SherAgent: Scaling Attack Investigation in the Wild via LLM-Empowered Iterative Query-Filter Backtracking

arXiv:2607.09176 · cs.CR · Submitted 2026-07-10 · Read on arXiv

Zhenyuan Li, Zhengkai Wang, Ling Jiang, Xiangmin Shen, Ruixiao Lin, Sen Nie, Shi Wu, Shouling Ji

cs.CR

Submitted: 2026-07-10

Code: https://github.com/ocsf/ocsf-schema

License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/

Terminology

• Provenance — 30× in this paper · explained in 4 episodes
• Accuracy — 17× in this paper · explained in 1 episode
• Success Rate — 17× in this paper
• Trace — 7× in this paper · explained in 2 episodes
• Consistency — 6× in this paper · explained in 3 episodes
• Core — 6× in this paper · explained in 2 episodes
• Hallucination — 5× in this paper · explained in 3 episodes
• Verification — 5× in this paper · explained in 2 episodes
• Adaptability — 4× in this paper · explained in 1 episode
• Knowledge Graph — 4× in this paper · explained in 7 episodes
• Adam — 3× in this paper · explained in 2 episodes
• Incorrect Rate — 3× in this paper
• Knowledge graphs — 3× in this paper · explained in 2 episodes
• APEX — 2× in this paper · explained in 1 episode
• Agentic Workflows — 2× in this paper · explained in 1 episode
• Benchmark — 2× in this paper · explained in 2 episodes
• IEEE Symposium on Security and Privacy — 2× in this paper
• Open Cybersecurity Schema Framework — 2× in this paper
• Pruning — 2× in this paper · explained in 4 episodes
• Semantic Gap — 2× in this paper · explained in 2 episodes
• Actor — 1× in this paper · explained in 3 episodes
• Adversarial Attacks — 1× in this paper · explained in 1 episode
• Alert Fatigue — 1× in this paper · explained in 1 episode
• Commentary — 1× in this paper · explained in 2 episodes
• Computational overhead — 1× in this paper · explained in 2 episodes
• Distillation — 1× in this paper · explained in 2 episodes
• Failure Modes — 1× in this paper · explained in 3 episodes
• Formal Verification — 1× in this paper · explained in 2 episodes
• Generalization — 1× in this paper · explained in 13 episodes
• Graph Construction — 1× in this paper · explained in 3 episodes
• Interpretability — 1× in this paper · explained in 15 episodes
• Large Language Models (LLMs) — 1× in this paper · explained in 6 episodes
• Point of Interest — 1× in this paper
• Reasoning Traces — 1× in this paper · explained in 3 episodes
• Redundancy — 1× in this paper · explained in 2 episodes
• Semantic Drift — 1× in this paper · explained in 3 episodes
• Semantic Understanding — 1× in this paper · explained in 2 episodes

Sources

• Toolformer: Language Models Can Teach Themselves to Use Tools
• ReAct: Synergizing Reasoning and Acting in Language Models

Related papers

• SoK: AI-Augmented Binary Reversing
• Relaxed Sender Anonymity for CBDC Interbank Settlement: A Zero-Knowledge Approach on Permissioned EVM
• Calibration-Family Overfit: Why Trusted Sabotage Monitors Don't Transfer Across Lineages
• Efficient Fuzzy PSI under One-Sided Assumptions
• Sealing the Audit-Runtime Gap for LLM Skills
• Token Composition: A Graph Based on EVM Logs