{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,31]],"date-time":"2026-07-31T06:02:08Z","timestamp":1785477728816,"version":"3.56.0"},"publisher-location":"Cham","reference-count":25,"publisher":"Springer Nature Switzerland","isbn-type":[{"value":"9783032338648","type":"print"},{"value":"9783032338655","type":"electronic"}],"license":[{"start":{"date-parts":[[2026,8,1]],"date-time":"2026-08-01T00:00:00Z","timestamp":1785542400000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"},{"start":{"date-parts":[[2026,8,1]],"date-time":"2026-08-01T00:00:00Z","timestamp":1785542400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2027]]},"DOI":"10.1007\/978-3-032-33865-5_33","type":"book-chapter","created":{"date-parts":[[2026,7,31]],"date-time":"2026-07-31T05:50:01Z","timestamp":1785477001000},"page":"539-559","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["CBR-PAR: LLM-Augmented Case-Based Reasoning for\u00a0Provenance-Based Alert Reduction"],"prefix":"10.1007","author":[{"given":"Canhua","family":"Chen","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Yaqin","family":"Cao","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Xinyu","family":"Liu","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Baihang","family":"Liu","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Yongjun","family":"Wang","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Xiaoyu","family":"Wang","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Qixu","family":"Liu","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"297","published-online":{"date-parts":[[2026,8,1]]},"reference":[{"issue":"1","key":"33_CR1","doi-asserted-by":"publisher","first-page":"39","DOI":"10.3233\/AIC-1994-7104","volume":"7","author":"A Aamodt","year":"1994","unstructured":"Aamodt, A., Plaza, E.: Case-based reasoning: foundational issues, methodological variations, and system approaches. AI Commun. 7(1), 39\u201359 (1994)","journal-title":"AI Commun."},{"key":"33_CR2","unstructured":"Bach, K., et al.: Case-based reasoning meets large language models: a research manifesto for open challenges and research directions (2025)"},{"key":"33_CR3","unstructured":"Bates, A., Tian, D.J., Butler, K.R., Moyer, T.: Trustworthy $$\\{$$Whole-System$$\\}$$ provenance for the Linux kernel. In: 24th USENIX Security Symposium (USENIX Security 15), pp. 319\u2013334 (2015)"},{"key":"33_CR4","doi-asserted-by":"crossref","unstructured":"Bhattarai, B., Huang, H.: SteinerLog: prize collecting the audit logs for threat hunting on enterprise network. In: Proceedings of the 2022 ACM on Asia Conference on Computer and Communications Security, pp. 97\u2013108 (2022)","DOI":"10.1145\/3488932.3523261"},{"key":"33_CR5","doi-asserted-by":"crossref","unstructured":"Cheng, Z., et al.: Kairos: Practical intrusion detection and investigation using whole-system provenance. In: 2024 IEEE Symposium on Security and Privacy (SP), pp. 3533\u20133551. IEEE (2024)","DOI":"10.1109\/SP54263.2024.00005"},{"key":"33_CR6","doi-asserted-by":"crossref","unstructured":"DARPA Information Innovation Office (I2O): Transparent computing (TC) engagement 3 datasets. https:\/\/github.com\/darpa-i2o\/Transparent-Computing (2018). Accessed 26 Oct 2025","DOI":"10.1002\/fgc.34541"},{"key":"33_CR7","doi-asserted-by":"crossref","unstructured":"Esmaili, M., Balachandran, B., Safavi-Naini, R., Pieprzyk, J.: Case-based reasoning for intrusion detection. In: Proceedings 12th Annual Computer Security Applications Conference, pp. 214\u2013223. IEEE (1996)","DOI":"10.1109\/CSAC.1996.569702"},{"key":"33_CR8","doi-asserted-by":"crossref","unstructured":"Gates, L., Leake, D., Wilkerson, K.: Cases are king: a user study of case presentation to explain CBR decisions. In: International Conference on Case-Based Reasoning, pp. 153\u2013168. Springer (2023)","DOI":"10.1007\/978-3-031-40177-0_10"},{"key":"33_CR9","doi-asserted-by":"crossref","unstructured":"Han, X., Pasquier, T., Bates, A., Mickens, J., Seltzer, M.: UniCorn: runtime provenance-based detector for advanced persistent threats (2020). arXiv:2001.01525 arXiv preprint","DOI":"10.14722\/ndss.2020.24046"},{"key":"33_CR10","doi-asserted-by":"crossref","unstructured":"Hassan, W.U., Bates, A., Marino, D.: Tactical provenance analysis for endpoint detection and response systems. In: 2020 IEEE Symposium on Security and Privacy (SP), pp. 1172\u20131189. IEEE (2020)","DOI":"10.1109\/SP40000.2020.00096"},{"key":"33_CR11","doi-asserted-by":"crossref","unstructured":"Hassan, W.U., et al.: NoDoze: combatting threat alert fatigue with automated provenance triage. In: Network and Distributed Systems Security Symposium (2019)","DOI":"10.14722\/ndss.2019.23349"},{"key":"33_CR12","unstructured":"Jia, Z., Xiong, Y., Nan, Y., Zhang, Y., Zhao, J., Wen, M.: $$\\{$$MAGIC$$\\}$$: Detecting advanced persistent threats via masked graph representation learning. In: 33rd USENIX Security Symposium (USENIX Security 24), pp. 5197\u20135214 (2024)"},{"key":"33_CR13","doi-asserted-by":"crossref","unstructured":"King, S.T., Chen, P.M.: Backtracking intrusions. In: Proceedings of the Nineteenth ACM Symposium on Operating Systems Principles, pp. 223\u2013236 (2003)","DOI":"10.1145\/945445.945467"},{"key":"33_CR14","doi-asserted-by":"crossref","unstructured":"Liu, F., et al.: MicroCBR: case-based reasoning on spatio-temporal fault knowledge graph for microservices troubleshooting. In: International Conference on Case-based Reasoning, pp. 224\u2013239. Springer (2022)","DOI":"10.1007\/978-3-031-14923-8_15"},{"key":"33_CR15","doi-asserted-by":"crossref","unstructured":"Liu, Y., Shu, X., Sun, Y., Jang, J., Mittal, P.: Rapid: real-time alert investigation with context-aware prioritization for efficient threat discovery. In: Proceedings of the 38th Annual Computer Security Applications Conference, pp. 827\u2013840. (2022)","DOI":"10.1145\/3564625.3567997"},{"key":"33_CR16","doi-asserted-by":"crossref","unstructured":"Milajerdi, S.M., Eshete, B., Gjomemo, R., Venkatakrishnan, V.: POIROT: aligning attack behavior with kernel audit records for cyber threat hunting. In: Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security, pp. 1795\u20131812 (2019)","DOI":"10.1145\/3319535.3363217"},{"key":"33_CR17","doi-asserted-by":"crossref","unstructured":"Milajerdi, S.M., Gjomemo, R., Eshete, B., Sekar, R., Venkatakrishnan, V.: Holmes: real-time APT detection through correlation of suspicious information flows. In: 2019 IEEE symposium on security and privacy (SP), pp. 1137\u20131152. IEEE (2019)","DOI":"10.1109\/SP.2019.00026"},{"key":"33_CR18","doi-asserted-by":"crossref","unstructured":"Pasquier, T., et al.: Practical whole-system provenance capture. In: Proceedings of the 2017 Symposium on Cloud Computing, pp. 405\u2013418 (2017)","DOI":"10.1145\/3127479.3129249"},{"key":"33_CR19","doi-asserted-by":"crossref","unstructured":"Rehman, M.U., Ahmadi, H., Hassan, W.U.: Flash: a comprehensive approach to intrusion detection via provenance graph representation learning. In: 2024 IEEE Symposium on Security and Privacy (SP), pp. 3552\u20133570. IEEE (2024)","DOI":"10.1109\/SP54263.2024.00139"},{"key":"33_CR20","unstructured":"Richter, M.M., Michael, M.: Knowledge containers. Readings in case-based reasoning, Morgan Kaufmann Publishers (2003)"},{"key":"33_CR21","unstructured":"Shervashidze, N., Schweitzer, P., Van Leeuwen, E.J., Mehlhorn, K., Borgwardt, K.M.: Weisfeiler-Lehman graph kernels. J. Mach. Learn. Res. 12(9) (2011)"},{"key":"33_CR22","doi-asserted-by":"crossref","unstructured":"Wang, H., Hardy, J., Kandah, F.: Case-based reasoning with diffusion model for ransomware detection. In: International Conference on Case-Based Reasoning, pp. 469\u2013483. Springer (2025)","DOI":"10.1007\/978-3-031-96559-3_31"},{"key":"33_CR23","doi-asserted-by":"publisher","first-page":"3972","DOI":"10.1109\/TIFS.2022.3208815","volume":"17","author":"S Wang","year":"2022","unstructured":"Wang, S., et al.: ThreatRace: detecting and tracing host-based threats in node level through provenance graph learning. IEEE Trans. Inf. Forensics Secur. 17, 3972\u20133987 (2022)","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"key":"33_CR24","unstructured":"Watson, I.: A case-based persistent memory for a large language model (2023). arXiv:2310.08842 arXiv preprint"},{"key":"33_CR25","doi-asserted-by":"crossref","unstructured":"Wilkerson, K., Leake, D.: On implementing case-based reasoning with large language models. In: International Conference on Case-Based Reasoning, pp. 404\u2013417. Springer (2024)","DOI":"10.1007\/978-3-031-63646-2_26"}],"container-title":["Lecture Notes in Computer Science","Case-Based Reasoning Research and Development"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/978-3-032-33865-5_33","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,7,31]],"date-time":"2026-07-31T05:50:06Z","timestamp":1785477006000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/978-3-032-33865-5_33"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,8,1]]},"ISBN":["9783032338648","9783032338655"],"references-count":25,"URL":"https:\/\/doi.org\/10.1007\/978-3-032-33865-5_33","relation":{},"ISSN":["0302-9743","1611-3349"],"issn-type":[{"value":"0302-9743","type":"print"},{"value":"1611-3349","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,8,1]]},"assertion":[{"value":"1 August 2026","order":1,"name":"first_online","label":"First Online","group":{"name":"ChapterHistory","label":"Chapter History"}},{"value":"During the preparation of this work, the authors used ChatGPT and Claude to assist with grammar checking and language polishing. All AI-assisted content was carefully reviewed and edited by the authors. The authors take full responsibility for the content of this publication.","order":1,"name":"Ethics","label":"Declaration on Generative AI","group":{"name":"EthicsHeading","label":"Ethics"}},{"value":"ICCBR","order":1,"name":"conference_acronym","label":"Conference Acronym","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"International Conference on Case-Based Reasoning","order":2,"name":"conference_name","label":"Conference Name","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Bremen","order":3,"name":"conference_city","label":"Conference City","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Germany","order":4,"name":"conference_country","label":"Conference Country","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"2026","order":5,"name":"conference_year","label":"Conference Year","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"13 August 2026","order":7,"name":"conference_start_date","label":"Conference Start Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"16 August 2026","order":8,"name":"conference_end_date","label":"Conference End Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"34","order":9,"name":"conference_number","label":"Conference Number","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"iccbr2026","order":10,"name":"conference_id","label":"Conference ID","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"https:\/\/2026.iccbr.org\/","order":11,"name":"conference_url","label":"Conference URL","group":{"name":"ConferenceInfo","label":"Conference Information"}}]}}