Search Icon
Register

Call for Papers: Workshop on Attack Provenance, Reasoning, and Investigation for Security in the Monitored Environment (PRISM) 2026

We invite researchers and practitioners to submit original research papers for the first Workshop on Attack Provenance, Reasoning, and Investigation for Security in the Monitored Environment (PRISM). PRISM emphasizes holistic reasoning and human-centered after-the-fact investigation. Its mission is to catalyze a shift in the security community: from fragmented, alert-centric detection toward causal, explainable, and analyst-friendly approaches that capture the complexity of modern cyber attacks. By integrating provenance research with advances in AI, systems design, and human factors, the workshop aims to establish a new foundation for how defenders understand and respond to sophisticated threats, leading to a safer and trustworthy cyberspace ultimately.

Areas of Interest

PRISM solicits contributions on a broad range of topics, including but not limited to:

  • Provenance graphs and attack-path reconstruction
  • Causal inference under partial or adversarial telemetry
  • Learning and new models for detection and investigation (graph learning, diffusion models, LLMs, etc.)
  • Systems and infrastructure for provenance analytics (query, indexing, storage)
  • Cross-domain and cross-layer correlation
  • Human factors and operator workflows
  • Modern deployments (cloud, containers/serverless, IoT, CPS/OT)
  • Case studies from industry, government, and critical infrastructure
  • Log capture and integrity
  • Log compression and reduction
  • Adversarial attacks and defenses on provenance-aware systems
  • Real-time and cost-aware pipelines
  • Explainability and uncertainty
  • Datasets and benchmarks
  • Standards and interoperability (W3C PROV, OpenTelemetry, MITRE ATT&CK).
  • Privacy, governance, and compliance for provenance data.

Submission Guidelines for Papers

We invite both regular papers and work-in-progress papers. Regular papers should have no more than 10 pages in total (excluding references and appendices). Work-in-progress papers must have no more than 6 pages (again, excluding references and appendices), which discuss work-in-progress and novel ideas. Work-in-progress papers will be selected based on their potential to spark interesting discussions during the workshop.

All papers must be written in English. Papers must be formatted with the official NDSS templates.

Submissions must be properly anonymized for double-blind review (please follow NDSS guidelines on paper anonymization).

The submission portal for papers is: https://prism26.hotcrp.com/

One author of each accepted paper is expected to present the paper at the workshop. Following notification to authors, more information will be provided regarding speaking times and other details.

The accepted papers will be made available on the workshop website and the workshop will have official proceedings. The proceedings will be published and archived by the Internet Society (ISOC).

The PC will select the best paper awards and they are presented during the workshop.

Submission Guidelines for Tutorials

We invite submissions of tutorial proposals that emphasize live demonstration of real systems for attack provenance, investigation and reasoning. We seek engaging, demo-driven sessions in which presenters show how their system actually works (or can be used) in practice.

Each submission will undergo light review (i.e., relevance, originality, and feasibility). Accepted tutorials will be allocated a 30-minute to 60-minute slot during the workshop, with the expectation that a significant portion is devoted to live demo, audience Q&A, and interactive exploration.

The submission link to the tutorials will be provided soon.

The submission portal for tutorials is https://docs.google.com/forms/d/e/1FAIpQLSeZx-zmCIKWP5N0FJOCspK-O5n6ERRdrCaAEmh31LQ0EsKrrA/viewform

Important Dates

  • Paper/Tutorial Submission Deadline: 15 December 2025 by 11:59pm Anywhere-on-earth (AOE)
  • Notification of Acceptance: 22 January 2026
  • Camera Ready Submission: February 2026
  • Workshop date: 23 February 2026