{"id":"https://openalex.org/W7168180642","doi":"https://doi.org/10.48550/arxiv.2607.09176","title":"SherAgent: Scaling Attack Investigation in the Wild via LLM-Empowered Iterative Query-Filter Backtracking","display_name":"SherAgent: Scaling Attack Investigation in the Wild via LLM-Empowered Iterative Query-Filter Backtracking","publication_year":2026,"publication_date":"2026-07-10","ids":{"openalex":"https://openalex.org/W7168180642","doi":"https://doi.org/10.48550/arxiv.2607.09176"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2607.09176","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2607.09176","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2607.09176","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5140522206","display_name":"Zhenyuan Li","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Li, Zhenyuan","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5140551836","display_name":"Zhengkai Wang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Wang, Zhengkai","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5088052728","display_name":"Lu Jiang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Jiang, Ling","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5140548948","display_name":"Xiangmin Shen","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Shen, Xiangmin","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5140571497","display_name":"Ruixiao Lin","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Lin, Ruixiao","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5069450513","display_name":"Sen Nie","orcid":"https://orcid.org/0000-0003-4154-2941"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Nie, Sen","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5140549409","display_name":"Shi Wu","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Wu, Shi","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5140539442","display_name":"Shouling Ji","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Ji, Shouling","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11986","display_name":"Scientific Computing and Data Management","score":0.9370999932289124,"subfield":{"id":"https://openalex.org/subfields/1802","display_name":"Information Systems and Management"},"field":{"id":"https://openalex.org/fields/18","display_name":"Decision Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},"topics":[{"id":"https://openalex.org/T11986","display_name":"Scientific Computing and Data Management","score":0.9370999932289124,"subfield":{"id":"https://openalex.org/subfields/1802","display_name":"Information Systems and Management"},"field":{"id":"https://openalex.org/fields/18","display_name":"Decision Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.009100000374019146,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":0.0044999998062849045,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/backtracking","display_name":"Backtracking","score":0.7146000266075134},{"id":"https://openalex.org/keywords/dependency","display_name":"Dependency (UML)","score":0.5665000081062317},{"id":"https://openalex.org/keywords/context","display_name":"Context (archaeology)","score":0.5654000043869019},{"id":"https://openalex.org/keywords/overhead","display_name":"Overhead (engineering)","score":0.5550000071525574},{"id":"https://openalex.org/keywords/process","display_name":"Process (computing)","score":0.5440000295639038},{"id":"https://openalex.org/keywords/automation","display_name":"Automation","score":0.47110000252723694},{"id":"https://openalex.org/keywords/the-internet","display_name":"The Internet","score":0.41589999198913574},{"id":"https://openalex.org/keywords/iterative-and-incremental-development","display_name":"Iterative and incremental development","score":0.397599995136261}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7904999852180481},{"id":"https://openalex.org/C156884757","wikidata":"https://www.wikidata.org/wiki/Q798554","display_name":"Backtracking","level":2,"score":0.7146000266075134},{"id":"https://openalex.org/C19768560","wikidata":"https://www.wikidata.org/wiki/Q320727","display_name":"Dependency (UML)","level":2,"score":0.5665000081062317},{"id":"https://openalex.org/C2779343474","wikidata":"https://www.wikidata.org/wiki/Q3109175","display_name":"Context (archaeology)","level":2,"score":0.5654000043869019},{"id":"https://openalex.org/C2779960059","wikidata":"https://www.wikidata.org/wiki/Q7113681","display_name":"Overhead (engineering)","level":2,"score":0.5550000071525574},{"id":"https://openalex.org/C98045186","wikidata":"https://www.wikidata.org/wiki/Q205663","display_name":"Process (computing)","level":2,"score":0.5440000295639038},{"id":"https://openalex.org/C115901376","wikidata":"https://www.wikidata.org/wiki/Q184199","display_name":"Automation","level":2,"score":0.47110000252723694},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.41589999198913574},{"id":"https://openalex.org/C143587482","wikidata":"https://www.wikidata.org/wiki/Q1543216","display_name":"Iterative and incremental development","level":2,"score":0.397599995136261},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.3833000063896179},{"id":"https://openalex.org/C165064840","wikidata":"https://www.wikidata.org/wiki/Q1321061","display_name":"Matching (statistics)","level":2,"score":0.36959999799728394},{"id":"https://openalex.org/C77618280","wikidata":"https://www.wikidata.org/wiki/Q1155772","display_name":"Scheme (mathematics)","level":2,"score":0.34700000286102295},{"id":"https://openalex.org/C120314980","wikidata":"https://www.wikidata.org/wiki/Q180634","display_name":"Distributed computing","level":1,"score":0.3240000009536743},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.3228999972343445},{"id":"https://openalex.org/C2776505523","wikidata":"https://www.wikidata.org/wiki/Q4785468","display_name":"Plan (archaeology)","level":2,"score":0.29499998688697815},{"id":"https://openalex.org/C132964779","wikidata":"https://www.wikidata.org/wiki/Q2110223","display_name":"Raw data","level":2,"score":0.2856999933719635},{"id":"https://openalex.org/C79974875","wikidata":"https://www.wikidata.org/wiki/Q483639","display_name":"Cloud computing","level":2,"score":0.2809999883174896},{"id":"https://openalex.org/C2779585090","wikidata":"https://www.wikidata.org/wiki/Q3457762","display_name":"Resilience (materials science)","level":2,"score":0.2761000096797943},{"id":"https://openalex.org/C81917197","wikidata":"https://www.wikidata.org/wiki/Q628760","display_name":"Selection (genetic algorithm)","level":2,"score":0.2702000141143799},{"id":"https://openalex.org/C90673727","wikidata":"https://www.wikidata.org/wiki/Q901718","display_name":"Product (mathematics)","level":2,"score":0.26930001378059387},{"id":"https://openalex.org/C2780801425","wikidata":"https://www.wikidata.org/wiki/Q5164392","display_name":"Construct (python library)","level":2,"score":0.25920000672340393}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2607.09176","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2607.09176","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2607.09176","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2607.09176","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Provenance-based":[0],"attack":[1],"investigation":[2,35,67,90,109,135,188],"enables":[3],"viable":[4],"automation":[5],"by":[6,19,100,146,191],"standardizing":[7],"data":[8],"and":[9,22,33,62,92,137,166,193,201,217,234],"query":[10,153],"logic;":[11],"however,":[12],"it":[13,161,206],"is":[14],"critically":[15],"hindered":[16],"in":[17,26,53,95,179,214],"practice":[18],"dependency":[20,175],"explosions":[21],"fragmented":[23,142],"causal":[24,143],"chains":[25,144],"the":[27,40,86,123,149,157,180,186,239],"wild.":[28],"Towards":[29],"designing":[30],"a":[31,43],"robust":[32],"automated":[34,108],"tool,":[36],"we":[37,57,103],"collaborated":[38],"with":[39,208],"SOC":[41],"of":[42,49,72,74,89,127],"major":[44,93],"Internet":[45],"corporation":[46],"serving":[47],"billions":[48],"users.":[50],"By":[51],"engaging":[52],"real-world":[54],"incident":[55],"response,":[56],"are":[58],"able":[59],"to":[60,83,129,155,196],"evaluate":[61],"refine":[63],"their":[64,96],"existing":[65,97],"LLM-based":[66],"workflows,":[68],"which":[69],"processes":[70],"tens":[71],"thousands":[73,79],"raw":[75],"alerts":[76],"daily,":[77],"leaving":[78],"for":[80,170,242],"manual":[81],"triage,":[82],"find":[84],"out":[85],"root":[87],"causes":[88],"failures":[91],"challenges":[94],"tools.":[98],"Motivated":[99],"these":[101],"findings,":[102],"propose":[104],"SherAgent,":[105],"an":[106,113],"LLM-empowered":[107],"system.":[110],"Operating":[111],"on":[112],"iterative":[114],"``query-filter''":[115],"backtracking":[116],"paradigm":[117],"over":[118],"provenance":[119],"graphs,":[120],"SherAgent":[121,184,231],"leverages":[122],"semantic":[124],"reasoning":[125],"capabilities":[126],"LLMs":[128],"process":[130],"unstructured":[131],"data,":[132],"such":[133],"as":[134],"context":[136],"threat":[138],"intelligence.":[139],"To":[140],"overcome":[141],"caused":[145],"missing":[147],"events,":[148],"system":[150],"dynamically":[151],"calibrates":[152],"conditions":[154],"broaden":[156],"search":[158],"scope.":[159],"Concurrently,":[160],"performs":[162],"precision":[163],"result":[164],"filtering":[165],"strategic":[167],"nodes":[168],"selection":[169],"subsequent":[171],"exploration,":[172],"thereby":[173],"mitigating":[174],"explosions.":[176],"Extensive":[177],"evaluations":[178],"wild":[181],"demonstrate":[182],"that":[183,230],"improves":[185],"end-to-end":[187],"success":[189],"rate":[190],"31.1%":[192],"63.7%":[194],"compared":[195],"both":[197],"legacy":[198],"enterprise":[199],"baselines":[200],"SOTA":[202],"approaches,":[203],"respectively.":[204],"Furthermore,":[205],"operates":[207],"remarkable":[209],"efficiency,":[210],"incurring":[211],"under":[212],"$0.10":[213],"API":[215],"costs":[216],"requiring":[218],"less":[219],"than":[220],"4":[221],"minutes":[222],"per":[223],"investigation.":[224],"Finally,":[225],"our":[226],"user":[227],"study":[228],"confirms":[229],"provides":[232],"accurate":[233],"clear":[235],"insights,":[236],"significantly":[237],"reducing":[238],"analytical":[240],"overhead":[241],"security":[243],"experts.":[244]},"counts_by_year":[],"updated_date":"2026-07-28T07:46:37.118299","created_date":"2026-07-14T00:00:00"}