Minos: A Multi-Agent Collaborative Framework for Provenance-Based Backward Tracking Jiahui Wang1,2,∗ , Zhenyuan Li1,2,∗B , Zhengkai Wang1 , Xiangmin Shen3 , and Fan Zhang1 Zhejiang University, Hangzhou, China {wjh_13, lizhenyuan}@zju.edu.cn 2 Ningbo Key Laboratory of Quantum Software and Security, Ningbo, China 3 Hofstra University, Hempstead, NY, USA
arXiv:2607.00440v1 [cs.CR] 1 Jul 2026
1
Abstract. Sophisticated cyber attacks, particularly Advanced Persistent Threats (APTs), necessitate rigorous post-intrusion forensic analysis. Provenance-based backward tracking serves as a pivotal capability for reconstructing attack scenarios by tracing causality from initial alerts. However, existing methods frequently rely on low-level statistical features and rigid traversal strategies. These approaches fail to capture highlevel adversarial intent, especially against stealthy living-off-the-land techniques, and inevitably struggle with “dependency explosion”. To address these challenges, we propose Minos, a multi-agent collaborative framework that reconceptualizes backward tracking as a Large Language Model (LLM)-driven reasoning process. Minos operates via a two-tiered architecture. For individual event assessment, it introduces a structured framework to overcome the inherent limitations of LLMs: it employs a hierarchical context model for persistent state maintenance, implements retrieval-augmented reasoning with citation verification to ground inferences, and incorporates an adversarial deliberation mechanism to mitigate sycophancy bias. For end-to-end graph exploration, Minos orchestrates four specialized agents under a finite state machine (FSM), replacing exhaustive topological traversal with hypothesis-guided reasoning and “count-first” query protocols to prune the search space. Comprehensive evaluations on 14 attack scenarios across five public datasets demonstrate that Minos achieves average recall and precision of 0.92 and 0.64, respectively, significantly outperforming state-of-the-art baselines while generating attack subgraphs that are 49% more compact. Furthermore, Minos generates interpretable reasoning at every step, providing robust support for auditing and system refinement. Ultimately, our exploration validates the efficacy of leveraging LLMs for automated provenance-based backward tracking. Keywords: Backward Tracking · Provenance Analysis · Large Language Model · Multi-Agent System Two authors contribute equally to this work. B Corresponding author: [email protected] ∗
2
J. Wang et al.
1
Introduction
Sophisticated cyber attacks, particularly Advanced Persistent Threats (APTs), pose an escalating threat to critical infrastructures. As adversaries frequently evade initial defenses to establish prolonged persistence within compromised networks, the ability to reconstruct a comprehensive attack scenario after anomaly detection becomes a critical forensic capability. To support such post-intrusion analysis, provenance graphs [18] have emerged as instrumental tools: by parsing kernel-level audit logs into a unified graph representation where nodes represent system entities and edges capture causal interactions, they transform discrete, fragmented log entries into a temporal graph with inherent causality, enabling systematic investigation. The central objective in this investigation is backward tracking: starting from a Point-of-Interest (POI) event flagged by an Intrusion Detection System (IDS), analysts trace backward along the provenance graph to reconstruct the adversarial operations and locate the attack entry points [16]. Prior research has advanced backward tracking through several strategies, including reachability analysis [14,9], statistical anomaly detection [13], and semantic clustering [32]. Despite their contributions, existing approaches still encounter two critical challenges. First, they often rely on low-level features such as frequency, node degree, or structural connectivity to assess individual events, fundamentally lacking the capacity to capture the high-level adversarial intent behind system operations. This significant gap is particularly acute against living-off-the-land (LotL) techniques [1], where adversaries leverage legitimate system utilities to perform malicious actions, producing statistical and topological footprints indistinguishable from benign administrative activities. Second, their rigid, predefined traversal strategies fail to navigate the massive scale of provenance data efficiently. A single host can produce terabytes of logs daily, where attack-related events constitute less than 0.001‰of the total volume. Lacking intelligent pruning or heuristic strategies, these methods inevitably suffer “dependency explosion” at high-degree supernodes (e.g., system processes), resulting in degraded performance and excessive computational overhead. The advent of Large Language Models (LLMs) [2] offers promising insights for addressing these challenges. Regarding event assessment, LLMs can transcend low-level features by reasoning over the latent malicious intent, enabling more nuanced and high-fidelity judgments. Regarding “dependency explosion”, LLMbased agents can simulate the specialized division of labor characteristic of human investigation teams to replace blind traversal with reasoning-driven, hypothesisguided exploration. Motivated by these insights, we propose Minos, a framework that formulates backward tracking as a multi-agent collaborative reasoning process. Minos addresses the two core challenges through a decomposed, two-tiered architecture. For individual event assessment, Minos introduces a structured reasoning framework explicitly designed to overcome three inherent limitations of generic LLMs: to counter context window constraints during prolonged tracking, a hierarchical context model employs a dual-grained design to maintain a condensed yet rich global tracking state; to eliminate knowledge cutoffs and hallucinations, a
Minos: A Multi-Agent Collaborative Framework for Backward Tracking
3
retrieval-augmented module with automated citation verification enhances the reasoning capability while anchoring each inference to traceable sources; and to mitigate the false positives induced by sycophancy bias, an adversarial deliberation mechanism (prosecutor–defense–judge) systematically extracts supporting evidence from both malicious and benign perspectives before yielding an objective event assessment through impartial arbitration. For end-to-end graph exploration, Minos partitions the complex investigation task into four specialized agent roles orchestrated by a finite state machine (FSM). The Planner agent serves as the hypothesis-driven commander, guiding the backward tracking through high-level semantic reasoning rather than rigid topological traversal. The Query agent acts as the data interface, employing a “count-first” protocol to securely retrieve system events while preventing “dependency explosion” at high-degree nodes. The Adversarial Assessment Group focuses on individual event assessment using the aforementioned adversarial deliberation. Finally, the Memory agent centralizes the tracking state, dynamically updating the evolving context to ensure logical coherence across the entire tracking lifecycle. We evaluate Minos on 14 attack scenarios spanning five public datasets across three operating systems. Specifically, Minos achieves an average recall of 0.92 and precision of 0.64, representing a significant improvement over the baselines, while producing attack subgraphs that are 49% more compact. The multi-agent architecture also exhibits a decisive advantage over the single-agent baseline. Additionally, the ablation studies validate the effectiveness of each design component. Furthermore, the cross-model experiments reveal that the tracking performance can be optimized by tailoring the underlying LLM backbone to the specific cognitive demands of each agent role. Our principal contributions are summarized as follows: – We design an LLM-based reasoning framework for individual event assessment that addresses three inherent limitations of LLMs through hierarchical context model, retrieval-augmented reasoning, and adversarial deliberation. – We architect a multi-agent collaborative system with four specialized agents orchestrated by an FSM, enabling efficient and interpretable backward tracking on massive provenance graphs. – We conduct comprehensive experiments on 14 attack scenarios across 5 public datasets, demonstrating that Minos achieves significant improvements over state-of-the-art methods in both reconstruction fidelity and subgraph compactness.
2
Background and Problem Formulation
2.1
Provenance Graphs.
In cybersecurity, continuous system auditing is a fundamental capability for monitoring and defending computing infrastructures. To achieve this, modern operating systems are instrumented via kernel-level audit frameworks [33] to record fine-grained system calls (e.g., read, write). These recorded operations are
4
J. Wang et al.
then systematically modeled as a provenance graph—a directed acyclic graph G = (V, E) where nodes V represent system entities (e.g., processes, files) and edges E denote causal dependencies among them (e.g., process spawning, file accesses), as Fig. 1 shows. By unifying isolated system calls into a causal topology, provenance graphs transform raw audit logs into a structured behavioral history, effectively bridging the gap between discrete audit data and comprehensive security analysis [18]. 2.2
Backward Tracking.
Modern security operations often leverage provenance-based IDS, which employ specific detection algorithms to identify suspicious behaviors and generate alerts. These alerts, termed POIs, represent localized anomalies whose broader context remains unknown. To uncover the full sequence of malicious activities, analysts perform backward tracking: starting from a POI event epoi , they traverse the provenance graph backward to trace its causal dependencies. This process aims to reconstruct the complete attack scenario preceding the POI and locate the root cause [16]. Formally, given a provenance graph G = (V, E) and a POI event epoi , backward tracking aims to recover an attack subgraph G∗ ⊆ G, which is defined as: G∗ = {e ∈ E | Rattack (e, epoi )}.
(1)
Rattack is a binary predicate indicating whether e is a causal ancestor of epoi and is relevant to the underlying attack campaign. The optimization objective is to minimize |G∗ | to ensure compactness while maintaining completeness with respect to Rattack . Since the full scope of an attack is often manifested incrementally, the backward tracking task can be formulated as an iterative discovery process. At each step t, an exploration policy π identifies a set of candidate events based on the current state: Et = π(G, G∗t−1 ). (2) Subsequently, a decision function f evaluates the relevance of each candidate e ∈ Et : ye = f (e, It ), (3) where It denotes the information that can be gathered to support the assessment of e. The tracking process proceeds as follows: G∗0 = {epoi }; 2.3
G∗t = G∗t−1 ∪ {e ∈ Et | f (e, It ) = 1}.
(4)
Core Challenges.
According to Eq. 1–4, the fidelity of the recovered subgraph G∗ is determined by the synergy between the exploration policy π and the decision function f . In practice, however, both components face bottlenecks arising from the inherent complexity of provenance data and the stealthy nature of modern attacks.
Minos: A Multi-Agent Collaborative Framework for Backward Tracking Scenario A: Routine Maintenance
Scenario B: Persistence Technique
192.168.10.7
78.205.13.17
services.exe kernel32.dll
5
tomcat.exe config.xml
maintenance.ps1
upload_8f3a.tmp
PowerShell
PowerShell
…/Tasks/job-A.xml
…/Tasks/payload.xml
Fig. 1. Semantic ambiguity in provenance graphs. The target event (PowerShell creating a scheduled task) is structurally and statistically identical in both scenarios
C1. As illustrated in Fig. 1, events in provenance graphs often appear neutral when observed in isolation. For instance, a PowerShell process creating a scheduled task could equally represent a routine administrative operation or a malicious persistence mechanism. Existing approaches typically evaluate events by constructing It from low-level features, like metadata, frequency or node degree [13,9]. However, these features are increasingly ineffective against LotL techniques [1], since attackers hijack native OS binaries to mask their actions, generating causal patterns devoid of obvious structural anomalies. C2. The massive scale of provenance data poses a significant challenge for efficient subgraph recovery [13]. While continuous monitoring easily yields terabytescale records daily per host, genuine adversarial events remain extremely sparse, generally falling below 0.001‰. To achieve π, existing exploration strategies, such as connectivity-based traversals (e.g., BFS or DFS), frequently encounter high-degree system process nodes (e.g., svchost.exe or bash) that interact with thousands of entities. Expanding through these nodes causes the candidate set Et to grow exponentially, resulting in excessive computational overhead and the accumulation of irrelevant background events. The rapid advancement of LLMs [28,2] presents pivotal insights for addressing these challenges: Regarding C1, pre-trained on massive corpora, LLMs are equipped with semantic priors over operating-system primitives, command-line idioms, and adversarial techniques, which allows them to transcend low-level features and reason over the latent malicious intent underlying system events [4,11,25], yielding more accurate event assessment. For C2, LLM-based agents can plan, decompose, and coordinate sub-tasks through tool use [31,30], allowing the exploration policy to mimic the iterative workflow of human SOC analysts and replace exhaustive topological traversal with reasoning-driven, on-demand queries. Building upon these two insights, we design the Minos system.
3
Individual Event Assessment
As discussed in Section 2, addressing the semantic ambiguity of individual events (C1) requires transcending low-level statistical features to perform intent-level reasoning. However, directly applying generic LLMs to construct the decision
6
J. Wang et al. ① Fetch Hierarchical Context ② RAG & Citation Verification ③ Adversarial Reasoning Coarse-grained Tactical Sequence
Candidate Event
[Execution]
attack log 1
attack log 3
Log Schema
+
[Collection]
Fine-grained Semantic Narrative attack log 2
Multi-Source RAG -------
CTI Reports TTP Matrix
[Persistence]
PowerShell …/payload.xml
[Exfiltration]
[Initial Access]
cmd.exe (PID: x) spawned by IOC nginx.exe IOC Exploitation ...
summarize (PID: x)
BM25
Hybrid Embedding Index
Citation Verification Alg.
Agents Debate Assume Malicious
Assume Benign
Evidence
Evidence
Citation Verification
[CTI] Report ID Verification
…
[MITRE] TTP ID Verification
Final Adjudication
Update Context (if attack-related)
Fig. 2. The structured framework for event assessment
function f encounters three inherent limitations. First, LLM invocations are stateless; they cannot accumulate the evolving context throughout backward tracking, despite such historical state being essential for accurate intent reasoning. Second, due to knowledge cutoff and domain knowledge gaps, LLMs struggle to keep pace with the rapid evolution of adversarial techniques, leading to hallucinations [15]. Third, LLMs exhibit sycophancy bias [29], a tendency to over-accommodate implicit prompt assumptions, which manifests as systematic false positive escalations in security investigations. To overcome these limitations, we formulate the individual event assessment as a structured framework powered by three corresponding mechanisms. Fig. 2 illustrates the complete workflow. 3.1
Hierarchical Context Representation.
To address the stateless nature of LLM invocations, a sustainable mechanism for maintaining the tracking state is required. Given the protracted timeframes and immense data volumes of APT campaigns, linearly concatenating raw historical events to the prompt rapidly surpasses context window constraints [19]. Accordingly, we propose a hierarchical context model that dynamically abstracts confirmed malicious events into two complementary dimensions: a fine-grained semantic narrative and a coarse-grained tactical sequence. The fine-grained context serves as an evolving narrative summary of confirmed attack-related events, preserving critical forensic artifacts (e.g., abnormal command lines or file paths) to reconstruct the attack scenario and anchor localized causal reasoning. However, since cyberattacks unfold as phased campaigns, accurately interpreting event intent also requires global tactical awareness. Therefore, we introduce a coarse-grained context that maps known malicious events to the MITRE ATT&CK framework [26], forming a sequential tactical chain (e.g., [Initial Access - Execution - Persistence]). By monitoring the logical completeness of the attack lifecycle, this sequence enables the system to recognize campaign boundaries, acting as a global constraint against localized reasoning. We select MITRE ATT&CK as the mapping target because recent studies have demonstrated that LLMs possess a strong inherent capability to align system events with its standardized taxonomy. Both levels are dynamically updated as new malicious events are encountered. The fine-grained context employs LLM-driven incremental summarization,
Minos: A Multi-Agent Collaborative Framework for Backward Tracking
7
emulating a memory decay strategy [23] that preserves immediate details while compressing distant history. The coarse-grained sequence is updated by prompting the LLM to infer appropriate MITRE mappings via a prompt-engineering mechanism established in prior work. Prompt templates for both mechanisms are detailed in the Appendix B. 3.2
Retrieval-Augmented Reasoning with Citation Verification.
While the hierarchical context captures the evolving state, accurately interpreting event intent requires mitigating the domain knowledge gap and hallucinations. We introduce a Retrieval-Augmented Generation (RAG) module [17] built upon a multi-source knowledge base aggregating: (1) Cyber Threat Intelligence (CTI) reports, providing insights into the latest adversarial techniques to circumvent knowledge cutoff; (2) the MITRE ATT&CK TTPs matrix [26], offering technique descriptions and execution examples to facilitate intent inference; and (3) system log schemas, standardizing heterogeneous audit fields. As cybersecurity analysis integrates both high-level attack semantics and exact technical IoCs (e.g., IP addresses or file hashes), we implement a hybrid retrieval strategy fusing dense vector similarities and sparse BM25 scores equally to retrieve the top-3 most relevant fragments. Moreover, to ensure the generated intent analysis is highly traceable, we enforce a strict citation protocol. The LLM must explicitly cite the factual provenance of its outputs: label [CTI] for retrieved threat reports, label [MITRE] for tactical references, and label [KNOWN] for model’s intrinsic knowledge. A deterministic algorithm validates these citations by cross-referencing [CTI] against the retrieved source list and verifying [MITRE] identifiers via regular expressions. Unmatched claims are flagged as [SUSPECT], yielding a quantified credibility summary that anchors the assessment to grounded evidence. 3.3
Adversarial Reasoning for Intent Verification.
Despite leveraging enriched context and retrieved knowledge, a single LLM for intent assessment frequently exhibits sycophancy bias [29], misclassifying benign events as malicious and causing excessive false positives. To mitigate this, we propose an adversarial reasoning framework [8] featuring three specialized agents: a prosecutor, a defense attorney, and a judge. In the initial phase, the prosecutor and defense agents independently analyze the target event under opposing assumptions—malicious and benign intent, respectively. Both agents exhaustively extract supporting evidence from the hierarchical context, retrieved knowledge, and intrinsic knowledge, providing formal citations for every claim. The verification algorithm then parses these citations to generate a credibility summary, flagging unverified claims. In the adjudication phase, the judge agent receives the opposing arguments together with their credibility summaries as input, and sequentially evaluates causal dependencies, evidence grounding, and action consistency to render a final verdict substantiated by transparent reasoning. This adversarial architecture
+ BM25
Evidence
Hybrid Index Embedding
tic Narrative
Evidence
Citation Verification
cmd.exe (PID: 4872) spawned by nginx.exe IOC (PID: 1024) – Exploitation … IOC
Citation Verification Algorithm [CTI] Report ID Verification
Final Adjudication
[MITRE] TTP ID Verification
Update Context (if attack-related)
8
J. Wang et al.
[Exfiltration]
Self-Correction
Planner Agent
Query Agent count-first protocol
hypothesis-driven Query Instructions
Provenance Graph DB
Backpressure (𝑛 > 𝜃)
Query Agent
Adversarial ssment Group
count-first protocol
Provenance Graph DB
ieval-Augmented
ate
Knowledge Base
Adversarial Group
Memory Agent fine narrative
Retrieval-Augmented
coarse tactical sequence
Self-Correction
Knowledge Base
Context Update
Fig. 3. Overview of the multi-agent collaborative architecture
necessitates a comprehensive assessment of benign alternatives, thereby significantly alleviating sycophancy bias. Prompt templates for these three agents are detailed in the Appendix B.
4
Multi-Agent Collaborative Backward Tracking
While the mechanisms introduced in Section 3 establish a solid foundation for evaluating a single event, constructing an end-to-end backward tracking system requires the effective implementation of the exploration policy π defined in Section 2. Specifically, the system must navigate the massive and complex topology of the provenance graph strategically to reconstruct the attack scenario without suffering from dependency explosion. Rather than relying on blind traversal, Minos employs a dynamic exploration strategy that explicitly determines the subsequent investigatory paths based on the current state. Minos achieves this through a multi-agent collaborative framework that emulates the functional specialization of human Security Operations Centers (SOCs). Fig. 3 illustrates this system architecture. 4.1
Role Specialization and Agent Design.
Drawing inspiration from specialized human labor division, Minos partitions the investigation responsibilities across discrete task units fundamental to the backward tracking process. Particularly, the system proposes four specialized agents, whose roles are codified in Table 1. The Planner Agent serves as the decision-making core governing the exploration policy π. It receives all current investigation state as input, including the POI event, hierarchical context, and action history, and outputs explicit instructions for the subsequent step. Since Minos iteratively queries the graph database to fetch candidates for evaluation, the Planner’s output is formalized as a structured query instruction (e.g., query the process that connected to the specific IP). As human analysts do not blindly scan logs but actively seek evidence based on their understanding of the attack progress, the Planner similarly performs a hypothesis-driven reasoning strategy rather than executing topological traversals like BFS. The Planner leverages the current context to explicitly
Minos: A Multi-Agent Collaborative Framework for Backward Tracking
9
Table 1. Specialized agent roles and their corresponding responsibilities in Minos Agent Role
Core Responsibility
Planner Determines the next tracking candidates Query Translates instructions and query data Adversarial Group Evaluates the intent of candidate events Memory Maintains the hierarchical context
propose hypotheses regarding the attacker’s next steps. To implement this, the Planner adopts a progressive three-tier strategy: (1) an initial backward expansion centered on the POI to establish a local footprint; (2) an edge-first exploration focusing on low-degree frontier nodes to broaden the subgraph efficiently; and (3) a continuous constraint that anchors hypotheses to the tactical lifecycle (e.g., if data exfiltration is confirmed, the Planner hypothesizes prior credential access activities). This design ensures that the search space is semantically constrained by the attack logic rather than relying solely on topological connectivity. The prompt template for the Planner agent is provided in the Appendix. Recognizing that strategic planning and the generation of query languages (e.g., Cypher) are cognitively distinct operations, Minos decouples these functionalities. A dedicated Query Agent is designed to receive the Planner’s natural language instructions and translate them into executable query code. This separation insulates the planning framework from the database infrastructure, allowing seamless migration across different storage engines by simply reconfiguring the Query Agent. Furthermore, this architectural decoupling enables the deployment of specialized LLMs optimized specifically for code generation to power the Query Agent, thereby enhancing the fidelity of query translation. The Query Agent incorporates two pivotal self-feedback mechanisms. The first is the “count-first” protocol, engineered to mitigate the data explosion. Considering that high-degree nodes in provenance graphs may connect to tens of thousands of events, executing naive queries directly would return an immense volume of candidates, incurring significant computational overhead on irrelevant background noise. Therefore, before fetching any data, the Query Agent executes a counting probe to quantify the candidate volume n. If n exceeds a predefined threshold θmax , it triggers a backpressure feedback signal, compelling the Planner to generate more stringent query instructions (e.g., by imposing tighter temporal windows). This self-optimization rigorously ensures the safety and efficiency of the query phase. A potential risk of this protocol is that attack-relevant events in high-degree neighborhoods may be filtered out when the Planner narrows the candidate set. However, since refinements are guided by the current investigation context rather than blind down-sampling, such omissions are unlikely in practice, making the protocol a favorable efficiency-coverage trade-off. The second mechanism is syntactic self-correction. To address the instability of LLM-based code generation, Minos routes any database execution errors back to the Query Agent to trigger an iterative repair process. Queries that fail to execute within a specified retry limit are bypassed to prevent infinite loops. The Memory Agent is primarily responsible for the maintenance and synchronous update of the hierarchical context introduced in Section 3, serving as
10
J. Wang et al.
the foundational state for the tracking process. The Adversarial Assessment Group, which is composed of the Prosecutor, Defense Attorney, and Judge agents, executes the intent reasoning mechanisms to function as the de facto arbiter for any event assessment. The orchestration of these specialized agents manifests the principle of taskoriented division of labor. By integrating hypothesis-driven exploration with intent-aware assessment, this framework systematically mitigates the dependency explosion of provenance graph (Challenge C2) while effectively resolving the semantic ambiguity of individual events (Challenge C1). 4.2
Automated Backward Tracking Orchestration.
These specialized agents collaborate through a FSM control loop to autonomously execute backward tracking. In each iteration, the Planner proposes a hypothesis, the Query Agent fetches candidate events under the “count-first” protocol, and the Adversarial Group adjudicates the intent of these events. Crucially, once an event is confirmed as attack-related, it triggers the Memory Agent to execute a context update, synchronously recalibrating both the fine-grained narrative and the coarse-grained tactical sequence to inform the next planning iteration. This iterative cycle is rigorously governed by multi-dimensional termination conditions designed to balance investigation completeness with operation safety. The orchestration loop terminates immediately if any of the following criteria are met: (1) logical completeness: the Planner autonomously infers via the coarsegrained context that the tactical chain has converged upon the root intrusion vector (e.g., the [Initial Access] stage), rendering further backward traversal redundant; (2) exploration sufficiency: the size of the attack-related subgraph remains stagnant for a predefined number of consecutive rounds (Nstag ), indicating the exhaustion of valid causal paths; or (3) system safety: an upper-bound on the total number of iterations (Nmax ) is reached, effectively preventing infinite loops. 4.3
State Persistence and Explainability.
A fundamental requirement for automated security systems is decision transparency. Minos achieves this by persistently serializing the comprehensive investigation state into structured audit logs at each FSM iteration. These persistent records encapsulate the holistic inferential lineage: the Planner’s strategic hypotheses, the specific CTI and MITRE fragments retrieved, and the multi-agent debate transcripts underlying every intent inference. This comprehensive persistence mechanism transcends the black-box nature of typical backward tracking systems, establishing a verifiable and accountable digital evidence chain. Consequently, security experts can conduct high-fidelity auditing of the reasoning trajectory for every node incorporated into the attack subgraph. Moreover, this interpretable trail enables analysts to pinpoint investigation failures, trace systematic misjudgments back to discrete reasoning discrepancies, and leverage these insights to fine-tune Minos’s strategies, prompt designs, and orchestration logic.
Minos: A Multi-Agent Collaborative Framework for Backward Tracking
5
11
Experiments
In this section, we present a systematic evaluation of Minos to investigate its reasoning performance and efficiency as a multi-agent collaborative framework for provenance-based backward tracking. Our evaluation is guided by three primary research questions: – RQ1: How effective is Minos compared to state-of-the-art approaches? – RQ2: How do different LLM backbones affect the performance of each specialized agent? – RQ3: How do individual components contribute to the performance of Minos? 5.1
Implementation.
Experimental Setup. Minos is implemented in Python 3.10 using LangGraph, employing Neo4j as the graph database backend. The Query Agent is powered by GPT-5.2-Codex [21], while the remaining agents utilize GPT-5.2 [22] as the core reasoning engine unless otherwise specified. The inference temperature of the Query Agent is set to 0 for deterministic code generation, whereas the other agents use the provider’s default temperature setting to preserve their reasoning diversity. Text embeddings are generated via text-embedding-3-large (3072 dimensions). We set α=0.7, top-K=3, θmax =50, Nstag =20, and Nmax =75. To simulate an initial security alert, we select the chronologically final malicious event in the ground truth as the POI event. Datasets and Baselines. We evaluate our system on advanced provenance datasets: (1) the DARPA Transparent Computing (TC) datasets [6], including Cadets, Trace, and Theia scenarios, which contain real-world APT scenarios interleaved with massive background noise; (2) the Aurora dataset [27], which is generated by an automated attack emulation engine that synthesizes stealthy attack chains by drawing on the curated catalog of living-off-the-land binaries and scripts maintained by the LOLBAS project [20]; and (3) the OpTC dataset [5], which represents enterprise-level APT campaigns. These three datasets provide a total of 14 attack scenarios, whose detailed descriptions are available in Table 5 in the Appendix. We compare Minos against three baselines representing distinct analytical mechanisms: (1) NoDoze [13], a frequency-based statistical framework that assigns anomaly scores based on the historical frequency of system events, aiming to identify rare, suspicious activities from the pervasive background noise inherent in provenance logs. (2) DepImpact [9], a learning-based analytical system that extracts shallow event features and employs a Latent Dirichlet Allocation (LDA) model to score discrete system activities. It identifies critical attack paths by backpropagating threat scores from the POI, essentially formulating the investigation as a task of quantifying and propagating causal impact. (3) a Single-Agent baseline, which encapsulates the full suite of investigative capabilities within an independent GPT-5.2 instance. This agent operates via a standard ReAct [31]
12
J. Wang et al.
Table 2. Effectiveness of attack subgraph reconstruction across 14 evaluation scenarios. |G| reports the output subgraph size with the ground-truth size in parentheses NoDoze
Scenario
DepImpact
Single-Agent
Minos
Rec. Prec. |G| (GT) Rec. Prec. |G| (GT) Rec. Prec. |G| (GT) Rec. Prec. |G| (GT) OpTC C1
0.69
0.14
128 (26) 0.69
0.23
78 (26)
0.38
0.10
152 (26)
0.92
0.63
38 (26)
OpTC C2
0.72
0.16
225 (50) 0.58
0.22
132 (50) 0.42
0.11
148 (50)
0.90
0.60
75 (50)
OpTC C3
0.66
0.09
257 (35) 0.63
0.20
110 (35) 0.40
0.09
145 (35)
0.89
0.57
54 (35)
Aurora C1 0.88
0.18
83 (17)
0.82
0.30
46 (17)
0.65
0.25
68 (17)
1.00
0.74
23 (17)
Aurora C2 0.70
0.12
134 (23) 0.74
0.20
85 (23)
0.58
0.20
75 (23)
0.96
0.69
32 (23)
Aurora C3 0.74
0.12
167 (27) 0.70
0.45
42 (27)
0.56
0.22
72 (27)
0.93
0.76
33 (27)
Trace C1
0.73
0.10
110 (15) 0.60
0.16
56 (15)
0.15
0.30
7 (15)
0.87
0.57
23 (15)
Trace C2
0.78
0.15
94 (18)
0.67
0.22
55 (18)
0.22
0.33
10 (18)
0.89
0.62
26 (18)
Theia C1
0.77
0.12
83 (13)
0.62
0.18
45 (13)
0.31
0.08
130 (13)
0.92
0.60
20 (13)
Theia C2
0.80
0.17
141 (30) 0.70
0.26
81 (30)
0.38
0.10
120 (30)
0.93
0.67
42 (30)
Cadets C1 0.71
0.24
50 (17)
0.65
0.20
55 (17)
0.35
0.07
195 (17)
1.00
0.71
24 (17)
Cadets C2 0.50
0.05
80 (8)
0.50
0.13
31 (8)
0.38
0.06
200 (8)
0.75
0.50
12 (8)
Cadets C3 0.61
0.20
134 (44) 0.73
0.35
92 (44)
0.42
0.08
185 (44)
0.95
0.68
62 (44)
Cadets C4 0.76
0.14
114 (21) 0.57
0.29
42 (21)
0.38
0.09
180 (21)
0.90
0.63
30 (21)
Average
0.14
129 (24) 0.66
0.24
68 (24)
0.40
0.15
120 (24) 0.92 0.64
35 (24)
0.72
prompting loop and is granted access to the identical database query and knowledge retrieval toolset as Minos. This baseline serves as a controlled ablation to validate the architectural superiority of our multi-agent collaborative framework. We evaluate effectiveness using edge-level recall and precision, along with the final output subgraph size (|G|). For efficiency, we measure the end-to-end backward tracking time and total LLM token consumption. 5.2
RQ1: Overall Effectiveness.
Table 2 summarizes the performance of all systems across 14 attack scenarios. Generally, Minos achieves superior recall and precision while producing significantly more compact attack subgraphs than all baselines. Specifically, in complex scenarios involving massive background system activities, such as the OpTC and Theia datasets, existing systems suffer severely from “dependency explosion”. NoDoze and DepImpact exhibit notably low precision, retaining hundreds of irrelevant edges due to their inability to distinguish between structurally reachable benign events and genuinely adversarial operations. In contrast, Minos maintains consistently high precision by leveraging intent reasoning to filter semantically irrelevant events, demonstrating its robustness in noisy environments. In datasets with more distinctive attack patterns, such as Aurora, all systems achieve relatively high recall, reflecting the attack sequences’ alignment with standard tracking assumptions. However, the baselines still generate larger subgraphs due to their misclassification of benign administrative events. Minos produces the smallest and highest-fidelity attack subgraphs, attributed to
68
0
N.
D.
S.
0
H.
OPTC (3)
1800
S
1200
425
1392
42
N.
D.
N.
D.
S.
555
200 900 0
H.
0
N.
S.
0
N.
D.
S.
0
H.
Trace (2)
K 600 400
1512
200
197
225 D.
0
H.
2652 Time Token
105 0
S.
Aurora (3)
400 1800 178
600
18
K 600 2700 S
1680
Time Token
0
0
H.
Cadets (4) Theia (2) Minos: A Multi-Agent Collaborative Framework for Backward Tracking
1800
S
Time 1482 Token 405
1200 68
0
N. S
1680 425
95
205
N.
D.
Theia (2)
0
N. K
1392
600 2700
S
400 1800
M.
K
Time Token
18
M.
200 900 0
S.
S
750
684
168
75
D. S. Aurora (3) 2652 Time Token 555
M.
200 600 0
D. S. OPTC (3)
178
600
600 1800 400 1200
148
Time Token
1200
0
1230 165
600
1800
K
0
42
105
225
N.
D.
600 1800
200 600
197
Cadets (4)
M.
260
400 558
217
200
58
0
600 1800
0
Time Token
1555
M. K 1290
350 164
200 600 0
D. S. Trace (2)
S
400 1200
0 S.
124 N.
K
1758 K 600
Time Token
400 1200
0
1512
S
13
82
176
N.
D.
600 400 200 0
S.
M.
Average
Fig. 4. Overhead across five datasets. Left y-axis denotes end-to-end execution time (seconds) and right y-axis denotes total LLM token consumption (K). X-axis abbreviations: N.=NoDoze, D.=DepImpact, S.=Single-Agent, M.=Minos
the Aurora attacks’ strict adherence to the MITRE ATT&CK tactical order [26], which enables the coarse-grained context to terminate unnecessary exploration paths efficiently. On the Cadets dataset, a notable exception is Cadets Case 2, where recall drops to 0.75. Our analysis reveals this is caused by a specific technique that maps to multiple MITRE tactical stages, leading the system to prematurely terminate backward tracking before full coverage. The Single-Agent baseline further highlights the limitations of independent LLM-based backward tracking, achieving only 0.40 average recall and 0.15 precision with 120 edges per subgraph. Analysis reveals two failure modes: (1) on the large-scale Trace dataset, the single context window saturates rapidly, causing premature termination; (2) on Cadets and Theia, the absence of adversarial cross-validation allows initial misjudgments to propagate along causal chains, inflating subgraphs to 130–200 edges with precision as low as 0.06–0.10. These results validate the architectural design of Minos: multi-agent separation prevents context overflow, while adversarial assessment improves the accuracy of reasoning. Fig. 4 further reports the backward tracking overhead. NoDoze and DepImpact, as non-LLM statistical methods, complete tracking within seconds, whereas both LLM-based systems require substantially longer due to iterative inference latency. Minos achieves an average backward tracking time of 1,290 seconds, moderately faster than the Single-Agent baseline, while consuming significantly fewer tokens. The token efficiency gain stems directly from Minos’s architecture: the “count-first” protocol prevents wasteful queries on high-degree nodes, and the adversarial assessment reduces the exploration on the wrong branches. Notably, on the Trace dataset, Minos requires more time (1,758s) than the Single-Agent (558s), but this is because the Single-Agent terminates prematurely due to context overflow rather than completing a thorough investigation. While the LLM-based
14
J. Wang et al. Table 3. Impact of LLM backbone selection averaged across all scenarios Query Agent
Other Agents Rec. Prec. |G| (GT) Tokens
Group A: Varying Query Agent (code generation) Qwen3-Coder-30B GPT-5.2 0.45 0.15 95 (24) Qwen3-Coder-480B GPT-5.2 0.76 0.36 62 (24) DeepSeek-R1 GPT-5.2 0.87 0.53 46 (24)
305K 195K 198K
Group B: Varying Other Agents (intent reasoning) GPT-5.2-Codex Qwen3.5-122B 0.76 0.33 65 (24) GPT-5.2-Codex Qwen-Max 0.91 0.62 37 (24) GPT-5.2-Codex DeepSeek-V3 0.85 0.48 50 (24) GPT-5.2-Codex DeepSeek-R1 0.88 0.55 42 (24)
198K 175K 118K 208K
GPT-5.2-Codex
164K
GPT-5.2
0.92 0.64
35 (24)
approaches incur approximately two orders of magnitude higher latency than traditional methods, the backward tracking time remains practical for real-world security operations, where manual analysis typically requires hours to days per incident. 5.3
RQ2: Impact of LLM Backbone Selection.
A key advantage of the multi-agent architecture is enabling each agent to leverage a backbone best suited to its task characteristics. Since the Query Agent performs structured code generation whereas the remaining agents perform semantic intent reasoning, these two roles impose divergent requirements on the underlying LLM. Therefore, we conduct controlled experiments across two groups and the results are shown in Table 3: Group A varies the Query Agent’s LLM backbone while keeping the reasoning agents at GPT-5.2 [22], and Group B varies the remaining agents’ LLM backbone while maintaining the Query Agent at GPT-5.2-Codex [21]. In Group A, the smaller Qwen3-Coder-30B [3] struggles to generate valid Cypher at a high rate, causing excessive retries. Scaling to 480B partially mitigates this deficiency, yet queries still exhibit semantic imprecision under complex conditions. DeepSeek-R1 [12] narrows the performance gap but slightly increases token consumption due to the thinking mode. GPT-5.2-Codex, which synthesizes reasoning capability with dedicated code optimization, achieves the best overall balance. These results confirm that both parameter scale and code-specific optimization are critical. In Group B, the 122B-parameter Qwen3.5 [24] lacks sufficient reasoning depth, yielding only 0.33 precision. DeepSeek-V3 [7], despite the lowest token cost, reaches only 0.48 precision without thinking mode. By contrast, reasoningenhanced models (DeepSeek-R1 and Qwen-Max) substantially improve precision to 0.55 and 0.62, respectively. GPT-5.2 ultimately demonstrates superior efficacy across all effectiveness metrics, confirming that deep thinking capability is the decisive factor for backward tracking. Overall, these results reveal clear selection criteria for each agent role: the Query Agent benefits most from code-generation optimized backbones, while the
Minos: A Multi-Agent Collaborative Framework for Backward Tracking
15
Table 4. Ablation study results averaged across all scenarios Configuration
Rec. Prec. |G| (GT) Tokens
Minos (Full)
0.92 0.64
35 (24)
164K
0.51 0.68 0.28 0.48
52 (24) 28 (24) 98 (24) 53 (24)
128K 135K 285K 248K
0.72 0.49 0.78 0.42 0.90 0.58
49 (24) 48 (24) 40 (24)
168K 158K 155K
Architectural Components: w/o Adversarial Reasoning 0.89 w/o Fine-grained Context 0.72 w/o Coarse-grained Context 0.94 w/o Count-First Protocol 0.85 Knowledge Components: w/o CTI Reports w/o MITRE ATT&CK w/o Log Schema
other agents demand models with deep thinking capabilities. In both cases, sufficient parameter scale serves as a necessary prerequisite for reliable performance. 5.4
RQ3: Ablation Study.
To evaluate the individual contribution of each design component, we conduct a systematic ablation study by selectively disabling one mechanism at a time. Table 4 presents the performance metrics averaged across all 14 scenarios. Among the architectural components, the two context layers exhibit complementary degradation patterns that substantiate the design rationale in Section 3. Removing the coarse-grained context results in the most severe degradation: recall rises to 0.94, but precision plummets to 0.28 with the subgraph inflating to 98 edges, as the system loses the tactical boundary constraints and drifts into unbounded exploration. Conversely, removing the fine-grained context restricts each assessment to local topology, causing recall to decline to 0.72 with a smaller subgraph of 28 edges, since the system can no longer traverse long-range causal chains without the support of evolving narrative memory. The precision rise reflects an expected trade-off rather than an improvement: deprived of long-range narrative, the Adversarial Group falls back on stricter local evidence and discards ambiguous mid-chain events, sacrificing a sizeable fraction of genuine cross-stage causal edges. Disabling the adversarial reasoning reduces precision from 0.64 to 0.51 (subgraph: 35 → 52 edges), validating its role as the primary safeguard against sycophancy-induced false positives. Removing the “count-first” protocol incurs a substantial token overhead (164K → 248K) alongside precision degradation to 0.48, as the Query Agent fetches massive candidate sets from high-degree nodes, wasting resources and introducing downstream noise. Regarding the knowledge components, removing the MITRE ATT&CK knowledge base causes the most substantial decline, as it provides the structured tactical references that anchor coarse-grained context updates. CTI reports contribute moderately, providing complementary intelligence for novel adversarial techniques that exceed the LLM’s intrinsic knowledge. Finally, log schema removal produces a marginal impact, suggesting the LLM’s capability to partially compensate for common audit formats.
16
J. Wang et al.
6
Related Work
6.1
Provenance-Based Attack Investigation.
Extensive research has explored provenance-based backward tracking to uncover attack context. Early efforts reconstruct causal footprints via reachability analysis [14], while subsequent work mitigates dependency explosion through dependency weighting [9] or graph compression [10]. In parallel, statistical approaches model behavioral distributions to detect frequency anomalies [13], and semantic clustering abstracts low-level interactions into higher-level behaviors [32]. Despite these topological and statistical insights, such approaches remain constrained by rigid features, making it difficult to infer high-level adversarial intents. 6.2
LLMs for Cybersecurity.
The cognitive capabilities of LLMs have motivated their application in security analysis. Initial paradigms utilize LLMs as auxiliary reasoning modules to interpret suspicious events [11], often incorporating RAG for factual grounding [4]. To overcome context limits and hallucinations in single-model setups, emerging studies explore multi-agent systems that automate forensic tasks [25]. However, existing systems are generally built as static workflows, limiting the utilization of LLMs’ inherent reasoning capabilities.
7
Discussion and Conclusion
7.1
Limitations and Future Work.
Despite its promising capabilities, Minos presents opportunities for further refinement. First, to address data privacy constraints regarding sensitive audit logs, future work will explore localized deployment via model fine-tuning and knowledge distillation, empowering smaller open-source models for local execution and eliminating data exfiltration risks. Second, to reduce reliance on POI event quality, we aim to develop a multi-POI joint tracking mechanism for parallel exploration and cross-validation, complemented by a credibility self-assessment module to dynamically adjust strategies when processing low-confidence inputs. 7.2
Conclusion.
In this paper, we presented Minos, a multi-agent framework that reformulates provenance-based backward tracking as an LLM-driven reasoning process. Addressing semantic ambiguity and dependency explosion, Minos synergizes micro-level assessment (integrating hierarchical context, RAG, and adversarial deliberation) with macro-level orchestration of four specialized agents for hypothesis-driven exploration. Evaluations across 14 scenarios demonstrate that Minos achieves superior reconstruction fidelity and subgraph compactness, providing a foundation for next-generation automated cyber-investigation.
Minos: A Multi-Agent Collaborative Framework for Backward Tracking
17
References 1. Barr-Smith, F., Ugarte-Pedrero, X., Graziano, M., Spolaor, R., Martinovic, I.: Survivalism: Systematic analysis of windows malware living-off-the-land. In: 2021 IEEE Symposium on Security and Privacy (SP). pp. 1557–1574. IEEE (2021) 2. Brown, T., Mann, B., Ryder, N., Subbiah, M., Kaplan, J.D., Dhariwal, P., Neelakantan, A., Shyam, P., Sastry, G., Askell, A., et al.: Language models are few-shot learners. Advances in neural information processing systems 33, 1877–1901 (2020) 3. Cao, R., Chen, M., Chen, J., Cui, Z., Feng, Y., Hui, B., Jing, Y., Li, K., Li, M., Lin, J., Ma, Z., Shum, K., Wang, X., Wei, J., Yang, J., Zhang, J., Zhang, L., Zhang, Z., Zhao, W., Zhou, F.: Qwen3-coder-next technical report. arXiv preprint arXiv:2603.00729 (2026) 4. Cheng, W., Zhu, T., Jing, S., Mei, J.P., Ma, M., Jin, J., Weng, Z.: Omnisec: Llm-driven provenance-based intrusion detection via retrieval-augmented behavior prompting. arXiv preprint arXiv:2503.03108 (2025) 5. DARPA: Operationally transparent cyber (optc) dataset. GitHub Repository (2020), https://github.com/FiveDirections/OpTC-data 6. DARPA Information Innovation Office: Transparent computing (tc) program. https: //www.darpa.mil/program/transparent-computing (2016) 7. DeepSeek-AI, et al.: Deepseek-v3 technical report (2025), https://arxiv.org/abs/ 2412.19437 8. Du, Y., Li, S., Torralba, A., Tenenbaum, J.B., Mordatch, I.: Improving factuality and reasoning in language models through multiagent debate. In: Forty-first international conference on machine learning (2024) 9. Fang, P., Gao, P., Liu, C., Ayday, E., Jee, K., Wang, T., Ye, Y.F., Liu, Z., Xiao, X.: Back-propagating system dependency impact for attack investigation. In: 31st USENIX Security Symposium (USENIX Security 22). pp. 2461–2478 (2022) 10. Fei, P., Li, Z., Wang, Z., Yu, X., Li, D., Jee, K.: {SEAL}: Storage-efficient causality analysis on enterprise logs with query-friendly compression. In: 30th USENIX security symposium (USENIX Security 21). pp. 2987–3004 (2021) 11. Gandhi, P.A., Wudali, P.N., Amaru, Y., Elovici, Y., Shabtai, A.: Shield: Apt detection and intelligent explanation using llm. arXiv preprint arXiv:2502.02342 (2025) 12. Guo, D., et al.: Deepseek-r1 incentivizes reasoning in llms through reinforcement learning. Nature 645(8081), 633–638 (Sep 2025). https://doi.org/10.1038/ s41586-025-09422-z, http://dx.doi.org/10.1038/s41586-025-09422-z 13. Hassan, W.U., Guo, S., Li, D., Chen, Z., Jee, K., Li, Z., Bates, A.: Nodoze: Combatting threat alert fatigue with automated provenance triage. In: Proceedings of the Network and Distributed System Security Symposium (NDSS). The Internet Society (2019) 14. Hossain, M.N., Milajerdi, S.M., Wang, J., Eshete, B., Gjomemo, R., Sekar, R., Stoller, S., Venkatakrishnan, V.: {SLEUTH}: Real-time attack scenario reconstruction from {COTS} audit data. In: 26th USENIX Security Symposium (USENIX Security 17). pp. 487–504 (2017) 15. Huang, L., Yu, W., Ma, W., Zhong, W., Feng, Z., Wang, H., Chen, Q., Peng, W., Feng, X., Qin, B., et al.: A survey on hallucination in large language models: Principles, taxonomy, challenges, and open questions. ACM Transactions on Information Systems 43(2), 1–55 (2025) 16. King, S.T., Chen, P.M.: Backtracking intrusions. ACM SIGOPS Operating Systems Review 37(5), 223–236 (2003)
18
J. Wang et al.
17. Lewis, P., Perez, E., Piktus, A., Petroni, F., Karpukhin, V., Goyal, N., Küttler, H., Lewis, M., Yih, W.t., Rocktäschel, T., et al.: Retrieval-augmented generation for knowledge-intensive nlp tasks. Advances in neural information processing systems 33, 9459–9474 (2020) 18. Li, Z., Chen, Q., Chen, R., Ye, Y., Zhang, S.: Threat detection and investigation with system-level provenance graphs: A survey. Computers & Security 106, 102282 (2021) 19. Liu, N.F., Lin, K., Hewitt, J., Paranjape, A., Bevilacqua, M., Petroni, F., Liang, P.: Lost in the middle: How language models use long contexts. Transactions of the Association for Computational Linguistics 12, 157–173 (2024) 20. LOLBAS Project: LOLBAS: Living off the land binaries, scripts and libraries. https://lolbas-project.github.io/ (2024) 21. OpenAI: Gpt-5.2-codex: Specialized model for software engineering and agentic coding. OpenAI Blog (December 2025), https://openai.com/index/gpt-5-2-codex/ 22. OpenAI: Gpt-5.2 technical report. Tech. rep., OpenAI (2025), https://openai. com/index/introducing-gpt-5-2/ 23. Park, J.S., O’Brien, J., Cai, C.J., Morris, M.R., Liang, P., Bernstein, M.S.: Generative agents: Interactive simulacra of human behavior. In: Proceedings of the 36th annual acm symposium on user interface software and technology. pp. 1–22 (2023) 24. Qwen Team: Qwen3.5: Towards native multimodal agents (February 2026), https: //qwen.ai/blog?id=qwen3.5 25. Song, C., Ma, L., Zheng, J., Liao, J., Kuang, H., Yang, L.: Audit-llm: Multi-agent collaboration for log-based insider threat detection. arXiv preprint arXiv:2408.08902 (2024) 26. Strom, B.E., Applebaum, A., Miller, D.P., Nickels, K.C., Pennington, A.G., Thomas, C.B.: MITRE ATT&CK: Design and philosophy. https://attack.mitre.org/ (2018) 27. Wang, L., Li, Z., Jiang, Y., Wang, Z., Guo, Z., Wang, J., Wei, Y., Shen, X., Ruan, W., Chen, Y.: From sands to mansions: Towards automated cyberattack emulation with classical planning and large language models. arXiv preprint arXiv:2407.16928 (2024) 28. Wei, J., Tay, Y., Bommasani, R., Raffel, C., Zoph, B., Borgeaud, S., Yogatama, D., Bosma, M., Zhou, D., Metzler, D., et al.: Emergent abilities of large language models. Transactions on Machine Learning Research (2022), https://openreview. net/forum?id=yzkSU5zdwD 29. Wei, J., Huang, D., Lu, Y., Zhou, D., Le, Q.V.: Simple synthetic data reduces sycophancy in large language models. arXiv preprint arXiv:2308.03958 (2023) 30. Wu, Q., Bansal, G., Zhang, J., Wu, Y., Li, B., Zhu, E., Jiang, L., Zhang, X., Zhang, S., Liu, J., et al.: Autogen: Enabling next-gen llm applications via multi-agent conversations. In: First conference on language modeling (2024) 31. Yao, S., Zhao, J., Yu, D., Du, N., Shafran, I., Narasimhan, K., Cao, Y.: React: Synergizing reasoning and acting in language models. In: Proceedings of the 11th International Conference on Learning Representations (ICLR) (2023) 32. Zeng, J., Chua, Z.L., Chen, Y., Ji, K., Liang, Z., Mao, J.: Watson: Abstracting behaviors from audit logs via aggregation of contextual semantics. In: NDSS (2021) 33. Zipperle, M., Gottwalt, F., Chang, E., Dillon, T.: Provenance-based intrusion detection systems: A survey. ACM Computing Surveys 55(7), 1–36 (2022)
Minos: A Multi-Agent Collaborative Framework for Backward Tracking
A
19
Evaluation Dataset Details
Table 5 provides comprehensive statistics for the 14 evaluation scenarios detailed in Section 5, spanning five public provenance datasets of varying scale and complexity. Table 5. Summary of evaluation datasets. #Nodes/#Edges: total entities and causal dependencies in the provenance graph. GT: ground-truth attack subgraph size Dataset
Scenario #Nodes #Edges GT Nodes GT Edges
OpTC [5]
Case 1 Case 2 Case 3
56K 385K 298K
829K 1.44M 1.84M
25 36 29
26 50 35
620 MB 1.05 GB 1.32 GB
Case 1 Aurora [27] Case 2 Case 3
43K 23K 25K
86K 74K 90K
15 20 23
17 23 27
31 MB 23 MB 28 MB
Trace [6]
Case 1 Case 2
1.27M 2.21M
18.5M 1.89M
13 13
15 18
1.75 GB 2.77 GB
Theia [6]
Case 1 Case 2
375K 107K
5.60M 579K
12 27
13 30
5.34 GB 3.86 GB
Case 1 996K 3.87M 15 17 Case 2 2.45M Coarse-grained 3.85MContext Update 8 Prompt(simplified) 8 Cadets [6] <Role-Play> <Role-Play> Case 3analyst. Your task2.73M 30analyst. Your Task is to 44 You 3.58M are a MITRE ATT\&CK tactical You are a forensic investigation is to maintain map the system events into MITRE TTPs… a tracking narrative ... Case 4 2.96M 16 21 Input3.73M State: Input State:
2.26 GB 2.07 GB 1.95 GB 2.17 GB
Fine-grained Context Update Prompt(simplified)
{Current fine-gained context} and {New attack-related event}.
B
<Memory-Decay Strategy> Update the narrative adhering to this topological decay logic: • Recent Focus: Retain atomic artifacts (e.g., specific file paths, IPs) for events near the investigation focus … • Historical Compression: Abstract chronologically distant events into high-level descriptions… • Causality Focus: Explicitly link causal dependencies…
{Current fine-gained context}, {Current coarse-gained context} {New attack-related event}
Size
<CoT Reasoning> You need to infer step-by-step: • Intent Inference: How does this action facilitate a broader attack lifecycle … • Tactical Mapping: Align the intent with macro-tactics (e.g., Persistence, Lateral Movement) … • Technique Mapping: Assign the definitive MITRE TTP based on the action….
Structured Prompt Details <Output-Constraint> Output the updated narrative strictly as a coherent paragraph without any markdown formatting, JSON syntax, or explanatory text. Limit the overall length to 500 words …
<Output-Constraint>
Output a JSON object with the format:{"tactic": "...", Fig. 5 presents the three prompt templates that"technique_name": govern"..."…} the adversarial reasoning "technique_id": "Txxxx.xxx", framework described in Section 3.
Prosecutor Prompt (simplified)
Defense Attorney Prompt (simplified)
Judge Prompt (simplified)
<Role-Play> You are a cybersecurity red team analyst acting as the Prosecutor. Your task is to uncover malicious intent ...
<Role-Play> You are a senior IT operations expert acting as the Defense Attorney. Your task is to provide legitimate justifications ...
<Role-Play> You are a security analyst. Your task is to finish a final judge. You must impartially weigh the arguments from both the Prosecutor and Defense Attorney to deliver an objective verdict...
<CoT Reasoning> Before generating arguments, you must reason step-by-step: • Contextual Correlation Analysis: examine causal links between the current event and confirmed malicious events ... • Technical Feature Identification: Focus on technical indicators implying malicious intent, such as suspicious cmd ... • Attack Pattern Matching: Evaluate whether the event aligns with retrieved CTI reports and MITRE ATT&CK techniques...
<CoT Reasoning> Before generating arguments, you must reason step-by-step: • Legitimate Business Pattern Matching: Evaluate whether the event belongs to normal administrative tasks ... • Benign Evidence in Context: Scrutinize the broader investigation context to find evidence supporting ... • Rebutting Malicious Hypotheses: Provide specific counterarguments to potential malicious interpretations …
<Evidence-based Citation Norms> All malicious characterizations must include in-line citations to knowledge sources, with a complete source list appended... <RAG> {CTI}, {MITRE}, {Log Schema}
<Evidence-based Citation Norms> All benign characterizations must include in-line citations to knowledge sources, with a complete source list appended... <RAG> {CTI}, {MITRE}, {Log Schema}
Input State: {Current context} and {Candidate event}.
Input State: {Current context} and {Candidate event}.
Input State: {Prosecutor’s arguments} and {Defender’s arguments} {Current context} and {Candidate event}.
<Output-Constraint> Output a 150-200 word malicious evidence analysis with inline citations, followed by the complete reference list …
<Output-Constraint> Output a 150-200 word benign evidence analysis with inline citations, followed by the complete reference list …
<Output-Constraint> Strictly output a JSON object containing is_malicious (boolean) and reasoning (string) fields …
<CoT Reasoning> Before finalizing the verdict, you must reason step-by-step: • Correlation Priority: Evaluate the correlation strength between the event and confirmed malicious context... • Citation Credibility Weighting: Refer to the citation credibility summary. Arguments with more verified references receive higher credibility weights... • Tactical Consistency Checking: If deemed malicious, map the event to a MITRE ATT&CK technique and assess if it aligns with the evolving tactical sequence... <RAG> {CTI}, {MITRE}, {Log Schema}
Fig. 5. The structured prompt templates designed for the Adversarial Assessment Group, instructing the Prosecutor and Defense Attorney to form opposing hypotheses.
{New attack-related event} <Memory-Decay Strategy> Update the narrative adhering to this topological decay logic: • Recent Focus: Retain atomic artifacts (e.g., specific file paths, IPs) for events near the investigation focus … • Historical Compression: Abstract chronologically distant events into high-level descriptions… • Causality Focus: Explicitly link causal dependencies… <Output-Constraint> Output the updated narrative strictly as a coherent paragraph without any markdown formatting, JSON syntax, or explanatory text. Limit the overall words et … al. 20 length to J.500 Wang
<CoT Reasoning> You need to infer step-by-step: • Intent Inference: How does this action facilitate a broader attack lifecycle … • Tactical Mapping: Align the intent with macro-tactics (e.g., Persistence, Lateral Movement) … • Technique Mapping: Assign the definitive MITRE TTP based on the action…. <Output-Constraint> Output a JSON object with the format:{"tactic": "...", "technique_id": "Txxxx.xxx", "technique_name": "..."…}
Fig. 6 shows the prompt templates used by the Memory Agent to maintain the hierarchical context introduced in Section 3. Prosecutor Prompt (simplified)
Defense Attorney Prompt (simplified)
Judge Prompt (simplified)
Fine-grained Context Update Prompt(simplified) Coarse-grained Context Update<Role-Play> Prompt(simplified) <Role-Play> <Role-Play> You are a cybersecurity red team analyst acting as You are a senior IT operations expert acting as the Defense You are a security analyst. Your task is to finish a final judge. <Role-Play> <Role-Play> the Prosecutor. Your task is to uncover malicious intent ... Attorney. Your task is to provide legitimate justifications ... You must impartially weigh the arguments from both the You are a MITRE ATT\&CK tactical analyst. Your Task is to You are a forensic investigation analyst. Your task is to maintain Prosecutor and Defense Attorney to deliver an objective verdict... map the system events into MITRE TTPs… a tracking narrative ... <CoT Reasoning> <CoT Reasoning> <CoT Reasoning> Input State: Before generating arguments, you must reason step-by-step: Before generating arguments, you must reason step-by-step: Input State: Before finalizingcontext} the verdict, you must reason step-by-step: {Current fine-gained context}, {Current coarse-gained • Contextual Correlation Analysis: examine causal links context}•and Legitimate Businessevent}. Pattern Matching: Evaluate whether {Current fine-gained {New attack-related {New attack-related • Correlation Priority: Evaluate the correlation strength between the current event and confirmed malicious events ... the event belongs to normal administrative tasks ... event} <Memory-Decay Strategy> between the event and confirmed malicious context... • Technical Feature Identification: Focus on technical • Benign Evidence in Context: Scrutinize the broader <CoT Reasoning> Update the narrative adhering to this topological decay logic: • Citation Credibility Weighting: Refer to the citation You need to infer step-by-step: indicators implying malicious intent, such as suspicious cmd ... investigation context to find evidence supporting ... • Recent Focus: Retain atomic artifacts (e.g., specific file paths, • Intent Inference: does this actioncredibility facilitate asummary. broader Arguments with more verified references • Attack Pattern Matching: Evaluate whether event aligns • Rebutting Hypotheses: Provide specificHow counterIPs) the for events near the investigation focusMalicious … attack lifecycle… … receive higher credibility weights... with retrieved CTI reports and MITRE ATT&CK techniques... arguments to potential malicious interpretations • Historical Compression: Abstract chronologically distant • Tactical Mapping: Align the intent •with macro-tactics (e.g., Checking: If deemed malicious, map Tactical Consistency events into high-level descriptions… <Evidence-based Citation Norms> Citation Norms> Persistence, Lateral Movement) … the event to a MITRE ATT&CK technique and assess if it • Causality Focus: Explicitly<Evidence-based link causal dependencies… • Technique the definitive MITRE TTP All malicious characterizations must include in-line citations to All benign characterizations must include in-lineMapping: citationsAssign to aligns with the evolving tactical sequence... based onlist theappended... action…. knowledge sources, with a complete source<Output-Constraint> list appended... knowledge sources, with a complete source <RAG> Output the updated narrative strictly as a coherent paragraph <Output-Constraint> <RAG> <RAG> {CTI}, {MITRE}, {Log Schema} without any markdown formatting, JSON syntax, or explanatory {CTI}, {MITRE}, {Log Schema} {CTI}, {MITRE}, {Log Schema} Output a JSON object with the format:{"tactic": "...", text. Limit the overall length to 500 words … "technique_id": "Txxxx.xxx", "technique_name": "..."…} Input State: Input State: Input State: {Prosecutor’s arguments} and {Defender’s arguments} {Current context} and {Candidate event}. {Current context} and {Candidate event}. {Current context} and {Candidate event}. <Output-Constraint> <Output-Constraint> <Output-Constraint> Fig. 6. The structured prompt templates used for fine-grained and coarse-grained Output a 150-200 word malicious evidence analysis with inline Output a 150-200 word benign evidence analysis with inline Strictly output a JSON object containing is_malicious (boolean) context updating. citations, followed by the completeProsecutor reference listPrompt … complete referencePrompt list … (simplified) and reasoning (string) Judge fields … (simplified)citations, followed by the Defense Attorney Prompt (simplified) <Role-Play> <Role-Play> Fig. 7 illustrates the prompt template used by the Planner Agent to facilitate You are a senior IT operations expert acting as the Defense You are a security analyst. Your task is to finish a final judge. hypothesis-guided graph exploration, in justifications Section...4. Attorney. Youras taskintroduced is to provide legitimate You must impartially weigh the arguments from both the
<Role-Play> You are a cybersecurity red team analyst acting as the Prosecutor. Your task is to uncover malicious intent ...
<CoT Reasoning> <CoT Reasoning> Before generating arguments, you must reason step-by-step: Before generating arguments, you must reason step-by-step: • Contextual Correlation Analysis: examine causal links • Legitimate Business Pattern Matching: Evaluate whether Planner Agent Prompt (simplified) between the current event and confirmed malicious events ... the event belongs to normal administrative tasks ... • Technical Feature Identification: Focus on technical • Benign Evidence in Context: Scrutinize the broader <Role-Play> indicators implying malicious intent, such as suspicious cmd ... investigation context to find evidence supporting ... a professional cybersecurity specializing in APT counter• Attack Pattern Matching: Evaluate whether theYou eventare aligns • Rebutting Maliciousanalyst Hypotheses: Provide specific provenance arguments investigation. Your task is to interpretations formulate … with retrieved CTI reports and MITRE ATT&CKattack techniques... to potential malicious
hypothesis-guided exploration plans...
<Evidence-based Citation Norms> <Evidence-based Citation Norms> All malicious characterizations must include in-line<CoT citations to All benign characterizations must include in-line citations to Reasoning> knowledge sources, with a complete source list appended... knowledge sources, complete source list appended... Before generating an tracking plan,with youa must reason step-by-step: <RAG> <RAG> Review the current attack subgraph to • Situation Assessment: {CTI}, {MITRE}, {Log Schema} {CTI},nodes {MITRE}, {Log not Schema} identify all frontier that have been fully explored... Input State: • Tactical Localization: Compare the current context to {Current context} and {Candidate determine uncovered phases within the attack event}. lifecycle... • Hypothesis Generation: Based on the situational analysis, <Output-Constraint> <Output-Constraint> formulate regarding the attacker's Output a 150-200 word malicious evidence analysis with inline actionable Output ahypotheses 150-200 word benign evidence analysis with inline citations, followed by the complete reference list … subsequent potential citations, followed by the complete reference list … targets... <Few Shots> Examples: • Output: {"phase": "Initial Expansion", "thought_process": ... , "next_action": "Explore tomcat’s father process"...} • Output: {"phase": "Frontier Expansion","thought_process": ... , "next_action": "Explore tomcat’s fork actions"...} Input State: {Current context} and {Candidate event}.
Prosecutor and Defense Attorney to deliver an objective verdict...
<CoT Reasoning> Before finalizing the verdict, you must reason step-by-step: • Correlation Priority: Evaluate the correlation strength between the event and confirmed malicious context... • Citation Credibility Weighting: Refer to the citation credibility summary. Arguments with more verified references receive higher credibility weights... • Tactical Consistency Checking: If deemed malicious, map the event to a MITRE ATT&CK technique and assess if it aligns with the evolving tactical sequence... <RAG> {CTI}, {MITRE}, {Log Schema} Input State: {Prosecutor’s arguments} and {Defender’s arguments} {Current context} and {Candidate event}. <Output-Constraint> Strictly output a JSON object containing is_malicious (boolean) and reasoning (string) fields …
Input State: {Current context}, {action_history} and {attack_subgraph}. <Output-Constraint> Strictly output a JSON-formatted verification plan containing exactly four fields: phase, thought_process, next_action, and stop_investigation.
Fig. 7. The structured prompt template directing the Planner Agent’s hypothesisguided graph exploration strategy.