ANTEATER: A Filter-then-Scrutinize Architecture for End-to-End Attack Investigation
Summary: ANTEATER cascades lightweight flow-based filtering with a three-agent LLM scrutinizer over provenance graphs. It reconstructs long-term, stealthy attacks and generates structured analyst-ready reports while controlling LLM cost and context length. (summarized by gpt-5.6-luna on Jul 26 2026)
Incoming Non-self Citations Over Time
No non-self incoming citations found for this paper in this database.
Authors
- 1. Yiming Ren (Chinese Academy of Sciences; University of Chinese Academy of Sciences)
- 2. Haoqiang Wang (Chinese Academy of Sciences; University of Chinese Academy of Sciences)
- 3. Linghao Li (Chinese Academy of Sciences; University of Chinese Academy of Sciences)
- 4. Haoyang Chen (Chinese Academy of Sciences; University of Chinese Academy of Sciences)
- 5. Chengxiang Si (National Computer Network Emergency Response Technical Team/Coordination Center of China)
- 6. Zhou Zhou (Chinese Academy of Sciences)
- 7. Qingyun Liu (Chinese Academy of Sciences)
BibTeX Citation
@inproceedings{ren_sigmod26,
title = {{ANTEATER: A Filter-then-Scrutinize Architecture for End-to-End Attack Investigation}},
author = {Ren, Yiming and Wang, Haoqiang and Li, Linghao and Chen, Haoyang and Si, Chengxiang and Zhou, Zhou and Liu, Qingyun},
series = {{SIGMOD} '26},
booktitle = {Proceedings of the {ACM} {SIGMOD} International Conference on Management of Data},
publisher = {Association for Computing Machinery},
doi = {10.1145/3802012},
url = {https://dl.acm.org/doi/10.1145/3802012},
year = {2026}
}Incoming Citations (Sorted by Pagerank)
Showing 0 of 0 citing papers.
| Rank | Citing Paper | Year | Venue | Pagerank |
|---|
Previous
Page 1 / 1
Next
Outgoing Citations (Sorted by Pagerank)
Showing 3 of 3 cited papers.
Citations counted here include only citations to other VLDB/SIGMOD/CIDR/PODS papers in this database.
| Rank | Cited Paper | Year | Venue | Pagerank |
|---|---|---|---|---|
| 3,376 | Robust and Transferable Log-based Anomaly Detection | 2023 | SIGMOD | 7.4605908e-05 |
| 5,228 | Pluto: Sample Selection for Robust Anomaly Detection on Polluted Log Data | 2024 | SIGMOD | 6.3082722e-05 |
| 5,713 | PreLog: A Pre-trained Model for Log Analytics | 2024 | SIGMOD | 6.1123632e-05 |
Previous
Page 1 / 1
Next
Semantically Similar Papers
| # | Overall Rank | Paper | Year | Venue |
|---|---|---|---|---|
| 1 | 10,956 | CoLA: Model Collaboration for Log-based Anomaly Detection | 2025 | VLDB |
| 2 | 5,713 | PreLog: A Pre-trained Model for Log Analytics | 2024 | SIGMOD |
| 3 | 11,775 | AUDITOR: A System Designed for Automatic Discovery of Complex Integrity Constraints in Relational Databases | 2020 | SIGMOD |
| 4 | 13,508 | A Query System for Efficiently Investigating Complex Attack Behaviors for Enterprise Security | 2019 | VLDB |
| 5 | 10,019 | Substructure-aware Log Anomaly Detection | 2025 | VLDB |
| 6 | 10,909 | LLMLog: Advanced Log Template Generation via LLM-driven Multi-Round Annotation | 2025 | VLDB |
| 7 | 10,507 | Unseen Anomaly Detection from System Logs | 2026 | SIGMOD |
| 8 | 10,947 | Enabling Efficient Attack Investigation via Human-in-the-Loop Security Analysis | 2025 | VLDB |
| 9 | 3,376 | Robust and Transferable Log-based Anomaly Detection | 2023 | SIGMOD |
| 10 | 11,655 | A System for Automated Open-Source Threat Intelligence Gathering and Management | 2021 | SIGMOD |