惯性聚合 高效追踪和阅读你感兴趣的博客、新闻、科技资讯
阅读原文 在惯性聚合中打开

推荐订阅源

D
Docker
U
Unit 42
Google DeepMind News
Google DeepMind News
B
Blog RSS Feed
S
SegmentFault 最新的问题
阮一峰的网络日志
阮一峰的网络日志
雷峰网
雷峰网
Microsoft Security Blog
Microsoft Security Blog
爱范儿
爱范儿
Cyber Security Advisories - MS-ISAC
Cyber Security Advisories - MS-ISAC
博
博客园_首页
Apple Machine Learning Research
Apple Machine Learning Research
罗
罗磊的独立博客
GbyAI
GbyAI
Stack Overflow Blog
Stack Overflow Blog
Martin Fowler
Martin Fowler
宝玉的分享
宝玉的分享
L
LangChain Blog
Engineering at Meta
Engineering at Meta
量
量子位
有赞技术团队
有赞技术团队
博
博客园 - 【当耐特】
A
About on SuperTechFans
Y
Y Combinator Blog

Proceedings of the AAAI Conference on Artificial Intelligence

Resource Efficient Sleep Staging via Multi-Level Masking and Prompt Learning AutoMalDesc: Large-Scale Script Analysis for Cyber Threat Research Modulation-Based Backdoors: Leveraging Amplitude and Frequency Patterns to Attack Speaker Recognition Learning Structurally Stabilized Representations for Lossless DNA Storage ViG-RAG: Video-aware Graph Retrieval-Augmented Generation via Temporal and Semantic Hybrid Reasoning Transferable Backdoor Attacks for Code Models via Sharpness-Aware Adversarial Perturbation Toward Multimodal Fake News Detection by Multi-perspective Rationale Generation and Verification RTMol: Rethinking Molecule-text Alignment in a Round-trip View Physical-regularized Hierarchical Generative Model for Metallic Glass Structural Generation and Energy Prediction Regressor-guided Diffusion Model for De Novo Peptide Sequencing with Explicit Mass Control RareAgents: Autonomous Multi-disciplinary Team for Rare Disease Diagnosis and Treatment Transferring Causal Driving Patterns for Generalizable Traffic Simulation with Diffusion-Based Distillation TRACE: Transformation-Aware Graph Refinement for Reaction Condition Prediction SIDE: Surrogate Conditional Data Extraction from Diffusion Models DyC-STG: Dynamic Causal Spatio-Temporal Graph Network for Real-time Data Credibility Analysis in IoT ProAR: Probabilistic Autoregressive Modeling for Molecular Dynamics Light but Sharp: SlimSTAD for Real-Time Action Detection from Sensor Data VFCionX: Bridging Large and Small Models for Robust Vulnerability-Fixing Commit Identification T2Agent: A Tool-augmented Multimodal Misinformation Detection Agent with Monte Carlo Tree Search Measuring What Matters: Scenario-Driven Evaluation for Trajectory Predictors in Autonomous Driving DensiCrafter: Physically-Constrained Generation and Fabrication of Self-Supporting Hollow Structures Topology-Enhanced and Label Correlation-Aware Model for Protein-Protein Interaction Prediction InteChar: A Unified Oracle Bone Character List for Ancient Chinese Language Modeling NucEL: Single-Nucleotide ELECTRA-Style Genomic Pre-training for Efficient and Interpretable Representations OR-R1: Automating Modeling and Solving of Operations Research Optimization Problem via Test-Time Reinforcement Learning Learning from Long-Term Engagement: Adaptive Tutoring Dialogue Planning for Personalized Education Toward Time-Continuous Data Inference in Sparse Urban CrowdSensing Multi-Horizon Time Series Forecasting of Non-Parametric CDFs with Deep Lattice Networks From Stimuli to Minds: Enhancing Psychological Reasoning in LLMs via Bilateral Reinforcement Learning Unveiling the Attribute Misbinding Threat in Identity-Preserving Models
GARNET: GoT-Based Alert Reduction and Narrative Event Tra...
Yiru Gong, S · 2026-03-14 · via Proceedings of the AAAI Conference on Artificial Intelligence

Authors

  • Yiru Gong Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China School of Cyber Security, University of Chinese Academy of Sciences, Beijing, China
  • Song Liu Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China School of Cyber Security, University of Chinese Academy of Sciences, Beijing, China
  • Changzhi Zhao Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China School of Cyber Security, University of Chinese Academy of Sciences, Beijing, China
  • Junrong Liu Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China School of Cyber Security, University of Chinese Academy of Sciences, Beijing, China
  • Tian Tian Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China School of Cyber Security, University of Chinese Academy of Sciences, Beijing, China
  • Xiaobo Yang Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China School of Cyber Security, University of Chinese Academy of Sciences, Beijing, China
  • Bo Jiang Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China School of Cyber Security, University of Chinese Academy of Sciences, Beijing, China
  • Zhigang Lu Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China School of Cyber Security, University of Chinese Academy of Sciences, Beijing, China

DOI:

https://doi.org/10.1609/aaai.v40i1.36994

Abstract

Alerts generated by Security Operations Centers (SOCs) are often numerous and scattered, requiring significant effort from security analysts to manage, which severely slows response times. While recent alert correlation graph methods can effectively reduce alert volume, these graphs are often too complex for analysts to understand. As a result, analysts are increasingly seeking ways to automatically correlate alerts and generate concise, human-readable attack path summaries. Recently, Large Language Models (LLMs) have demonstrated superior performance due to their advanced capabilities in knowledge reserve and reasoning. In this work, we propose GARNET, a framework that uses LLMs for reasoning on alert correlation graphs. GARNET addresses three key technical challenges: 1) modality alignment between alert graphs and logs; 2) semantic alignment between alert graphs and logs; 3) enabling LLMs reasoning along graph paths. Specifically, we first project the embeddings of the graph and logs into the same vector space using contrastive learning. Then, we design self-supervised graph-log instructions to bridge the semantic gap between the graph and logs by training a novel LLM. Finally, GARNET uses a novel Graph-of-Thought (GoT)-based interaction reasoning approach to guide LLM reasoning along graph paths, ultimately generating structured, concise, and human-readable attack path summaries. Experimental results across six attack scenarios show that GARNET reduces false positives by an average of 80%, lowering the false positive rate to below 0.0037. It outperforms the latest approaches and provides more explainable attribution.

How to Cite

Gong, Y., Liu, S., Zhao, C., Liu, J., Tian, T., Yang, X., … Lu, Z. (2026). GARNET: GoT-Based Alert Reduction and Narrative Event Tracing. Proceedings of the AAAI Conference on Artificial Intelligence, 40(1), 327–335. https://doi.org/10.1609/aaai.v40i1.36994

Issue

Section

AAAI Technical Track on Application Domains I

此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。