SBProv This is the source code repository for SBProv, specific implementation details can be found in README.md Datasets We use three public datasets: DARPA Transparent Computing – Engagement 3 (E3): DARPA E3 DARPA Transparent Computing – Engagement 5 (E5): DARPA E5 DARPA OpTC (Operationally Transparent Cyber) dataset: DARPA OpTC Repository Structure main.py / train.py / test.py: entrypoints for training and evaluation. model.py: dynamic GATv2 autoencoder and related components. evaluate.py: evaluation logic and KNN anomaly detector. data_preprocess.py: data loading, preprocessing, and weight computation. experiment.py: experiment management, logging, checkpointing, and wandb integration. attack_reconstruction/: contamination propagation and reconstruction utilities. graph_construction/: scripts to build provenance graphs from raw datasets. configs/: dataset-specific YAML configuration files. utils/config.py: lightweight configuration loader and global CONFIG object. sbp_miner/: SBP mining pipeline