SherAgent Scaling Attack Investigation in the Wild via LLM-Empowered Iterative Query-Filter Backtracking

Jul 16, 2026

Upload by Quinn

Provenance-based attack investigation enables automation by standardizing data and query logic, but real-world deployments face critical obstacles from dependency explosions and fragmented causal chains. To address these issues, the work partners with a large Internet corporation’s SOC handling tens of thousands of alerts daily, analyzing where existing LLM-based workflows fail and why. It introduces SherAgent, an LLM-powered iterative query-filter backtracking system over provenance graphs, dynamically calibrating queries, filtering results, and selecting nodes to mitigate failures.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages17

Reading Time43 min

Abstract

Keywords

CCS Concepts

1 Introduction

Attack investigation challenges and alert fatigue

Provenance analysis as a solution

Existing approaches: backward tracking vs query-based hunting

SherAgent: Scaling Attack Investigation in the Wild via LLM-Empowered Iterative Query-Filter Backtracking Zhenyuan Li Zhejiang University China Xiangmin Shen Hofstra University USA Zhengkai Wang Zhejiang University China Ruixiao Lin Zhejiang University China Ling Jiang Tencent Security Keen Lab China Sen Nie Tencent Security Keen Lab China arXiv :2607 .09 176v 1 [ cs .CR] 10 Jul 2026 Shi Wu Tencent Security Keen Lab China Abstract Provenance-based attack investigation enables viable automation by standardizing data and query logic; however, it is critically hindered in practice by dependency explosions and fragmented causal chains in the wild. Towards designing a robust and automated investigation tool, we collaborated with the SOC of a major Internet corporation serving billions of users. By engaging in real-world incident response, we are able to evaluate and refine their existing LLM-based investigation workflows, which processes tens of thousands of raw alerts daily, leaving thousands for manual triage, to find out the root causes of investigation failures and major challenges in their existing tools. Motivated by these findings, we propose SherAgent, an LLMempowered automated investigation system. Operating on an iterative “query-filter” backtracking paradigm over provenance graphs, SherAgent leverages the semantic reasoning capabilities of LLMs to process unstructured data, such as investigation context and threat intelligence. To overcome fragmented causal chains caused by missing events, the system dynamically calibrates query conditions to broaden the search scope. Concurrently, it performs precision result filtering and strategic nodes selection for subsequent exploration, thereby mitigating dependency explosions. Extensive evaluations in the wild demonstrate that SherAgent improves the end-to-end investigation success rate by 31.1% and 63.7% compared to both legacy enterprise baselines and SOTA approaches, respectively. Furthermore, it operates with remarkable efficiency, incurring under $0.10 in API costs and requiring less than 4 minutes per investigation. Finally, our user study confirms that SherAgent provides accurate and clear insights, significantly reducing the analytical overhead for security experts. Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than the author(s) must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission [and/or a fee. Request permissions from permissions@acm.org](and/or a fee. Request permissions from permissions@acm.org). Conference acronym ’XX, Woodstock, NY © 2018 Copyright held by the owner/author(s) . Publication rights licensed to ACM. ACM ISBN 978-1-4503-XXXX-X/2018/06 [https://doi.org/XXXXXXX.XXXXXXX](https://doi.org/XXXXXXX.XXXXXXX) Shouling Ji Zhejiang University China CCS Concepts • Security and privacy → Intrusion detection systems; Operating systems security; • Computing methodologies → Natural language processing; • General and reference → Empirical studies. Keywords Attack Investigation, Provenance Analysis, Dependence Explosion, Broken Chains, Large Language Model, Empirical Study ACM Reference Format: Zhenyuan Li, Zhengkai Wang, Ling Jiang, Xiangmin Shen, Ruixiao Lin, Sen Nie, Shi Wu, and Shouling Ji. 2018. SherAgent: Scaling Attack Investigation in the Wild via LLM-Empowered Iterative Query-Filter Backtracking. In Proceedings of Make sure to enter the correct conference title from your rights confirmation email (Conference acronym ’XX). ACM, New York, NY, USA, 17 pages. [https://doi.org/XXXXXXX.XXXXXXX](https://doi

FAQs

What problem does the document identify with provenance-based attack investigation in the wild?

It highlights dependency explosions and fragmented causal chains that hinder automation in real deployments, making investigation workflows fail or require excessive manual triage.

What is SherAgent, and how does it work conceptually?

SherAgent is an LLM-empowered automated investigation system that runs an iterative “query-filter” backtracking paradigm over provenance graphs to reason over unstructured investigation context and threat intelligence.

How does SherAgent address missing events and reduce investigation failure modes?

It dynamically calibrates query conditions to broaden search scope when causal chains are broken, while also applying precision result filtering and strategic node selection to mitigate dependency explosions.

Jul 16, 2026

Upload by Quinn