SoK: Timestamps Are Not a Time Model: Rethinking Temporal Reasoning in Host-Based Intrusion Detection

1. Introduction

• A timestamp alone does not say whether it marks event or observation time, how clocks differ, whether records arrive late or disappear, or what an attacker can alter.Campaign claims inherit the implicit answers when systems leave these questions open.Source: §1 · pp. 1–2
• Symbolic systems derive conclusions from expert-maintained rules, while learned systems produce statistical scores; re-evaluations find benchmark accuracy can overstate learned-detector quality under more realistic conditions.Provenance-based investigation developed from backtracking and execution partitioning into rule-based detectors such as SLEUTH and HOLMES,,,,.Source: §1 · p. 1
• Temporal KRR offers formalisms for temporal order, incomplete evidence, and rule-based derivation, but the paper finds no survey connecting its breadth to host-based intrusion-detection problems.The cited neuro-symbolic survey describes symbolic foundations without temporal operators [21], while a proof of concept composes SIEM alerts against attack patterns in temporal ASP.Source: §1 · p. 2
• The survey asks which time and evidence assumptions host-audit systems state, what temporal KRR offers and guarantees, and what campaign claims must make explicit to be checkable.Its documented search and screening process is described in the paper’s appendices.Source: §1 · pp. 2–3
• The paper contributes a five-component time-model framework, an assumptions checklist, four guarantee levels, a running campaign example, and a survey of fifteen detection and investigation families.It also compares families, assesses eleven KRR formalisms and a learned baseline on nine attack patterns, and identifies five open challenges.Source: §1 · p. 2

2. Time, evidence and guarantees

• The five time-model components are the time domain, timestamp meaning and clock assumptions, delivery assumptions, order basis, and verdict policy for final versus provisional results.A bounded past-time query becomes final once delivery rules out further records in its range; future-dependent queries need a completion condition.Source: §2 · p. 3
• Timestamp ties, clock error, and learned interval uncertainty are distinct precision limits; a timestamp comparison guarantees precedence under clock-error bounds only when timestamps differ by more than the relevant bounds’ sum.A 2007 study found only about 74% of roughly 8,000 web servers within 10 seconds of a reference clock, and forensic practice estimates skew and drift using reference sources,.Source: §2 · p. 3
• Evidence assumptions cover record completeness, timestamp trust, and entity identity; trusting the kernel or logs does not rule out missing or delayed records, nor does it verify the recorded behavior.The paper distinguishes evidence manipulation capabilities including metadata changes, record deletion or delay, control of one logger or host, and control of all sensors.Source: §2 · p. 4
• Specification, evaluation, certificate, and correspondence are separate guarantee levels; correctness at one level does not establish correctness at another or prove that inputs describe host events.Late, corrected, or retracted records can invalidate claims depending on negation, completeness, counting, maximality, or changed premises.Source: §2 · p. 4
• The checklist asks about timestamp meaning, order, clocks and precision, delivery, entity identity, and attacker capability over evidence.The audit codes neither time domain nor verdict policy; the formalism comparison examines constructs for them under fixed conventions.Source: §2 · p. 5

3. A running example: from audit records to a campaign claim

• The campaign links a credential read on host A to a later use, authentication on host B, and data leaving B, with identity, clock-offset, authenticity, and delivery assumptions qualifying the steps.The assumed cross-host clock offset is at most δ, including timestamp rounding.Source: §3 · p. 5
• Joining the read, logon, session, and process events in time can derive the campaign claim, but whether it describes reality depends on correspondence assumptions and complete records where absence or counts matter.None of the inspected systems states these assumptions together.Source: §3 · p. 5
• The records do not establish that the credential read on A was the one used later, that the read preceded the logon on B, or that data leaving B originated from A.These are assumptions about correspondence between records and events, not observations.Source: §3 · pp. 5–6
• An absent logon record prevents derivation of that step but does not prove the logon did not occur; non-derivation differs from negation.A candidate interface for independent checking would include the derivation, record identifiers, mapping rules, and correspondence assumptions; surveyed systems produce no such object.Source: §3 · p. 6

4.1. Learned and hybrid families

• Learned and hybrid families include graph-learning detectors, semantic-structural fusion, LLM investigation agents, knowledge-guided learning, and host behavior models.Their approaches range from event scoring and attack-summary reconstruction to learned sequence models and authored policies.Source: §4.1 · pp. 6–7

4.2. Symbolic families

• Other symbolic families cover alert correlation, learned or synthesized rules, threat-intelligence knowledge, and provenance tracing and investigation.These include attack-plan recognition, temporal-logic rule synthesis, structured threat vocabularies, and forensic reconstruction.Source: §4.2 · pp. 7–9
• Symbolic families include event-pattern correlation, temporal-logic monitoring, rule-based provenance analysis, provenance queries, attack graphs, and argumentation.The surveyed systems range from declarative signatures and monitors to graph-based attack reconstruction and evidence attribution.Source: §4.2 · p. 8

4.3. What the systems assume about time and evidence

• The reproducible audit selected papers by screening role and publication period, added named and landmark systems, and checked 160 of 175 selected papers in full text.Its unit is a publication, not a distinct implementation or field-wide adoption estimate.Source: §4.3 · p. 9
• No sampled system states a numeric residual clock-offset bound, although cross-host order inferred from physical timestamps depends on one.Some early alert correlators state qualitative clock conditions, unlike the provenance-era systems described here.Source: §4.3 · pp. 9, 11
• Of 52 eligible papers, four describe input-ordering conditions or conventions, and none specifies validity conditions across a stated class of delayed or missing records.Alert correlators and some investigation systems address late, out-of-order, or incomplete observations in other ways.Source: §4.3 · p. 11
• Among 38 provenance-era detector papers, 28 trust capture or stored evidence or place its manipulation out of scope; systems also leave process reuse and cross-host entity correspondence unspecified.The audit reports that none says which conclusions survive deleted, delayed, or forged records.Source: §4.3 · pp. 11–12
• Four papers describe input-ordering conditions or conventions, but none specifies conditions for conclusion validity across a stated class of delivery failures.The audit also found no residual clock-error bound in provenance-era systems.Source: §4.3 · pp. 11–12

5. Comparative assessment

• No family dominates the fourteen dimensions; ratings reflect each representative’s stated scope, and temporal reasoning formalisms lack comparison on common audit tasks.Table 6 separates capability ratings from evidence-state values such as “not studied” and distinguishes late data from adversarial manipulation.Source: §5 · pp. 12–13, Table 6 · p. 13

5.1. Integration patterns in hybrid systems

• Hybrid patterns are nonexclusive, and guarantees for symbolic components cover only those components; correspondence to real behavior depends on their inputs.The six patterns include learned detection, symbolic reasoning over extracted facts, and four combinations of learned and symbolic stages.Source: §5.1 · p. 13

5.2. Where campaign composition happens

• Provenance systems compose campaigns through system-specific procedures, objectives, learned state, causal queries or LLMs, without specifying or certifying the intended campaign predicate.KRYSTAL’s SPARQL patterns lack temporal or metric constraints and correspondence assumptions; early alert correlators specify composition declaratively.Source: §5.2 · pp. 13–14, §5.3 · p. 14

5.3. Takeaways

• No surveyed system gives learned provenance outputs temporal composition with a stated semantics for their confidences.The missing step is mapping scored outputs to typed hypotheses and defining how their uncertainty composes.Source: §5.3 · pp. 14–15
• Most provenance-era detectors do not specify which conclusions survive late, lost or forged records; formal work on manipulated evidence lies outside the sampled cohort.The identified robustness evaluations concern manipulated behavior rather than deletion, delay or forgery of input records.Source: §5.3 · p. 15
• The surveyed temporal reasoning formalisms have not been compared on common host-audit tasks with aligned patterns and explicit clock and delivery assumptions.Source: §5.3 · p. 15

6.2. Structure versus semantics

• Learned detectors produce scores rather than rule-derived consequences; symbolic reasoning can express precise conditions over command arguments only after extraction makes them typed relations.Missed or mislabeled arguments may not be recoverable without redundant evidence or domain constraints.Source: §6.2 · p. 15, §6.1 · p. 15

6.3. Multi-hop causality and expressiveness

• GNN expressiveness results bound specific architectures on stated representations and tasks, not whole detectors whose preprocessing or graph construction may encode joins.The surveyed detectors do not state which pattern classes their full pipelines can distinguish.Source: §6.3 · p. 15, §6.6 · p. 16

6.4. Expressiveness versus decidability

• Several formalisms have tractable detection-time cores, but richer features security reasoning seeks can carry high worst-case complexity.The paper notes that no evaluation on audit workloads is available for these features’ worst-case results.Source: §6.4 · pp. 15–16

6.5. Evasion and the levels of guarantee

• Manipulated evidence can break correspondence between input facts and host behavior, invalidating temporal conclusions that depend on affected records or their completeness.Missed upstream events cannot be derived from their own records; mis-extracted facts can yield sound derivations of false conclusions.Source: §6.5 · p. 16

6.6. Takeaways

• Rule-language expressiveness is a major determinant of symbolic reasoning’s worst-case cost, while simple tag-propagation rules and complex event automata can run in real time.Source: §6.6 · p. 16
• Learned and rule-based detectors can both be evaded by manipulated behavior, while evaluation-level guarantees do not repair manipulated evidence.The choice of reasoning formalism also trades features such as uncertainty, entity generation and stable-model negation against worst-case complexity.Source: §6.6 · p. 16

7.1. R1: Recognizing ordered multi-step patterns

• Temporal formalisms and CEP support ordered patterns with deadlines, joins, and window counts, but surveyed security rule languages lack published formal semantics or translations into formal monitoring languages.The section calls for comparison on common audit tasks with aligned pattern semantics and explicit clock and delivery assumptions.Source: §7.1 · p. 16

7.2. R2: Composing campaigns across windows and hosts

• No temporal rule language, Event Calculus engine, or stream reasoner beyond CEP-based query systems has, to the authors’ knowledge, been applied to host audit data.Selected provenance systems compose campaigns through system-specific procedures or objectives, learned state, causal graph queries, or LLM agents.Source: §7.2 · p. 17

7.3. R3: Reasoning under uncertainty

• Probabilistic temporal methods address uncertain reasoning, but surveyed learned provenance pipelines lack documented calibration and interfaces for shared evidence, and these logics have not been applied to whole-system provenance.Calibrated marginals alone do not determine a campaign’s joint probability when hypotheses share evidence.Source: §7.3 · p. 17

7.4. R4: Missing, conflicting and manipulated evidence

• Formal methods address missing, conflicting, and manipulated evidence, but no surveyed detection system formally reasons about evidence completeness or timestamp consistency under a stated attacker model.The section also notes that logging-layer integrity signals are not yet inputs to the reasoning layer’s conclusions.Source: §7.4 · pp. 17–18

7.5. R5: Explanation and forensic evidence

• Temporal reasoners can produce proof-tree explanations, yet apart from WhyMon the surveyed systems do not document derivations checkable outside the reasoner, and certified temporal explanations are unused in intrusion analysis.Provenance-system root causes are dependency origins, not counterfactual causes under a stated causal model.Source: §7.5 · p. 18

7.6. R6: Acquiring and maintaining knowledge

• Temporal knowledge can be learned in several formalisms, but host-security multi-step rule synthesis remains limited to proof-of-concept patterns and ad hoc validation beyond syntax.The survey found no inductive logic programming application to whole-system provenance or metric, multi-stage campaign patterns.Source: §7.6 · p. 18

7.7. A catalog of attack-reasoning patterns

• No assessed base language natively covers all nine patterns; support differs across temporal composition, uncertainty, and qualitative consistency, while some positive cells rely on encodings or extensions.Table 9 assesses expressibility over fixed input traces, not clock-error assumptions, delivery guarantees, verdict policies, or deployed-system performance; support across extensions does not establish one combined implementation.Source: §7.7 · pp. 19–20, Table 9 · p. 20

7.8. Takeaways

• Security uptake concentrates on pattern recognition and explanation; uncertainty and manipulated-evidence methods have few security applications despite established KRR methods for specified subproblems.Every assessed language leaves part of the catalog to encodings or extensions, and separate extensions do not establish a combined implementation or deployed host-audit system.Source: §7.8 · p. 20

C1. Typed interfaces between learned recognition and symbolic composition

• C1 proposes typed interfaces from learned detectors to temporal reasoning, evaluated through entity and interval matching, timing-jitter robustness, calibration, and campaign reconstruction.The proposed comparison includes an LLM investigator or system-specific procedure using the same typed facts and background knowledge.Source: §8 · p. 20

C2. Comparative evidence across temporal formalisms

• C2 proposes comparing temporal formalisms on shared attack patterns, checking encodings against an independent reference, and measuring throughput, latency, and memory as rate and horizon grow.The evaluation would replay the same audit facts in and out of order.Source: §8 · p. 21

C3. Reasoning over incomplete and manipulated evidence

• C3 proposes testing reasoning under deleted, delayed, reordered, clock-skewed, and timestomped records against a reference model of admissible histories and verdicts.Measures include reconstruction accuracy and whether verdicts are correct, wrongly determinate, unnecessarily undetermined, or recover as late evidence arrives.Source: §8 · p. 21

C4. Validated acquisition of temporal knowledge

• C4 proposes acquiring varied multi-step temporal rules from threat intelligence or host evidence and validating them with stated guarantees before deployment.Measures include false-positive rate, attack precision and recall at stated base rates, technique coverage, and agreement with analyst-written rules.Source: §8 · p. 21

C5. Benchmarks with formal ground truth and adversarial evaluation

• C5 proposes benchmarks that release campaign specifications, node-level labels, and evidence traces, then score reconstruction, ordering, and explanation fidelity under mimicry and rule evasion.The challenge calls for separating conformance-to-specification labels from attack-status labels, including benign and ambiguous cases.Source: §8 · p. 21

Further directions

• Further directions include derivation provenance for metric temporal operators, decidable fragments for inventing unobserved entities, interventional causality, and spatio-temporal host and network models.These directions are identified as needing further study.Source: §8 · p. 21

9. Threats to validity

• The comparative ratings in Table 6 and pattern assessment in Table 9 rely on literature reading and formalizations checked against language documentation, not experiments.Only Table 5 rests on a systematic check of full texts.Source: §9 · p. 21
• Section 4.3 findings rest on full-text checks of 160 selected papers, but thirteen could not be obtained and two were coded from abstracts or other descriptions for Q1 and Q2 only.The rule-based sample and single coding bound the absence claims; citation rank favors older and influential work within each period.Source: §9 · p. 21
• Claims that something is absent from the literature are bounded by the documented search, which may miss rarely cited KRR work outside the listed venues.The open and recent KRR sets were checked only for highly cited work.Source: §9 · p. 21
• Screening was performed once with AI assistance and without an independent second screening; claim support was also checked once, with AI assistance.Roles and decisions per record are released, and most references were checked against full texts.Source: §9 · p. 21
• Reported figures come from different datasets, splits, and metrics, and may be optimistic, as re-evaluations and benchmark-protocol concerns indicate.The paper cites re-evaluations of learned detectors and concerns about synthetic backgrounds, conspicuous attacks, benchmark choice, and operational gaps.Source: §9 · p. 21

10. Conclusion

• Among 52 audited host-detector papers consuming host records, four describe input-ordering conditions or conventions, and none specifies validity across a stated class of delayed or missing records.No sampled system states a numeric clock-offset bound; 28 of 38 provenance-era detector papers trust capture or stored evidence or place manipulation out of scope.Source: §10 · p. 22
• No assessed base language covers all nine attack patterns natively, and support spread across separate extensions does not amount to one implementation.Temporal KRR offers formal treatments of late, imprecise, and incomplete records and certified explanations, but sampled systems use these only for incomplete logs.Source: §10 · p. 22
• A campaign claim can be open to independent checking when it supplies a formally specified derivation, names input records and rules, and states correspondence assumptions.A checker can establish the inference relative to those inputs; whether assumptions about capture, identity, and attacker influence hold remains separate.Source: §10 · p. 22
• The findings are bounded by the search and a single coding, and the paper turns them into five research questions with proposed measures of progress.Source: §10 · p. 22

• The study systematizes published work and involves no human subjects, personal data, or experiments on live systems.Source: Ethics Considerations · p. 22
• The authors develop no attack and disclose no vulnerability.Source: Ethics Considerations · p. 22
• Because the discussed capabilities are documented attack techniques such as timestomping, the authors judge that exposing detector dependencies helps defenders more than attackers.Source: Ethics Considerations · p. 22

• The archive includes search scripts, OpenAlex requests and retrieval dates, returned records, screening decisions with arguments, ranked citation-chase candidates, and the evidence ledger for Tables 5 and C1.Source: Open Science · p. 22
• Appendix D provides schematic formulas and construction descriptions for Table 9 and identifies reused constructions.Source: Open Science · p. 22
• Appendix D distinguishes assessed support from unconstructed or unassessed extensions.Source: Open Science · p. 22

• Both authors are founders of datAInsights GmbH, which develops the temporal reasoning engine Tyla.Source: Competing Interests · p. 22
• During doctoral work at TU Wien, M. Nissl contributed to Temporal Vadalog and DatalogMTL with existential rules, both discussed in the paper.Source: Competing Interests · p. 22
• The paper does not describe, evaluate, or rate Tyla, and none of its findings depends on it.Source: Competing Interests · p. 22
• Table 9 rates DatalogMTL under the same rubric as other formalisms and ranks none; Appendix D records the evidence status of each symbolic cell.Source: Competing Interests · p. 22

• Google Gemini, Anthropic Claude, and OpenAI models ran searches, screened records, searched full texts for the evidence ledger, drafted ratings, encodings, and text, and checked bibliographic metadata.Source: Use of Generative AI · p. 22
• The authors defined the research questions, inclusion rules, rubric, and conventions, directed revisions, reviewed results, and take responsibility for the manuscript’s claims and citations.Source: Use of Generative AI · p. 22
• Prompts and intermediate outputs were not archived, so the AI steps are not reproducible; the released artifact allows decisions to be checked against their sources.Source: Use of Generative AI · p. 22

A.1. Security literature

• Across three rounds, the security search retained 1,003 of 4,869 records under a stated rule covering host-audit attack analysis, symbolic machinery, evidence integrity, and related evaluation.The search used OpenAlex queries, venue and capped open/recent sets, and written inclusion or exclusion reasons.Source: Appendix A · p. 31, §A.1 · p. 32

A.2. KRR literature

• The KRR search retained 1,009 of 2,550 venue-set records; open and recent sets were retrieved but not screened record by record.Queries covered ten KRR domains plus event-stream processing and its time model.Source: §A.2 · p. 32

A.3. Citation chase

• A bounded citation chase inspected 130 of 650 highly linked candidates and surfaced eleven lines of work that informed added queries and cited landmarks.The chase began from 107 references with OpenAlex identifiers.Source: §A.3 · p. 35

A.4. Sampling and full-text check of systems

• The system sample contains 175 papers, combining role-and-period rankings with named systems, landmarks, forensics papers, and claim-check papers.Of these, 160 were checked in full text; coding records located statements, so a negative code means none was found by the specified procedure.Source: §A.4 · p. 35
• The delivery follow-up distinguished input-ordering conditions from statements specifying when conclusions remain valid under delivery failures.Sorting stored events by timestamp and reporting no dropped records did not count as output-validity accounts.Source: §A.4 · p. 35

A.5. Artifacts

• The archived artifacts preserve query requests, records, hit counts, decisions, and the evidence ledger, but live-index reruns may differ and the snowballing traversal cannot be replayed.The seed-to-paper links for the supplemental roster were not retained.Source: §A.5 · pp. 35–36

Appendix B. In-depth analysis of KRR domains

• The KRR domain analysis uses a common template for reasoning tasks, intrusion expressiveness, complexity, engines, and open questions, separating design-time from repeated detection-time tasks.Table B1 summarizes complexity across domains and tasks.Source: Appendix B · p. 36, Table B1 · p. 37

B.1. Temporal logics and runtime verification

• Temporal-logic monitoring evaluates whether a trace so far satisfies, violates, or leaves a formula undetermined; whether bounded past-time monitoring suffices for realistic attacks remains open.The discussion notes that incomplete-observation treatments have not been evaluated on manipulated audit data.Source: §B.1 · p. 36

B.3. Datalog-based temporal rule languages

• DatalogMTL combines recursive graph reasoning with metric constraints, but its engines assume one timeline of trusted event times and provide no native uncertainty or documented derivation output.Fact entailment over rationals is PSPACE-complete in data complexity; the authors have not classified their example programs against tractable fragments.Source: §B.3 · pp. 37–38

B.4. Non-monotonic reasoning, argumentation and belief revision

• Default negation and argumentation express exceptions and conflicting reports, while abduction can label unobserved attack steps as hypotheses rather than treating missing observations as proof of absence.The cost and audit-stream performance of incremental non-monotonic reasoning with metric time remain unsettled in the reviewed evaluations.Source: §B.4 · p. 38

B.5. Uncertainty and neuro-symbolic reasoning

• Probabilistic and neuro-symbolic methods can carry learned scores into symbolic reasoning, but the reviewed systems lack a documented pipeline combining learned hypotheses, relational recursion, metric constraints, and independently checkable derivations.Such a pipeline needs an explicit input and uncertainty model and a checking procedure.Source: §B.5 · p. 39

B.6. Description logics, ontologies and ontology-based data access

• Temporal ontology-mediated querying could unify heterogeneous audit sources, but the authors found no temporal OBDA application to audit data and no evaluation on conflicting security evidence.OWL itself has no temporal operators.Source: §B.6 · p. 39

B.7. Graph pattern and query languages

• Graph queries capture structural signatures and provenance paths, but plain regular path queries cannot require edge times to increase, and query interfaces return matches rather than independently checkable derivations.Temporal constructs are system-specific, so comparison requires an explicit semantics or translation.Source: §B.7 · p. 39

B.8. Causal reasoning

• Causal analysis can distinguish candidate causes from dependent events and pose counterfactual countermeasure questions, but no validated structural causal model for host audit data was found.Mapping interventions to concrete countermeasures remains open.Source: §B.8 · p. 40

B.9. Qualitative and spatio-temporal reasoning

• Interval relations can represent overlapping attack stages under clock skew, while the authors found no STREL application to host detection or unified model of provenance, network zones, and physical invariants.STREL reach does not express propagation along edges that exist at increasing times.Source: §B.9 · p. 40

B.10. Rule and specification learning, and LLMs with formal reasoning

• Specification mining, inductive logic programming, and LLMs can acquire temporal formulas or rules from traces, examples, or natural language, addressing the specification work symbolic approaches require.The cited template-free methods learn from labeled normal and anomalous examples, while Indri et al. learn formula ensembles from normal data alone.Source: §B.10 · p. 40

C.1. Evidence for Table 5

• The ledger distinguishes delivery conditions and observations from statements about output validity under delivery failures, marking absent statements with — and inapplicable questions with n/a.Systems assessed only from abstracts or descriptions in other papers are marked † and could not be assessed on Q3–Q6.Source: §C.1 · p. 41, Table C1 · p. 41
• Several entries rely on trusted or selectively evaluated evidence: CAPTAIN trusts kernel and auditing tools, KnowGraph assumes tamper-proof audit data, and one evaluation excludes anti-forensics.Source: §C.1 · p. 42
• Debar and Wespi 2001 allow out-of-order alert arrival, treat missing expected alerts as failed probes, and require synchronized probes without specifying a bound.Valdes and Skinner 2001 tolerate clock drift using a minimum time-similarity threshold but give no numeric bound; late reports and spoofed source addresses are considered.Source: §C.1 · p. 42
• Geib and Goldman 2001 infer unobserved attack actions from reported state changes, explicitly accommodating incomplete action records.Source: §C.1 · p. 42
• Cross-host and cross-source timestamp merging is described without a clock bound in NetSTAT and Naldurg et al. 2004.NetSTAT names synchronization when merging trails from several hosts; Naldurg et al. describe merging sources by timestamp.Source: §C.1 · p. 43
• Morin and Debar 2003 integrate delayed alerts when synchronized sensor clocks have a gap coherent with chronicle resolution, but attackers may vary time gaps to evade detection.The work also accounts for delays from sensor processing or transport under that clock condition.Source: §C.1 · p. 43
• HOLMES flagged one scenario despite missing events.Source: §C.1 · p. 43
• AIQL assumes monotonically increasing timestamps per host, while its NTP synchronization has no stated bound; KRYSTAL names distributed time synchronization as an open issue.Source: §C.1 · p. 44
• Some forensic approaches model anti-forensic attacks that alter evidence, and Rekhis and Boudriga 2012b discusses clock-adjustment hypotheses.Source: §C.1 · p. 45
• BEEP notes that delays and asynchronous tasks make timestamps ineffective for causality, while ProTracer processes events concurrently and out of order across applications.TARDIS is described as robust to out-of-order attack payloads.Source: §C.1 · p. 45
• Several entries assume trusted kernels, audit systems, or logs, including PrioTracker, MORSE, and DepImpact.Source: §C.1 · p. 45
• MORSE’s evaluation noted incomplete DARPA TC logs.Source: §C.1 · p. 45
• About 74% of observed hosts were within 10 s of a reference clock, while historical approaches also correlated timestamps or tested clock hypotheses.Automated timeline reconstruction assumes the investigated system’s clock is correct and supports no generic clock offset; synchronization network delay was noted.Source: §C.1 · p. 45

C.2. Rubric and evidence for Table 6

• L1–L2 pipelines produce scores or summary graphs without recursive queries or joins; L2 adds attribute and command-line semantics, with CrossGuard assuming intact logs.NODLINK learns embeddings, whereas KAIROS feature-hashes attributes; FLASH’s evaluated mimicry resistance does not establish resistance to deletion, timestamp manipulation, or stronger adaptive attacks.Source: §C.2 · p. 46
• L3 language-model agents produce narratives without derivations, while L4 rules include weighted formulations and CAPTAIN’s timestamp-to-kill-chain ordering and defaults.L3 handles missing or conflicting evidence without stated semantics; CAPTAIN’s bounded mimicry and contaminated-training-data results do not establish resilience to corruption of deployed audit streams.Source: §C.2 · p. 46
• S1–S3 range from alert correlation and CEP patterns to metric-temporal monitors, with out-of-order correctness guarantees confined to specified fragments or verdict conditions.Some systems consider injected alerts or delayed steps without host-evidence guarantees; monitors also address incomplete or disagreeing logs, and some provide probabilistic semantics for uncertainty.Source: §C.2 · pp. 46–47
• S4–S7 cover kill-chain-ordered scenario graphs, temporal declarative queries, attack graphs, and defeasible reasoning, but their evidence includes limited or unevaluated streaming and timing guarantees.AIQL and SAQL provide temporal relations and aggregation; SAQL’s evaluated host-stream workload is not a cross-system throughput ranking. Attack-graph models lack metric event-time semantics, and cited defeasible systems report no streaming evaluation.Source: §C.2 · pp. 47–48
• S8–S10 include readable learned or generated rules, ontology-based detection, and audit-record tracing, but rule validation, evidence combination, or input-order guarantees remain limited.ProTracer handles out-of-order processing across applications while preserving within-application order; its approach does not guarantee final verdicts under missing input or arbitrary lateness.Source: §C.2 · p. 48

Conventions

• The encodings assume punctual events in integer seconds, strict ordering for “before,” closed windows for absence and counting, and stable episode and process identities.Equal-timestamp events are unordered; “within n seconds” means (0, n], while absence and counting use [t − n, t].Source: Appendix D · p. 48

Assessment conventions

• Ratings distinguish native temporal constructs (✓), constructions using arithmetic on timestamps or other encodings (G#), unsupported assessments (–), and unassessed cases (?).A learned-approach L rating indicates possible application, not established expressibility or learnability.Source: Appendix D · pp. 48–49

VeriMon and chronicles

• VeriMon’s past-guarded recursive let supports the assessed AP4 and AP9 paths, whereas chronicles cover bounded event constraints but not the distinct CEL constructs.The positive path ratings depend on VeriMon’s recursive let; no separate MonPoly construction is assessed.Source: Appendix D · p. 49

Event Calculus (RTEC)

• RTEC encodes bounded windows over retained timestamped events, while fluents represent persistent prefixes; AP4 and AP9 rely on an unconstructed cyclic-dependency extension.Window events must remain in working memory at evaluation, and AP6’s negation assumes complete data for variant (a).Source: Appendix D · pp. 49–50

LARS

• LARS provides native windows and explicit time points, but deadlines relative to an origin and qualitative interval consistency require additional constructions.Its AP4 and AP9 time-respecting paths need comparisons that bind deadlines to the origin.Source: Appendix D · p. 50

Temporal ASP

• Temporal ASP uses trace operators for temporal order, while metric bounds are arithmetic on timestamps; AP7 remains unassessed without a selected probability semantics and shared-evidence model.The AP8b encoding uses choice rules and interval-algebra constraints, unlike the assessed stratified Datalog fragment.Source: Appendix D · p. 50

Graph queries

• AIQL supports bounded temporal relations, but its and plain regular path queries’ constructions do not establish unbounded paths with increasing edge timestamps.AP5’s fixed three-event chain needs no path query; AP3 also requires authentication as a supplied event relation.Source: Appendix D · p. 50

Probabilistic logic programming (ProbLog)

• ProbLog represents shared evidence once, but campaign probability depends on its generative model and the independence assumptions for base facts.The example gives 0.378 under the shared-evidence model, versus about 0.34 when technique confidences are multiplied as independent.Source: Appendix D · p. 51