Context-Aware Automated Incident Triage Using Heterogeneous Graph Representations of Memory Artifacts and Error Logs
Keywords:
Incident Triage, Heterogeneous Graphs, Memory Forensics, Error Logs, Context-Aware AnalysisAbstract
Security operations centers increasingly struggle to separate high-priority incidents from large volumes of routine or noisy alerts. Traditional triage methods often examine memory artifacts and error logs in isolation, which weakens situational awareness and delays response. This article introduces a context-aware automated incident triage framework that represents disparate forensic and operational evidence as a heterogeneous graph. The framework treats processes, memory regions, loaded modules, file handles, error events, timestamps, users, and host entities as distinct node types connected by typed relationships. This design preserves the semantic differences between volatile memory evidence and event log evidence while enabling contextual message passing across both. The method begins with acquisition and normalization of memory dumps and error logs, followed by entity and relationship extraction. A heterogeneous graph is then constructed and enriched with temporal and host-level context. A graph learning model ranks incidents according to their likelihood of requiring urgent analyst attention. Evaluation uses replayed and simulated incident scenarios drawn from multiple host profiles and threat stages. The results indicate that context-aware heterogeneous graph triage improves prioritization quality compared with single-source and homogeneous graph baselines. Ablation analysis shows that process-memory relationships, cross-source temporal links, and host context provide complementary gains. Error analysis identifies degraded performance when memory capture is incomplete, timestamps are skewed, or logs omit critical parent processes. The discussion considers operational implications, analyst trust, and deployment constraints. The conclusion summarizes contributions and outlines future work on adaptive graph schemas, drift detection, and real-time streaming triage. By aligning evidence types through a shared contextual representation, the framework supports more transparent and reproducible triage decisions. The article also highlights where human oversight remains essential.References
1. Y. Dai, J. Mo, H. Larsen, and P. Ricci, “Intelligent incident triage in high-volume payment processing systems via hierarchical graph diffusion networks,” Multidisciplinary Research in Computing Information Systems, vol. 6, no. 1, pp. 132–143, 2026.
2. D. Holmes, “LLM-powered knowledge graphs for UNIX and Salesforce monitoring,” 2021.
3. J. Chen, X. He, Q. Lin, H. Zhang, D. Hao, F. Gao, and D. Zhang, “Continuous incident triage for large-scale online service systems,” in *2019 34th IEEE/ACM International Conference on Automated Software Engineering (ASE)*. Piscataway, NJ, USA: IEEE, 2019, pp. 364–375.
4. A. Rahman and S. Sultana, “Real-time threat intelligence correlation and triage for reducing security analyst burnout,” Journal of Engineering and Computational Intelligence Review, vol. 1, no. 1, pp. 64–86, 2023.
5. D. J. Thompson, R. M. Porter, A. L. Greene, S. K. Williams, and E. William, “Real-time incident correlation using cognitive AI,” 2024.
6. Z. Chen, J. Liu, Y. Su, H. Zhang, X. Wen, X. Ling, and M. R. Lyu, “Graph-based incident aggregation for large-scale online service systems,” in *2021 36th IEEE/ACM International Conference on Automated Software Engineering (ASE)*. Piscataway, NJ, USA: IEEE, 2021, pp. 430–442.
7. P. Pisal, P. Jalan, S. R. Chigurupati, C. Puligundla, and S. Bhogavalli, “Integrating LLMs for automated bug triaging and root cause localization in software systems,” in *2025 3rd International Conference on Artificial Intelligence, Blockchain, and Internet of Things (AIBThings)*. Piscataway, NJ, USA: IEEE, 2025, pp. 1–5.
8. Ö. Dimez and F. Cogen, “A privacy-conscious and explainable IDS-oriented triage and response pipeline for mobile network infrastructure using aggregated cellular traffic signatures,” Computers, vol. 15, no. 8, p. 531, 2026.
9. L. Baird and A. Moin, “Towards predicting multi-vulnerability attack chains in software supply chains from software bill of materials graphs,” in *Proceedings of the 34th ACM International Conference on the Foundations of Software Engineering*, 2026, pp. 1336–1340.
10. S. Kum, “Hierarchical attention-based graph neural network with relevance-driven pruning,” arXiv preprint arXiv:2605.09308, 2026.
11. M. Qi, J. Li, T. Zhu, L. Zhang, and Z. Sun, “Detecting logic vulnerabilities across the contract and device layers of blockchain-enabled IoT with multi-agent heterogeneous graph attention,” arXiv preprint arXiv:2609.18344, 2026.
12. D. Danang, Z. Mustofa, and I. Irlon, “Digital forensics and automated incident response framework leveraging big data analytics and real time network traffic profiling in heterogeneous cyber environments,” Cyber Security and Network Management, vol. 1, no. 1, pp. 45–55, 2026.
13. N. Amanmadov and T. Abdullayev, “From logs to knowledge: LLM-powered dynamic knowledge graphs for real-time cloud observability,” International Journal of Advanced Computer Science and Applications, vol. 16, no. 10, 2025.
14. A. Syed and R. Nangineni, “AIMS: An agentic AI-powered incident management suite on Oracle APEX for enterprise operational resilience,” in *2026 IEEE International Conference on Engineering, Technology & Management (ICETM)*. Piscataway, NJ, USA: IEEE, 2026, pp. 1–8.
15. T. Kakar, “Visual analytics for multi-level triage and investigation of incident reports,” Ph.D. dissertation, IBM Research, 2020.
16. F. Ferazza, C. Melella, K. Mersinas, R. Lugo, and R. Ottis, “From logs to tactics: unsupervised reconstruction of APT campaigns with MITRE-enriched meta-alerts,” International Journal of Information Security, vol. 25, no. 3, p. 79, 2026.
17. L. Tao, X. Lu, S. Zhang, J. Luan, Y. Li, M. Li, and D. Pei, “Diagnosing performance issues for large-scale microservice systems with heterogeneous graph,” IEEE Transactions on Services Computing, vol. 17, no. 5, pp. 2223–2235, 2024.
18. S. Wang, “Hybrid Transformer–LLM incident triage over structured observability logs: alert clustering, root-cause ranking, and runbook drafting,” Advances in Innovative Science, vol. 1, no. 1, pp. 10–24, 2026.
19. A. Potdar, V. Kodela, L. N. Srinivasagopalan, I. Khan, S. Chandramohan, and D. Gottipalli, “Next-generation autonomous troubleshooting using generative AI in heterogeneous cloud systems,” in 2025 International Conference on Information, Implementation, and Innovation in Technology (I2ITCON). Piscataway, NJ, USA: IEEE, 2025, pp. 1–7.
20. Z. Chu, J. Qiu, J. Xu, et al., “A collision-aware mobile robot navigation in grid environment using improved A*,” in 2026 12th International Conference on Control, Automation and Robotics (ICCAR). Piscataway, NJ, USA: IEEE, 2026, pp. 96–101.
21. P. Vasileva, S. McKee, A. Penev, M. Babik, and Y. Shavitt, “Explainable routing-aware incident triage from active measurements,” in Proceedings of the 2026 Applied Networking Research Workshop, 2026, pp. 67–74.
22. Y. Li, “AI-augmented automated triage for system error reporting using log and memory dump analysis,” in *2026 7th International Conference on Big Data & Artificial Intelligence & Software Engineering (ICBASE)*. Piscataway, NJ, USA: IEEE, 2026, pp. 572–577.
23. M. Aljumaily, H. Abd, and E. Majeed, “Enhancing user and entity behavior analytics in SIEM systems using AI-powered anomaly detection: A data-driven simulation approach,” International Journal of Mechatronics, Robotics, and Artificial Intelligence, vol. 1, no. 2, pp. 82–93, 2025.
24. Y. Chen, C. Zhang, Z. Dong, D. Yang, X. Peng, J. Ou, and W. Li, “Dynamic graph neural networks-based alert link prediction for online service systems,” in 2023 38th IEEE/ACM International Conference on Automated Software Engineering (ASE). Piscataway, NJ, USA: IEEE, 2023, pp. 79–90.
25. W. Qian, H. Zhao, Z. Wang, Z. Gao, J. Chen, Z. Ling, and S. Deng, “Missing-aware multimodal fusion for unified microservice incident management,” arXiv preprint arXiv:2603.25538, 2026.
26. Y. Zhao, Z. Song, Y. Yang, Y. Zhou, and Z. Ding, “LHGLink: LLM-enhanced heterogeneous graph learning for issue–issue link prediction,” IEEE Transactions on Software Engineering, 2026.
27. Y. Zhu, J. Cahoon, A. Pavlenko, Q. Bai, N. Shahbazi, D. Vermareddy, and S. Krishnan, “GraphMind: From operational traces to self-evolving workflow automation,” arXiv preprint arXiv:2605.17617, 2026.
28. A. Arrus, M. Di Gisi, S. Lilli, and M. Quadrini, “Accelerating incident response: A hybrid approach for data breach reporting,” arXiv preprint arXiv:2602.22244, 2026.
29. W. Zhang, T. Liao, and Y. Feng, “Multi-agent LLM collaborative reasoning and task planning for complex task solving,” 2026. doi: 10.21203/rs.3.rs-10232223/v1.
30. E. Yu, “A survey of anomaly detection and root cause analysis techniques for artificial intelligence for IT operations (AIOps) in large-scale software systems,” in *2026 6th International Conference on Artificial Intelligence and Industrial Technology Applications (AIITA)*. Piscataway, NJ, USA: IEEE, 2026, pp. 391–395.
31. A. E. S. Leni, “Explainable cyber threat prioritization using graph attention networks and risk analytics,” Journal of Intelligent Decision Making and Information Science, vol. 3, no. 9s, pp. 265–296, 2026.
32. Y. Sun, B. Shi, M. Mao, M. Ma, S. Xia, S. Zhang, and D. Pei, “Art: A unified unsupervised framework for incident management in microservice systems,” in *Proceedings of the 39th IEEE/ACM International Conference on Automated Software Engineering*, 2024, pp. 1183–1194.
33. C. Zhang, L. Zheng, H. Huang, and C. Su, “CCG-IDS: A causal counterfactual graph-based intrusion detection system for industrial IoT,” IEEE Transactions on Industrial Informatics, 2026.
34. W. Guo, W. Zhang, S. Wang, and R. Liu, "Efficient Test-Time Adaptation for Dynamic Distribution Shifts," 2026.
