Persistent Node Evidence: An Investigation-Oriented Representation for Provenance-Based Intrusion Detection
This work introduces persistent node evidence as an investigation-oriented representation boundary for provenance streams, and supports persistent node evidence as a bounded bridge from event prediction to precision-oriented offline investigation.