event correlation

Missing attributes in event logs severely hinder process mining performance; existing repair methods either rely on prior process models or support only single-type attribute recovery. This paper proposes the first end-to-end event log repair framework based on heterogeneous graph neural networks (HGNNs): it models execution traces as heterogeneous graphs, integrating multimodal nodes and relations—including activities, resources, and timestamps—and performs joint reconstruction of missing attributes via message passing. The approach is model-agnostic and simultaneously repairs both structured and unstructured attributes. Experiments on two synthetic and four real-world event logs demonstrate that our method consistently outperforms state-of-the-art autoencoder-based approaches across diverse missingness patterns, achieving superior reconstruction accuracy and generalization capability.

This work addresses the scarcity of production-grade Security Operations Center (SOC) logs for research due to stringent privacy constraints, which has led prior studies to rely on synthetic or outdated data. To bridge this gap, the authors propose a methodology that, for the first time, transforms real-world financial-sector SIEM logs into reusable research artifacts while adhering to strict privacy boundaries. The approach preserves investigation-relevant structures through structured anonymization, mapping to the MITRE ATT&CK framework, deterministic validation, and large language model (LLM)-based behavioral compliance checks. The resulting artifact comprises 37 HIKARI challenges suitable for effective model training and demonstrates its utility by accurately identifying LLM policy violations across 200 SOCpilot incidents, thereby validating its balanced trade-off between privacy preservation and analytical fidelity.

Event reconstruction in digital forensics suffers from fragmented perspectives, inconsistent terminology, and methodological fragmentation, lacking a systematic, unifying framework. Method: This paper proposes the first unified temporal event reconstruction framework tailored for digital forensics—adapting classical forensic reconstruction models to the digital domain; constructing a comprehensive, lifecycle-spanning conceptual map of temporal reconstruction; and conducting a systematic literature review (SLR) coupled with conceptual modeling to clarify terminological relationships and process elements. Contribution/Results: The study identifies three core challenges—data scale, temporal distortion, and semantic ambiguity—and establishes an extensible classification system. It delivers a consensus-based terminology set and a standardized process paradigm, thereby providing a rigorous theoretical foundation for the development and evaluation of automated event reconstruction tools.

This work addresses the challenge of distinguishing genuine causal relationships from mere correlations or temporal patterns in manufacturing system alarm logs. To this end, it proposes the LMT framework, which, for the first time, integrates semantic causal priors extracted by large language models with timestamp-based Poisson process likelihoods within a Bayesian causal discovery framework. By jointly modeling textual semantics and temporal statistical evidence, the method infers causal graphs that are both interpretable and well-supported by data. Extensive experiments demonstrate its superior performance across diverse simulated scenarios, particularly outperforming text-only or time-series-only baselines in low-data regimes with sparse alarm events.

This work addresses the challenges of fusing heterogeneous modalities—such as time-series metrics and textual logs—and the inherent difficulty large language models face in processing continuous temporal data for root cause analysis in cloud infrastructure failures. To this end, the authors propose a multimodal diagnostic framework that aligns time-series performance indicators with the embedding space of pretrained language models through temporal semantic compression, a gated cross-attention alignment encoder, and a retrieval-augmented generation mechanism. This integration enables automated root cause localization informed by historical knowledge. Experimental evaluation across six cloud system benchmarks demonstrates that the proposed method achieves a diagnosis accuracy of 48.75%, significantly outperforming existing approaches, particularly in complex, multi-fault scenarios.

This work addresses the challenge of reconstructing physically consistent vehicle trajectories from sparse and heterogeneous evidence in traffic accident analysis, a task where existing approaches often prioritize semantic or visual plausibility at the expense of quantitative geometric and dynamic fidelity. The paper introduces the first training-free, closed-loop structured inference framework that formulates reconstruction as an iterative process of motion hypothesis generation and refinement anchored to event-specific cues. By integrating geometric, kinematic, and interaction constraints—and augmented with a structured case memory and a consistency diagnostic mechanism—the method enables interpretable corrections even under evidentiary scarcity. Evaluated on real-world accident data, the approach significantly outperforms both data-driven and purely physics-based baselines in terms of trajectory geometric fidelity, velocity consistency, and collision accuracy.

This work addresses the challenge of modeling the dynamic and highly abstract evolution of information narratives during crisis events, a task where existing approaches are largely confined to static snapshots. We propose the first framework that integrates situated cognition theory with unsupervised temporal modeling, enabling adaptive representation of narrative entity trajectories within a shared semantic space. By combining semantic embeddings, density-based clustering, and rolling time-window linkage, our method requires no predefined labels and captures fine-grained narrative lifecycles, revealing heterogeneous evolution patterns characterized by coexisting transient fragments and stable anchors. Experiments on real-world crisis data demonstrate high clustering consistency and the ability to effectively identify diverse narrative evolution pathways, offering interpretable temporal representations for dynamic information monitoring and decision-making.

This study addresses the longstanding disconnect between detection engineering and digital forensics, which has led to a gap between real-time alerts and post-incident analysis. To bridge this divide, the authors propose a unified detection-and-forensics methodology based on Velociraptor that triggers targeted evidence collection immediately upon detection events, thereby integrating monitoring and forensic workflows. The approach introduces an innovative four-stage framework that transforms forensic artifacts into reusable, testable detection rules, enabling efficient initial triage without requiring full disk imaging. By leveraging BaseVQL data sources—such as Prefetch, USN Journal, and WMI—it facilitates cross-artifact correlation and periodic analysis, allowing effective screening even in the absence of Windows Event Logs. This significantly reduces data acquisition volume while supporting continuous monitoring.

Network failures propagate across layers under the joint influence of topology and protocol dependencies, often producing highly similar end-node alarms from distinct root causes, which complicates accurate diagnosis. To address this challenge, this work proposes PropLLM, a novel diagnostic framework that integrates hop-by-hop causal backtracking with large language model (LLM) reasoning. PropLLM leverages a dual-layer knowledge graph to retrieve verifiable evidence and introduces a Temporal Causal Propagation Attention (TCPA) mechanism that embeds topological causal priors into attention computation, guiding the model to perform backward inference along correct propagation paths and reconstruct complete causal chains for precise root cause localization and fault type identification. Evaluated on a real-world Wi-Fi multimodal dataset, PropLLM improves accuracy by 4.7% in root cause localization and 3.9% in fault type diagnosis while reducing hallucination rate by 50.8%. Further experiments on the TeleLogs 5G dataset confirm its strong generalization capability.

This work addresses the limitations of traditional anomaly detection systems, whose feature-level explanations often lack contextual relevance and actionable insights, thereby hindering efficient alert investigation by security analysts. To overcome this, the paper proposes an event-centric, detector-agnostic explainability framework that uniquely integrates multi-agent collaboration with large language models (LLMs). By orchestrating a structured, hypothesis-driven automated investigation process, the framework generates alert explanations grounded in verifiable evidence. This approach substantially enhances post-hoc analysis efficiency, delivers operationally meaningful interpretations, and significantly improves event classification accuracy.