{"id":"https://openalex.org/W7167101603","doi":"https://doi.org/10.48550/arxiv.2607.00440","title":"Minos: A Multi-Agent Collaborative Framework for Provenance-Based Backward Tracking","display_name":"Minos: A Multi-Agent Collaborative Framework for Provenance-Based Backward Tracking","publication_year":2026,"publication_date":"2026-07-01","ids":{"openalex":"https://openalex.org/W7167101603","doi":"https://doi.org/10.48550/arxiv.2607.00440"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2607.00440","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2607.00440","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2607.00440","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5139891729","display_name":"Jiahui Wang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Wang, Jiahui","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5139859318","display_name":"Zhenyuan Li","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Li, Zhenyuan","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5139903236","display_name":"Zhengkai Wang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Wang, Zhengkai","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5139918972","display_name":"Xiangmin Shen","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Shen, Xiangmin","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5047301622","display_name":"F Zhang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Zhang, Fan","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11986","display_name":"Scientific Computing and Data Management","score":0.49300000071525574,"subfield":{"id":"https://openalex.org/subfields/1802","display_name":"Information Systems and Management"},"field":{"id":"https://openalex.org/fields/18","display_name":"Decision Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},"topics":[{"id":"https://openalex.org/T11986","display_name":"Scientific Computing and Data Management","score":0.49300000071525574,"subfield":{"id":"https://openalex.org/subfields/1802","display_name":"Information Systems and Management"},"field":{"id":"https://openalex.org/fields/18","display_name":"Decision Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":0.13779999315738678,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.09030000120401382,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/tree-traversal","display_name":"Tree traversal","score":0.522599995136261},{"id":"https://openalex.org/keywords/adversarial-system","display_name":"Adversarial system","score":0.47279998660087585},{"id":"https://openalex.org/keywords/context","display_name":"Context (archaeology)","score":0.46810001134872437},{"id":"https://openalex.org/keywords/graph","display_name":"Graph","score":0.37439998984336853},{"id":"https://openalex.org/keywords/forward-chaining","display_name":"Forward chaining","score":0.3310999870300293},{"id":"https://openalex.org/keywords/satisfiability-modulo-theories","display_name":"Satisfiability modulo theories","score":0.3273000121116638},{"id":"https://openalex.org/keywords/probabilistic-logic","display_name":"Probabilistic logic","score":0.32659998536109924},{"id":"https://openalex.org/keywords/precision-and-recall","display_name":"Precision and recall","score":0.3188999891281128}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7134000062942505},{"id":"https://openalex.org/C140745168","wikidata":"https://www.wikidata.org/wiki/Q1210082","display_name":"Tree traversal","level":2,"score":0.522599995136261},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.4747999906539917},{"id":"https://openalex.org/C37736160","wikidata":"https://www.wikidata.org/wiki/Q1801315","display_name":"Adversarial system","level":2,"score":0.47279998660087585},{"id":"https://openalex.org/C2779343474","wikidata":"https://www.wikidata.org/wiki/Q3109175","display_name":"Context (archaeology)","level":2,"score":0.46810001134872437},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.4343999922275543},{"id":"https://openalex.org/C80444323","wikidata":"https://www.wikidata.org/wiki/Q2878974","display_name":"Theoretical computer science","level":1,"score":0.4115000069141388},{"id":"https://openalex.org/C132525143","wikidata":"https://www.wikidata.org/wiki/Q141488","display_name":"Graph","level":2,"score":0.37439998984336853},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.34929999709129333},{"id":"https://openalex.org/C142614401","wikidata":"https://www.wikidata.org/wiki/Q777433","display_name":"Forward chaining","level":3,"score":0.3310999870300293},{"id":"https://openalex.org/C164155591","wikidata":"https://www.wikidata.org/wiki/Q2067766","display_name":"Satisfiability modulo theories","level":2,"score":0.3273000121116638},{"id":"https://openalex.org/C49937458","wikidata":"https://www.wikidata.org/wiki/Q2599292","display_name":"Probabilistic logic","level":2,"score":0.32659998536109924},{"id":"https://openalex.org/C81669768","wikidata":"https://www.wikidata.org/wiki/Q2359161","display_name":"Precision and recall","level":2,"score":0.3188999891281128},{"id":"https://openalex.org/C2775936607","wikidata":"https://www.wikidata.org/wiki/Q466845","display_name":"Tracking (education)","level":2,"score":0.3127000033855438},{"id":"https://openalex.org/C16311509","wikidata":"https://www.wikidata.org/wiki/Q4148050","display_name":"Dependency graph","level":3,"score":0.3118000030517578},{"id":"https://openalex.org/C2776214188","wikidata":"https://www.wikidata.org/wiki/Q408386","display_name":"Inference","level":2,"score":0.2976999878883362},{"id":"https://openalex.org/C193856179","wikidata":"https://www.wikidata.org/wiki/Q5251100","display_name":"Defeasible estate","level":2,"score":0.2874000072479248},{"id":"https://openalex.org/C2776927521","wikidata":"https://www.wikidata.org/wiki/Q468489","display_name":"Pursuer","level":2,"score":0.27810001373291016},{"id":"https://openalex.org/C178489894","wikidata":"https://www.wikidata.org/wiki/Q8789","display_name":"Cryptography","level":2,"score":0.27079999446868896},{"id":"https://openalex.org/C55439883","wikidata":"https://www.wikidata.org/wiki/Q360812","display_name":"Correctness","level":2,"score":0.2671000063419342},{"id":"https://openalex.org/C106131492","wikidata":"https://www.wikidata.org/wiki/Q3072260","display_name":"Filter (signal processing)","level":2,"score":0.2599000036716461},{"id":"https://openalex.org/C184337299","wikidata":"https://www.wikidata.org/wiki/Q1437428","display_name":"Semantics (computer science)","level":2,"score":0.2599000036716461},{"id":"https://openalex.org/C161301231","wikidata":"https://www.wikidata.org/wiki/Q3478658","display_name":"Knowledge representation and reasoning","level":2,"score":0.2587999999523163},{"id":"https://openalex.org/C156884757","wikidata":"https://www.wikidata.org/wiki/Q798554","display_name":"Backtracking","level":2,"score":0.25369998812675476},{"id":"https://openalex.org/C75165309","wikidata":"https://www.wikidata.org/wiki/Q2258979","display_name":"Search engine indexing","level":2,"score":0.25279998779296875}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2607.00440","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2607.00440","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2607.00440","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2607.00440","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[{"display_name":"Peace, Justice and strong institutions","id":"https://metadata.un.org/sdg/16","score":0.6848397850990295}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Sophisticated":[0],"cyber":[1],"attacks,":[2],"particularly":[3],"Advanced":[4],"Persistent":[5],"Threats":[6],"(APTs),":[7],"require":[8],"effective":[9],"post-intrusion":[10],"forensic":[11,165],"analysis.":[12],"Provenance-based":[13],"backward":[14,58,181],"tracking":[15,59,162],"reconstructs":[16],"attack":[17,123,148],"scenarios":[18,124],"by":[19],"tracing":[20],"causality":[21],"from":[22,47],"security":[23],"alerts,":[24],"but":[25],"existing":[26],"methods":[27],"rely":[28],"on":[29,121],"low-level":[30],"statistical":[31],"features":[32],"and":[33,45,83,110,138,167],"rigid":[34],"traversal":[35,106],"strategies,":[36],"limiting":[37],"their":[38],"ability":[39],"to":[40,86,114],"capture":[41],"high-level":[42],"adversarial":[43,84],"intent":[44],"suffering":[46],"dependency":[48],"explosion.":[49],"We":[50],"present":[51],"Minos,":[52],"a":[53,67,99],"multi-agent":[54],"framework":[55],"that":[56,130,150],"formulates":[57],"as":[60],"an":[61,133],"LLM-driven":[62,176],"reasoning":[63,79,88,109,159,177],"process.":[64],"Minos":[65,131,156],"adopts":[66],"two-tiered":[68],"architecture:":[69],"for":[70,90,178],"event-level":[71],"analysis,":[72],"it":[73,93],"combines":[74],"hierarchical":[75],"context":[76],"management,":[77],"retrieval-augmented":[78],"with":[80,107],"citation":[81],"verification,":[82],"deliberation":[85],"improve":[87],"quality;":[89],"graph":[91],"exploration,":[92],"coordinates":[94],"four":[95],"specialized":[96],"agents":[97],"under":[98],"finite":[100],"state":[101],"machine":[102],"(FSM),":[103],"replacing":[104],"exhaustive":[105],"hypothesis-guided":[108],"count-first":[111],"query":[112],"protocols":[113],"efficiently":[115],"prune":[116],"the":[117,161,173],"search":[118],"space.":[119],"Experiments":[120],"14":[122],"across":[125],"five":[126],"public":[127],"datasets":[128],"show":[129],"achieves":[132],"average":[134],"recall":[135],"of":[136,140,175],"0.92":[137],"precision":[139],"0.64,":[141],"significantly":[142],"outperforming":[143],"state-of-the-art":[144],"baselines":[145],"while":[146],"producing":[147],"subgraphs":[149],"are":[151],"49%":[152],"more":[153],"compact.":[154],"Moreover,":[155],"generates":[157],"interpretable":[158],"throughout":[160],"process,":[163],"facilitating":[164],"auditing":[166],"system":[168],"refinement.":[169],"These":[170],"results":[171],"demonstrate":[172],"effectiveness":[174],"automated":[179],"provenance-based":[180],"tracking.":[182]},"counts_by_year":[],"updated_date":"2026-07-28T07:46:37.118299","created_date":"2026-07-03T00:00:00"}