Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
This paper introduces DeepFaith, an evidence-grounded framework designed to enhance incident reporting in the context of multi-stage Advanced Persistent Threat (APT) defense. By transforming structured outputs from autonomous defense systems into natural-language reports that are explicitly aligned with system evidence, DeepFaith significantly improves the faithfulness and reliability of generated content. Experimental results demonstrate a substantial increase in faithfulness (from 0.68 to 0.92) and a reduction in unsupported claims (from 0.32 to 0.08), making it a valuable tool for security operations centers.
DeepFaith achieves a remarkable 35% increase in report faithfulness, transforming how security analysts interpret complex APT incidents.
Advanced Persistent Threats (APTs) are difficult to detect and interpret due to their multi-stage and stealthy nature. While recent autonomous defense systems leverage provenance graphs and learning-based models for detection and mitigation, their outputs remain largely machine-oriented and difficult for analysts to interpret. Large language models (LLMs) offer a promising interface for report generation, but often produce hallucinated or weakly grounded content. In this paper, we propose DeepFaith, an evidence-grounded framework for faithful incident reporting in multi-stage APT defense. DeepFaith transforms structured outputs from autonomous defense and explainability modules into natural-language reports that are explicitly aligned with underlying system evidence. The framework integrates a unified evidence representation, evidence-grounded prompting, faithfulness-aware generation, and post-generation verification to ensure that all generated statements are supported. Experiments in a realistic enterprise testbed demonstrate that DeepFaith improves faithfulness from 0.68 to 0.92, reduces unsupported claims from 0.32 to 0.08, and increases temporal consistency from 0.6 to 0.88, while maintaining concise reports and lower error rates than existing template-based and LLM-based solutions. These results show that evidence-grounded generation enables reliable, interpretable, and actionable reporting for security operations centers.