APTInvestBench: Evaluating Autonomous APT Investigation under Varying Telemetry
Large language model (LLM) agents could help security operations centers (SOCs) investigate advanced persistent threats (APTs) by turning weak leads into evidence for intrusion scoping and response. Yet success under one telemetry setting does not establish robustness to changes in log collection, retention, or samplin...
Yu Wang, Shu-Hao Li, Tao Yin et al.
· 0 citations