{"as_of":"2026-08-07T19:38:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:f917bfda10ff2f3ed00119fd0afdf3ffbb3572dd4f9c59d1be7eb203b2e19480","coverage":[{"denominator":96,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":96,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-05T05:14:57.322743Z","state":"measured"},{"denominator":97,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":97,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-07T06:34:17.273281+00:00","state":"measured"},{"denominator":1,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":1,"source":"paper_references, paper_reference_links","source_observed_at":"2026-05-16T22:24:38.056657Z","state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":0,"source":"arxiv_reference","source_observed_at":"2026-05-16T22:28:37.202345Z","state":"measured"}],"external_citation_measurements":[],"inbound":[{"citation":{"cited_paper":{"arxiv_id":"2509.05698","last_updated":"2025-09-06T12:25:06Z","snapshot_observed_at":"2026-08-07T07:24:50.563767Z","submitted_at":"2025-09-06T12:25:06Z","title":"KnowHow: Automatically Applying High-Level CTI Knowledge for Interpretable and Accurate Provenance Analysis","version":1},"cited_work":{"arxiv_id":"2509.05698","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2509.05698","snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":null,"venue":null,"work_id":"0483972a-87a3-4952-86d7-6b07aa9ce46d","year":2025},"citing_paper":{"arxiv_id":"2512.12078","last_updated":"2026-05-06T22:08:35Z","snapshot_observed_at":"2026-07-06T22:38:54.914862Z","submitted_at":"2025-12-12T22:53:52Z","title":"The Procedural Semantics Gap in Structured CTI: A Measurement-Driven STIX Analysis for APT Emulation","version":3},"reference_index":28,"source":"pdf_text","source_observed_at":"2026-05-16T22:24:38.056657Z"},"links":{"cited_paper":"/paper/2509.05698","citing_paper":"/paper/2512.12078"},"observation_digest":"sha256:65bb656cc295436a0e05649a7f87d341be08d197462606e9c01a661281f8496d","observation_id":"8e057ea9-2735-4e23-baa3-2723cfbf0de0","resolution":{"observed_at":"2026-05-16T22:28:37.204144Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}}],"links":{"evidence":"/evidence","html":"/paper/2509.05698/citation-record","integrity":"/paper/2509.05698/integrity","json":"/paper/2509.05698/citation-record.json","paper":"/paper/2509.05698"},"outbound":[{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:14:57.078877Z","title":"ThreatMiner,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2509.05698","last_updated":"2025-09-06T12:25:06Z","snapshot_observed_at":"2026-08-07T07:24:50.563767Z","submitted_at":"2025-09-06T12:25:06Z","title":"KnowHow: Automatically Applying High-Level CTI Knowledge for Interpretable and Accurate Provenance Analysis","version":1},"reference_index":1,"source":"pdf_text","source_observed_at":"2026-08-05T05:14:57.078877Z"},"links":{"citing_paper":"/paper/2509.05698"},"observation_digest":"sha256:2884bb81a5b0e03197c241b2babfa220c17dc9b14984824705211479d05a222e","observation_id":"6518b8a2-a24e-4209-9197-3c9b906ee120","resolution":{"observed_at":"2026-08-05T05:14:57.078877Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:14:57.082969Z","title":"Looking Beyond IoCs: Automatically Extracting Attack Patterns from External CTI,","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2509.05698","last_updated":"2025-09-06T12:25:06Z","snapshot_observed_at":"2026-08-07T07:24:50.563767Z","submitted_at":"2025-09-06T12:25:06Z","title":"KnowHow: Automatically Applying High-Level CTI Knowledge for Interpretable and Accurate Provenance Analysis","version":1},"reference_index":2,"source":"pdf_text","source_observed_at":"2026-08-05T05:14:57.082969Z"},"links":{"citing_paper":"/paper/2509.05698"},"observation_digest":"sha256:2554d3f4d165774288da5cfe1f84a85b67c5cef73209da17c14890a6090b1628","observation_id":"2b407f7e-5c4c-450b-bf97-288b87da6509","resolution":{"observed_at":"2026-08-05T05:14:57.082969Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:14:57.086247Z","title":"Lazagne,","venue":null,"work_id":null,"year":2017},"citing_paper":{"arxiv_id":"2509.05698","last_updated":"2025-09-06T12:25:06Z","snapshot_observed_at":"2026-08-07T07:24:50.563767Z","submitted_at":"2025-09-06T12:25:06Z","title":"KnowHow: Automatically Applying High-Level CTI Knowledge for Interpretable and Accurate Provenance Analysis","version":1},"reference_index":3,"source":"pdf_text","source_observed_at":"2026-08-05T05:14:57.086247Z"},"links":{"citing_paper":"/paper/2509.05698"},"observation_digest":"sha256:266d1cd40ffc2559db34b5cbb3c1cf5502f0ad5f89543907fcaef2f0cc9b29d9","observation_id":"22417cec-d405-4e68-ac52-4224e363d9be","resolution":{"observed_at":"2026-08-05T05:14:57.086247Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:14:57.089201Z","title":"ATLAS: A Sequence-based Learning Approach for Attack Investigation,","venue":null,"work_id":null,"year":2021},"citing_paper":{"arxiv_id":"2509.05698","last_updated":"2025-09-06T12:25:06Z","snapshot_observed_at":"2026-08-07T07:24:50.563767Z","submitted_at":"2025-09-06T12:25:06Z","title":"KnowHow: Automatically Applying High-Level CTI Knowledge for Interpretable and Accurate Provenance Analysis","version":1},"reference_index":4,"source":"pdf_text","source_observed_at":"2026-08-05T05:14:57.089201Z"},"links":{"citing_paper":"/paper/2509.05698"},"observation_digest":"sha256:a9c3f26ed85ba1d7ec0fd452ebf5156898ae96dae5a494d6369a8c2309675f47","observation_id":"d809cdb4-6596-408d-bf8e-bc9adbe7bc35","resolution":{"observed_at":"2026-08-05T05:14:57.089201Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:14:57.091966Z","title":"SANDWORM INTRUSION SET CAMPAIGN TARGETING CENTREON SYSTEMS,","venue":null,"work_id":null,"year":2021},"citing_paper":{"arxiv_id":"2509.05698","last_updated":"2025-09-06T12:25:06Z","snapshot_observed_at":"2026-08-07T07:24:50.563767Z","submitted_at":"2025-09-06T12:25:06Z","title":"KnowHow: Automatically Applying High-Level CTI Knowledge for Interpretable and Accurate Provenance Analysis","version":1},"reference_index":5,"source":"pdf_text","source_observed_at":"2026-08-05T05:14:57.091966Z"},"links":{"citing_paper":"/paper/2509.05698"},"observation_digest":"sha256:2a235f5dfe3796834ab5e96702819d623d835d613e7fe6a36b9a84551c4c0e9e","observation_id":"219a8dc7-8162-46ef-a277-b36af8878c1a","resolution":{"observed_at":"2026-08-05T05:14:57.091966Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:14:57.097836Z","title":"ProvTalk: Towards Interpretable Multi-level Provenance Analysis in Networking Functions Virtualization (NFV)","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2509.05698","last_updated":"2025-09-06T12:25:06Z","snapshot_observed_at":"2026-08-07T07:24:50.563767Z","submitted_at":"2025-09-06T12:25:06Z","title":"KnowHow: Automatically Applying High-Level CTI Knowledge for Interpretable and Accurate Provenance Analysis","version":1},"reference_index":6,"source":"pdf_text","source_observed_at":"2026-08-05T05:14:57.097836Z"},"links":{"citing_paper":"/paper/2509.05698"},"observation_digest":"sha256:d699dff6c286002208b77e4ee5725380d4cf5e914d35642e1179b1a4914eb6f0","observation_id":"12a0e2c4-8289-410f-bdec-638d899cf9c4","resolution":{"observed_at":"2026-08-05T05:14:57.097836Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:14:57.100824Z","title":"Representation learning: A review and new perspectives,","venue":null,"work_id":null,"year":2013},"citing_paper":{"arxiv_id":"2509.05698","last_updated":"2025-09-06T12:25:06Z","snapshot_observed_at":"2026-08-07T07:24:50.563767Z","submitted_at":"2025-09-06T12:25:06Z","title":"KnowHow: Automatically Applying High-Level CTI Knowledge for Interpretable and Accurate Provenance Analysis","version":1},"reference_index":7,"source":"pdf_text","source_observed_at":"2026-08-05T05:14:57.100824Z"},"links":{"citing_paper":"/paper/2509.05698"},"observation_digest":"sha256:7354444e8d2f5a6e8e5cac7465f683f3c7eb07b0e61ef70b402e1453fa2e9445","observation_id":"4d7554a7-caaf-4b8f-b71f-927e5d938bba","resolution":{"observed_at":"2026-08-05T05:14:57.100824Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:14:57.103467Z","title":"Multidimensional binary search trees used for associative searching,","venue":null,"work_id":null,"year":1975},"citing_paper":{"arxiv_id":"2509.05698","last_updated":"2025-09-06T12:25:06Z","snapshot_observed_at":"2026-08-07T07:24:50.563767Z","submitted_at":"2025-09-06T12:25:06Z","title":"KnowHow: Automatically Applying High-Level CTI Knowledge for Interpretable and Accurate Provenance Analysis","version":1},"reference_index":8,"source":"pdf_text","source_observed_at":"2026-08-05T05:14:57.103467Z"},"links":{"citing_paper":"/paper/2509.05698"},"observation_digest":"sha256:def22ea0b20d98e543f8a1af3301f24b56785948b1d1e476f094b300b9029759","observation_id":"c4276804-3706-497e-b058-c5121a45f7f9","resolution":{"observed_at":"2026-08-05T05:14:57.103467Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:14:57.106294Z","title":"BLACKENERGY & QUEDAGH,","venue":null,"work_id":null,"year":2020},"citing_paper":{"arxiv_id":"2509.05698","last_updated":"2025-09-06T12:25:06Z","snapshot_observed_at":"2026-08-07T07:24:50.563767Z","submitted_at":"2025-09-06T12:25:06Z","title":"KnowHow: Automatically Applying High-Level CTI Knowledge for Interpretable and Accurate Provenance Analysis","version":1},"reference_index":9,"source":"pdf_text","source_observed_at":"2026-08-05T05:14:57.106294Z"},"links":{"citing_paper":"/paper/2509.05698"},"observation_digest":"sha256:c961efd8a3537078d8056b5815f894d3382229c3efa2d5b61ab4704f85d1c28a","observation_id":"8d532b96-983d-419c-97cb-15248edc1c0a","resolution":{"observed_at":"2026-08-05T05:14:57.106294Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:14:57.108665Z","title":"Fast nonparametric clustering with gaussian blurring mean-shift,","venue":null,"work_id":null,"year":2006},"citing_paper":{"arxiv_id":"2509.05698","last_updated":"2025-09-06T12:25:06Z","snapshot_observed_at":"2026-08-07T07:24:50.563767Z","submitted_at":"2025-09-06T12:25:06Z","title":"KnowHow: Automatically Applying High-Level CTI Knowledge for Interpretable and Accurate Provenance Analysis","version":1},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-08-05T05:14:57.108665Z"},"links":{"citing_paper":"/paper/2509.05698"},"observation_digest":"sha256:5f893d201a67ac5ab926966b59e61333847a6a0888ef7340ce15c83599384759","observation_id":"863b2f01-932a-444e-9626-ca88d3a6d604","resolution":{"observed_at":"2026-08-05T05:14:57.108665Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:14:57.111309Z","title":"Teamtnt with new campaign aka","venue":null,"work_id":null,"year":2021},"citing_paper":{"arxiv_id":"2509.05698","last_updated":"2025-09-06T12:25:06Z","snapshot_observed_at":"2026-08-07T07:24:50.563767Z","submitted_at":"2025-09-06T12:25:06Z","title":"KnowHow: Automatically Applying High-Level CTI Knowledge for Interpretable and Accurate Provenance Analysis","version":1},"reference_index":11,"source":"pdf_text","source_observed_at":"2026-08-05T05:14:57.111309Z"},"links":{"citing_paper":"/paper/2509.05698"},"observation_digest":"sha256:ccfcc54b432ef6dfaf95d765a74105bdcdb3c7efa1ee908ba273215ae8c7e78a","observation_id":"6ed31922-c09d-4d42-b276-0701048847a7","resolution":{"observed_at":"2026-08-05T05:14:57.111309Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:14:57.113674Z","title":"ROCKET KIT TEN: A CAMPAIGN WITH 9 LIVES,","venue":null,"work_id":null,"year":2015},"citing_paper":{"arxiv_id":"2509.05698","last_updated":"2025-09-06T12:25:06Z","snapshot_observed_at":"2026-08-07T07:24:50.563767Z","submitted_at":"2025-09-06T12:25:06Z","title":"KnowHow: Automatically Applying High-Level CTI Knowledge for Interpretable and Accurate Provenance Analysis","version":1},"reference_index":12,"source":"pdf_text","source_observed_at":"2026-08-05T05:14:57.113674Z"},"links":{"citing_paper":"/paper/2509.05698"},"observation_digest":"sha256:b807f60d62df765824a6adb1ec16f77c343619e202c96eb1e425a3b1149e4034","observation_id":"82ba5437-25ed-41e8-b78b-93826ea6816e","resolution":{"observed_at":"2026-08-05T05:14:57.113674Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:14:57.116112Z","title":"Kairos: Practical Intrusion Detection and Investigation using Whole- system Provenance,","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2509.05698","last_updated":"2025-09-06T12:25:06Z","snapshot_observed_at":"2026-08-07T07:24:50.563767Z","submitted_at":"2025-09-06T12:25:06Z","title":"KnowHow: Automatically Applying High-Level CTI Knowledge for Interpretable and Accurate Provenance Analysis","version":1},"reference_index":13,"source":"pdf_text","source_observed_at":"2026-08-05T05:14:57.116112Z"},"links":{"citing_paper":"/paper/2509.05698"},"observation_digest":"sha256:7560ef0effc128c1728e8de670cf63ca1a6d8bd67816cb565f5c858fb967a09f","observation_id":"7c33590f-8a0d-41a9-8c6e-dc25fc398c90","resolution":{"observed_at":"2026-08-05T05:14:57.116112Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:14:57.118596Z","title":"GRUBBS: Stata module to perform Grubbs’ test for outliers,","venue":null,"work_id":null,"year":2007},"citing_paper":{"arxiv_id":"2509.05698","last_updated":"2025-09-06T12:25:06Z","snapshot_observed_at":"2026-08-07T07:24:50.563767Z","submitted_at":"2025-09-06T12:25:06Z","title":"KnowHow: Automatically Applying High-Level CTI Knowledge for Interpretable and Accurate Provenance Analysis","version":1},"reference_index":14,"source":"pdf_text","source_observed_at":"2026-08-05T05:14:57.118596Z"},"links":{"citing_paper":"/paper/2509.05698"},"observation_digest":"sha256:7edc3dca03c8c695aa9f775de5d7f51d3b719c154be008c67e8e20ad8f2f6e23","observation_id":"f7422e64-23df-48d1-ad2e-964b3cd3ee98","resolution":{"observed_at":"2026-08-05T05:14:57.118596Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:14:57.120950Z","title":"ADV ANCED PERSISTENT THREAT (APT),","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2509.05698","last_updated":"2025-09-06T12:25:06Z","snapshot_observed_at":"2026-08-07T07:24:50.563767Z","submitted_at":"2025-09-06T12:25:06Z","title":"KnowHow: Automatically Applying High-Level CTI Knowledge for Interpretable and Accurate Provenance Analysis","version":1},"reference_index":15,"source":"pdf_text","source_observed_at":"2026-08-05T05:14:57.120950Z"},"links":{"citing_paper":"/paper/2509.05698"},"observation_digest":"sha256:04d5a348233eb891e53dcef38470f37ed83235d85f519653769d726ddf9b674f","observation_id":"0a3535b7-ef89-4ae4-ba6f-e47e11f54ab7","resolution":{"observed_at":"2026-08-05T05:14:57.120950Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:14:57.123891Z","title":"A BAZAR OF TRICKS: FOLLOWING TEAM9’S DEVELOPMENT CYCLES,","venue":null,"work_id":null,"year":2020},"citing_paper":{"arxiv_id":"2509.05698","last_updated":"2025-09-06T12:25:06Z","snapshot_observed_at":"2026-08-07T07:24:50.563767Z","submitted_at":"2025-09-06T12:25:06Z","title":"KnowHow: Automatically Applying High-Level CTI Knowledge for Interpretable and Accurate Provenance Analysis","version":1},"reference_index":16,"source":"pdf_text","source_observed_at":"2026-08-05T05:14:57.123891Z"},"links":{"citing_paper":"/paper/2509.05698"},"observation_digest":"sha256:798461785f3b15431e3b26f3bf8551c25229718bea1c2eeebdf45d4e2748a1b8","observation_id":"4ad29e01-c05c-4a5f-afb8-34b6efc7bb97","resolution":{"observed_at":"2026-08-05T05:14:57.123891Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:14:57.126499Z","title":"DARPA Transparent Computing Engagement #3,","venue":null,"work_id":null,"year":2018},"citing_paper":{"arxiv_id":"2509.05698","last_updated":"2025-09-06T12:25:06Z","snapshot_observed_at":"2026-08-07T07:24:50.563767Z","submitted_at":"2025-09-06T12:25:06Z","title":"KnowHow: Automatically Applying High-Level CTI Knowledge for Interpretable and Accurate Provenance Analysis","version":1},"reference_index":17,"source":"pdf_text","source_observed_at":"2026-08-05T05:14:57.126499Z"},"links":{"citing_paper":"/paper/2509.05698"},"observation_digest":"sha256:903534244ca73af21d92b050d4ca3712942ece9d0eb2b3e1218454e6c77fbab3","observation_id":"d3da7bf7-d9c4-4f5d-a7b3-e10d76973a5f","resolution":{"observed_at":"2026-08-05T05:14:57.126499Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:14:57.128796Z","title":"Transparent computing engagement 3 data release,","venue":null,"work_id":null,"year":2018},"citing_paper":{"arxiv_id":"2509.05698","last_updated":"2025-09-06T12:25:06Z","snapshot_observed_at":"2026-08-07T07:24:50.563767Z","submitted_at":"2025-09-06T12:25:06Z","title":"KnowHow: Automatically Applying High-Level CTI Knowledge for Interpretable and Accurate Provenance Analysis","version":1},"reference_index":18,"source":"pdf_text","source_observed_at":"2026-08-05T05:14:57.128796Z"},"links":{"citing_paper":"/paper/2509.05698"},"observation_digest":"sha256:afae7cfa3660af5e41829b8c3d7fd66c6cc4c1ad7081c2fb145ce412df319f0a","observation_id":"f99efd23-042b-4905-aacf-23613412862b","resolution":{"observed_at":"2026-08-05T05:14:57.128796Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:14:58.550392Z","title":"Lifecycle of the Advanced Persistent Threat,","venue":null,"work_id":"45c2a225-2608-4154-b025-9964fe562175","year":2024},"citing_paper":{"arxiv_id":"2509.05698","last_updated":"2025-09-06T12:25:06Z","snapshot_observed_at":"2026-08-07T07:24:50.563767Z","submitted_at":"2025-09-06T12:25:06Z","title":"KnowHow: Automatically Applying High-Level CTI Knowledge for Interpretable and Accurate Provenance Analysis","version":1},"reference_index":19,"source":"pdf_text","source_observed_at":"2026-08-05T05:14:57.131368Z"},"links":{"citing_paper":"/paper/2509.05698"},"observation_digest":"sha256:0c0954a8858d253b5f8aeba428e90ede7c7b898d194f023963c36083b2f6781f","observation_id":"6328c636-c23c-45ac-9ef8-f0fd891aa350","resolution":{"observed_at":"2026-08-05T05:14:58.552842Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:14:58.542621Z","title":"AIRTAG: Towards Automated Attack Investigation by Unsupervised Learning with Log Texts,","venue":null,"work_id":"0809a03e-c301-4f1a-af1f-d61b57383f47","year":2023},"citing_paper":{"arxiv_id":"2509.05698","last_updated":"2025-09-06T12:25:06Z","snapshot_observed_at":"2026-08-07T07:24:50.563767Z","submitted_at":"2025-09-06T12:25:06Z","title":"KnowHow: Automatically Applying High-Level CTI Knowledge for Interpretable and Accurate Provenance Analysis","version":1},"reference_index":20,"source":"pdf_text","source_observed_at":"2026-08-05T05:14:57.133837Z"},"links":{"citing_paper":"/paper/2509.05698"},"observation_digest":"sha256:dfdbc65e42aa5ff7ddef90439282f8e7b95b05a46ebd24ab288d844c63ab48b4","observation_id":"7ad96bcb-b617-4471-9309-6926425da5ca","resolution":{"observed_at":"2026-08-05T05:14:58.545730Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:14:57.136331Z","title":"Are we there yet? An Industrial Viewpoint on Provenance-based Endpoint Detection and Response Tools,","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2509.05698","last_updated":"2025-09-06T12:25:06Z","snapshot_observed_at":"2026-08-07T07:24:50.563767Z","submitted_at":"2025-09-06T12:25:06Z","title":"KnowHow: Automatically Applying High-Level CTI Knowledge for Interpretable and Accurate Provenance Analysis","version":1},"reference_index":21,"source":"pdf_text","source_observed_at":"2026-08-05T05:14:57.136331Z"},"links":{"citing_paper":"/paper/2509.05698"},"observation_digest":"sha256:0923f4ff2a79b3aa623340f5564e82d85be5c16f1bfe9dae0e35abb2cb6f86ee","observation_id":"dff4a584-0489-41a7-b8c6-d400f217d9ae","resolution":{"observed_at":"2026-08-05T05:14:57.136331Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:14:58.535312Z","title":"Elasticsearch,","venue":null,"work_id":"20503a2f-d2c1-4ebe-a52e-581e7ef79b9a","year":null},"citing_paper":{"arxiv_id":"2509.05698","last_updated":"2025-09-06T12:25:06Z","snapshot_observed_at":"2026-08-07T07:24:50.563767Z","submitted_at":"2025-09-06T12:25:06Z","title":"KnowHow: Automatically Applying High-Level CTI Knowledge for Interpretable and Accurate Provenance Analysis","version":1},"reference_index":22,"source":"pdf_text","source_observed_at":"2026-08-05T05:14:57.138887Z"},"links":{"citing_paper":"/paper/2509.05698"},"observation_digest":"sha256:b1fa846680ef7de0ace3b14705c7c8c3a743ed67ff42a8f1b3f291da8ec5f53a","observation_id":"0fc1f78a-22fb-42c8-ae65-0287a5ffd236","resolution":{"observed_at":"2026-08-05T05:14:58.537902Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:14:58.528313Z","title":"New osx/keydnap malware is hungry for credentials,","venue":null,"work_id":"612061f1-3fae-4653-aff2-bec75f383977","year":2016},"citing_paper":{"arxiv_id":"2509.05698","last_updated":"2025-09-06T12:25:06Z","snapshot_observed_at":"2026-08-07T07:24:50.563767Z","submitted_at":"2025-09-06T12:25:06Z","title":"KnowHow: Automatically Applying High-Level CTI Knowledge for Interpretable and Accurate Provenance Analysis","version":1},"reference_index":23,"source":"pdf_text","source_observed_at":"2026-08-05T05:14:57.141365Z"},"links":{"citing_paper":"/paper/2509.05698"},"observation_digest":"sha256:d690507dd82943d40c9fa408c737234451eb54f38d836b73713e0bcf0377b62e","observation_id":"b03f1d68-7da5-497e-b43b-cece3f758925","resolution":{"observed_at":"2026-08-05T05:14:58.530811Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:14:58.521359Z","title":"FastText. ,","venue":null,"work_id":"9139bd81-3323-470b-a539-f458acca5a82","year":2017},"citing_paper":{"arxiv_id":"2509.05698","last_updated":"2025-09-06T12:25:06Z","snapshot_observed_at":"2026-08-07T07:24:50.563767Z","submitted_at":"2025-09-06T12:25:06Z","title":"KnowHow: Automatically Applying High-Level CTI Knowledge for Interpretable and Accurate Provenance Analysis","version":1},"reference_index":24,"source":"pdf_text","source_observed_at":"2026-08-05T05:14:57.143737Z"},"links":{"citing_paper":"/paper/2509.05698"},"observation_digest":"sha256:55030cd0518f0fad213cdff4c1dd02861101509b164d782f07a81a2d61feda36","observation_id":"ee9e28a6-3ba1-4052-8941-693c6d487714","resolution":{"observed_at":"2026-08-05T05:14:58.523654Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:14:58.514647Z","title":"Back-Propagating system dependency impact for attack investigation,","venue":null,"work_id":"25e56419-0437-44b7-9f13-736061395f74","year":2022},"citing_paper":{"arxiv_id":"2509.05698","last_updated":"2025-09-06T12:25:06Z","snapshot_observed_at":"2026-08-07T07:24:50.563767Z","submitted_at":"2025-09-06T12:25:06Z","title":"KnowHow: Automatically Applying High-Level CTI Knowledge for Interpretable and Accurate Provenance Analysis","version":1},"reference_index":25,"source":"pdf_text","source_observed_at":"2026-08-05T05:14:57.146360Z"},"links":{"citing_paper":"/paper/2509.05698"},"observation_digest":"sha256:82a4db89ccc1f4db9b2b0684875a588e21961e10f5e872457c7d11f6607da14c","observation_id":"2b10b21c-17d0-428b-b7f2-edf7577ca5ab","resolution":{"observed_at":"2026-08-05T05:14:58.517049Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:14:58.507573Z","title":"APT37(reaper): The overlooked north korean actor,","venue":null,"work_id":"5dc6cea2-ca5d-4849-a951-dbb8215bd944","year":2021},"citing_paper":{"arxiv_id":"2509.05698","last_updated":"2025-09-06T12:25:06Z","snapshot_observed_at":"2026-08-07T07:24:50.563767Z","submitted_at":"2025-09-06T12:25:06Z","title":"KnowHow: Automatically Applying High-Level CTI Knowledge for Interpretable and Accurate Provenance Analysis","version":1},"reference_index":26,"source":"pdf_text","source_observed_at":"2026-08-05T05:14:57.149453Z"},"links":{"citing_paper":"/paper/2509.05698"},"observation_digest":"sha256:64bf3f54a40b995b0e43ed85c191b1a59d015ba7f24850da93dd0df61ebff2a1","observation_id":"d03bae21-72d1-4490-acc1-8c8d74b9d5ad","resolution":{"observed_at":"2026-08-05T05:14:58.510105Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:14:58.499946Z","title":"Apt42: Crooked charms, cons, and compromises,","venue":null,"work_id":"03fe9cfa-6c66-42c4-8e21-dfbce75a026c","year":2022},"citing_paper":{"arxiv_id":"2509.05698","last_updated":"2025-09-06T12:25:06Z","snapshot_observed_at":"2026-08-07T07:24:50.563767Z","submitted_at":"2025-09-06T12:25:06Z","title":"KnowHow: Automatically Applying High-Level CTI Knowledge for Interpretable and Accurate Provenance Analysis","version":1},"reference_index":27,"source":"pdf_text","source_observed_at":"2026-08-05T05:14:57.152074Z"},"links":{"citing_paper":"/paper/2509.05698"},"observation_digest":"sha256:b844460cd3d42b9ad4dce91471de19fc8c80283af78b043d6dfcb21ca2003253","observation_id":"9bd2476d-b53a-4ed4-9963-3d4bff33ec46","resolution":{"observed_at":"2026-08-05T05:14:58.502439Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:14:57.154782Z","title":"An algorithm for finding best matches in logarithmic expected time,","venue":null,"work_id":null,"year":1977},"citing_paper":{"arxiv_id":"2509.05698","last_updated":"2025-09-06T12:25:06Z","snapshot_observed_at":"2026-08-07T07:24:50.563767Z","submitted_at":"2025-09-06T12:25:06Z","title":"KnowHow: Automatically Applying High-Level CTI Knowledge for Interpretable and Accurate Provenance Analysis","version":1},"reference_index":28,"source":"pdf_text","source_observed_at":"2026-08-05T05:14:57.154782Z"},"links":{"citing_paper":"/paper/2509.05698"},"observation_digest":"sha256:76d9d772c1f8fcf106632af431d7f084abdf97a87324127f13c5f2c1fbc1d899","observation_id":"800d6b84-87bb-4c4d-ae01-3f179b38c55f","resolution":{"observed_at":"2026-08-05T05:14:57.154782Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:14:58.492763Z","title":"Enabling Efficient Cyber Threat Hunting With Cyber Threat Intelligence,","venue":null,"work_id":"fd6a524d-5157-467f-aa6a-88d6df0a2e3d","year":2021},"citing_paper":{"arxiv_id":"2509.05698","last_updated":"2025-09-06T12:25:06Z","snapshot_observed_at":"2026-08-07T07:24:50.563767Z","submitted_at":"2025-09-06T12:25:06Z","title":"KnowHow: Automatically Applying High-Level CTI Knowledge for Interpretable and Accurate Provenance Analysis","version":1},"reference_index":29,"source":"pdf_text","source_observed_at":"2026-08-05T05:14:57.157205Z"},"links":{"citing_paper":"/paper/2509.05698"},"observation_digest":"sha256:c10653058506899ceb84fec83e3af45b647ccc23494df4010d82863146f38db0","observation_id":"c7c09b31-b5b2-44b1-b4ba-d50e9e10231d","resolution":{"observed_at":"2026-08-05T05:14:58.495221Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:14:58.485497Z","title":"Sometimes, you aren’t what you do: Mimicry attacks against provenance graph host intrusion detection systems,","venue":null,"work_id":"3aca70f5-beff-49b8-8428-5d14f2cf6e6b","year":2023},"citing_paper":{"arxiv_id":"2509.05698","last_updated":"2025-09-06T12:25:06Z","snapshot_observed_at":"2026-08-07T07:24:50.563767Z","submitted_at":"2025-09-06T12:25:06Z","title":"KnowHow: Automatically Applying High-Level CTI Knowledge for Interpretable and Accurate Provenance Analysis","version":1},"reference_index":30,"source":"pdf_text","source_observed_at":"2026-08-05T05:14:57.160003Z"},"links":{"citing_paper":"/paper/2509.05698"},"observation_digest":"sha256:caf2a28e6a7b1ba1bd20b8135bb9922d9bd8e4d1ada492a60dbbe6d8a928c055","observation_id":"7fd8e629-964a-4a73-a977-175044abe7a1","resolution":{"observed_at":"2026-08-05T05:14:58.488142Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:14:58.478609Z","title":"R-CAID: Embedding Root Cause Analysis within Provenance-based Intrusion Detection,","venue":null,"work_id":"fc4e0a82-7083-44b9-9394-b1fd8055cc8e","year":2024},"citing_paper":{"arxiv_id":"2509.05698","last_updated":"2025-09-06T12:25:06Z","snapshot_observed_at":"2026-08-07T07:24:50.563767Z","submitted_at":"2025-09-06T12:25:06Z","title":"KnowHow: Automatically Applying High-Level CTI Knowledge for Interpretable and Accurate Provenance Analysis","version":1},"reference_index":31,"source":"pdf_text","source_observed_at":"2026-08-05T05:14:57.162512Z"},"links":{"citing_paper":"/paper/2509.05698"},"observation_digest":"sha256:a5e7a6aa989563fd49d5ed179c329a5c4154811f4de65d1edc8500391c02701e","observation_id":"9274cc75-3dcd-489f-aa68-31ee694e4bb8","resolution":{"observed_at":"2026-08-05T05:14:58.481227Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:14:58.471036Z","title":"Project TajMahal – a sophisticated new APT framework,","venue":null,"work_id":"03d2b5bc-d069-45a0-a9e0-33a569bf1237","year":2019},"citing_paper":{"arxiv_id":"2509.05698","last_updated":"2025-09-06T12:25:06Z","snapshot_observed_at":"2026-08-07T07:24:50.563767Z","submitted_at":"2025-09-06T12:25:06Z","title":"KnowHow: Automatically Applying High-Level CTI Knowledge for Interpretable and Accurate Provenance Analysis","version":1},"reference_index":32,"source":"pdf_text","source_observed_at":"2026-08-05T05:14:57.164761Z"},"links":{"citing_paper":"/paper/2509.05698"},"observation_digest":"sha256:0253d81b715c8fd57052a025ce378412018298a9f630992b370299fec7da4f55","observation_id":"e8778a57-20b6-452c-a7df-0b1b873f945e","resolution":{"observed_at":"2026-08-05T05:14:58.473548Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:14:58.463026Z","title":"What are advanced persistent threats?","venue":null,"work_id":"dc4697b6-7048-456b-a1ad-0d09c401eaab","year":2024},"citing_paper":{"arxiv_id":"2509.05698","last_updated":"2025-09-06T12:25:06Z","snapshot_observed_at":"2026-08-07T07:24:50.563767Z","submitted_at":"2025-09-06T12:25:06Z","title":"KnowHow: Automatically Applying High-Level CTI Knowledge for Interpretable and Accurate Provenance Analysis","version":1},"reference_index":33,"source":"pdf_text","source_observed_at":"2026-08-05T05:14:57.167080Z"},"links":{"citing_paper":"/paper/2509.05698"},"observation_digest":"sha256:727be0c205bf17de2f00838c18f59c255d313813899a86cfd44e5f1991398ee9","observation_id":"b0418d28-3d96-4a4d-a6b4-f9676f5bcfa2","resolution":{"observed_at":"2026-08-05T05:14:58.466394Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:14:58.456064Z","title":"Tactical Provenance Analysis for Endpoint Detection and Response Systems,","venue":null,"work_id":"63b6a17f-6a3d-4e26-8c51-3714ce3cf8ed","year":2020},"citing_paper":{"arxiv_id":"2509.05698","last_updated":"2025-09-06T12:25:06Z","snapshot_observed_at":"2026-08-07T07:24:50.563767Z","submitted_at":"2025-09-06T12:25:06Z","title":"KnowHow: Automatically Applying High-Level CTI Knowledge for Interpretable and Accurate Provenance Analysis","version":1},"reference_index":34,"source":"pdf_text","source_observed_at":"2026-08-05T05:14:57.169437Z"},"links":{"citing_paper":"/paper/2509.05698"},"observation_digest":"sha256:e96efe061977b7a6384ee7358f88a38f5bccd4268f3e58c90d672af5785ae9ac","observation_id":"a557c800-c15a-40bb-a0b7-044ca1a537de","resolution":{"observed_at":"2026-08-05T05:14:58.458461Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:14:58.448777Z","title":"Nodoze: Combatting threat alert fatigue with automated provenance triage,","venue":null,"work_id":"1f74d83f-4957-4667-8d62-322538865dfc","year":2019},"citing_paper":{"arxiv_id":"2509.05698","last_updated":"2025-09-06T12:25:06Z","snapshot_observed_at":"2026-08-07T07:24:50.563767Z","submitted_at":"2025-09-06T12:25:06Z","title":"KnowHow: Automatically Applying High-Level CTI Knowledge for Interpretable and Accurate Provenance Analysis","version":1},"reference_index":35,"source":"pdf_text","source_observed_at":"2026-08-05T05:14:57.172490Z"},"links":{"citing_paper":"/paper/2509.05698"},"observation_digest":"sha256:144e2e4022ae15247340505312a422a514449bd25b704b2d4c5a947342143fa4","observation_id":"edcce750-49a0-402b-a7b5-482750b9b247","resolution":{"observed_at":"2026-08-05T05:14:58.451454Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"7228.34272","doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:14:57.731627Z","title":"This is why we can’t cache nice things: Lightning-fast threat hunting using suspicion-based hierarchical storage,","venue":null,"work_id":"4db20796-b760-41ae-a880-3faefe248314","year":2020},"citing_paper":{"arxiv_id":"2509.05698","last_updated":"2025-09-06T12:25:06Z","snapshot_observed_at":"2026-08-07T07:24:50.563767Z","submitted_at":"2025-09-06T12:25:06Z","title":"KnowHow: Automatically Applying High-Level CTI Knowledge for Interpretable and Accurate Provenance Analysis","version":1},"reference_index":36,"source":"pdf_text","source_observed_at":"2026-08-05T05:14:57.174782Z"},"links":{"citing_paper":"/paper/2509.05698"},"observation_digest":"sha256:395e4ebd28a41bf0ae10c335d0a8231dc2dddf91036b67a1ccdbbf099f98904d","observation_id":"7d02504b-8712-41d5-b8c2-b2529633cd05","resolution":{"observed_at":"2026-08-05T05:14:57.736463Z","resolver_source":"raw_fallback","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"4600.31346","doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:14:57.643868Z","title":"TTPDrill: Automatic and Accurate Extraction of Threat Actions from Unstructured Text of CTI Sources,","venue":null,"work_id":"f895e1b5-2491-4031-95a2-44cfff1baa76","year":2017},"citing_paper":{"arxiv_id":"2509.05698","last_updated":"2025-09-06T12:25:06Z","snapshot_observed_at":"2026-08-07T07:24:50.563767Z","submitted_at":"2025-09-06T12:25:06Z","title":"KnowHow: Automatically Applying High-Level CTI Knowledge for Interpretable and Accurate Provenance Analysis","version":1},"reference_index":37,"source":"pdf_text","source_observed_at":"2026-08-05T05:14:57.177177Z"},"links":{"citing_paper":"/paper/2509.05698"},"observation_digest":"sha256:d1b4b74ab98d143fae40bc4d6505a78e31170149e5cc96a5d22a9db1932e3686","observation_id":"8ba04fc5-47fd-48a2-a775-d75f75e91e29","resolution":{"observed_at":"2026-08-05T05:14:57.651036Z","resolver_source":"raw_fallback","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:14:58.440675Z","title":"MAGIC: Detecting advanced persistent threats via masked graph representation learning,","venue":null,"work_id":"27ec660a-7d43-41c0-9a7b-0003a3d6e379","year":2024},"citing_paper":{"arxiv_id":"2509.05698","last_updated":"2025-09-06T12:25:06Z","snapshot_observed_at":"2026-08-07T07:24:50.563767Z","submitted_at":"2025-09-06T12:25:06Z","title":"KnowHow: Automatically Applying High-Level CTI Knowledge for Interpretable and Accurate Provenance Analysis","version":1},"reference_index":38,"source":"pdf_text","source_observed_at":"2026-08-05T05:14:57.179433Z"},"links":{"citing_paper":"/paper/2509.05698"},"observation_digest":"sha256:b283f05ed9d8f3973e6b78a026a7fc837c5d977a4dd200ba6dc5a6eaff7bb9a7","observation_id":"35fd1632-09ac-4d66-8f8b-62c30806955f","resolution":{"observed_at":"2026-08-05T05:14:58.443601Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:14:58.433631Z","title":"Sharing cyber threat intelligence: Does it really help?","venue":null,"work_id":"ae2eee88-86fc-4a86-95de-5a205e562744","year":2024},"citing_paper":{"arxiv_id":"2509.05698","last_updated":"2025-09-06T12:25:06Z","snapshot_observed_at":"2026-08-07T07:24:50.563767Z","submitted_at":"2025-09-06T12:25:06Z","title":"KnowHow: Automatically Applying High-Level CTI Knowledge for Interpretable and Accurate Provenance Analysis","version":1},"reference_index":39,"source":"pdf_text","source_observed_at":"2026-08-05T05:14:57.182078Z"},"links":{"citing_paper":"/paper/2509.05698"},"observation_digest":"sha256:e65dbacb677ff4f664d94ba85e0208cf5fd92774fb73ae4ee9c7de942db94481","observation_id":"b6ae417c-680d-4104-acdb-cc7733fa121f","resolution":{"observed_at":"2026-08-05T05:14:58.436107Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:14:58.425694Z","title":"Cyberwar in Ukraine leads to all-time-high levels of DDoS attacks,","venue":null,"work_id":"14b2236c-674a-472e-8e36-22d732861091","year":2022},"citing_paper":{"arxiv_id":"2509.05698","last_updated":"2025-09-06T12:25:06Z","snapshot_observed_at":"2026-08-07T07:24:50.563767Z","submitted_at":"2025-09-06T12:25:06Z","title":"KnowHow: Automatically Applying High-Level CTI Knowledge for Interpretable and Accurate Provenance Analysis","version":1},"reference_index":40,"source":"pdf_text","source_observed_at":"2026-08-05T05:14:57.184468Z"},"links":{"citing_paper":"/paper/2509.05698"},"observation_digest":"sha256:228d903c9f6215f623339aa8945b6772311c0941a6cc54aa843a1be4c35e3d56","observation_id":"280d9439-a3d1-46ce-9d27-edb237b74570","resolution":{"observed_at":"2026-08-05T05:14:58.428639Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:14:58.418586Z","title":"Virus.MSWord.Aos,","venue":null,"work_id":"5bf5b06a-d4c7-42aa-b820-2c6e8404dc15","year":2024},"citing_paper":{"arxiv_id":"2509.05698","last_updated":"2025-09-06T12:25:06Z","snapshot_observed_at":"2026-08-07T07:24:50.563767Z","submitted_at":"2025-09-06T12:25:06Z","title":"KnowHow: Automatically Applying High-Level CTI Knowledge for Interpretable and Accurate Provenance Analysis","version":1},"reference_index":41,"source":"pdf_text","source_observed_at":"2026-08-05T05:14:57.186809Z"},"links":{"citing_paper":"/paper/2509.05698"},"observation_digest":"sha256:a4a4da9eaaeebdeeb09dc04cb2e1c19ff4b481c30695ae8d5efd6e8809cb9951","observation_id":"fb284494-6a44-40fa-be77-032cb5dc4c4a","resolution":{"observed_at":"2026-08-05T05:14:58.421071Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:14:58.410723Z","title":"An integrated cyber security risk management framework and risk predication for the critical infras- tructure protection,","venue":null,"work_id":"abc0959f-3bfa-43da-94fa-af9696896bd6","year":2022},"citing_paper":{"arxiv_id":"2509.05698","last_updated":"2025-09-06T12:25:06Z","snapshot_observed_at":"2026-08-07T07:24:50.563767Z","submitted_at":"2025-09-06T12:25:06Z","title":"KnowHow: Automatically Applying High-Level CTI Knowledge for Interpretable and Accurate Provenance Analysis","version":1},"reference_index":42,"source":"pdf_text","source_observed_at":"2026-08-05T05:14:57.189031Z"},"links":{"citing_paper":"/paper/2509.05698"},"observation_digest":"sha256:01a316d65c478127736bd15a9324195c523c23a92f7590686bcef71b6dd022ae","observation_id":"430de44f-c3b8-4ba5-bf0d-b8aa889c11d8","resolution":{"observed_at":"2026-08-05T05:14:58.413530Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:14:58.403025Z","title":"NODLINK: An Online System for Fine-Grained APT Attack Detection and Investigation","venue":null,"work_id":"25cc2ff6-28aa-40d7-976e-2b81ebfdc3b2","year":2024},"citing_paper":{"arxiv_id":"2509.05698","last_updated":"2025-09-06T12:25:06Z","snapshot_observed_at":"2026-08-07T07:24:50.563767Z","submitted_at":"2025-09-06T12:25:06Z","title":"KnowHow: Automatically Applying High-Level CTI Knowledge for Interpretable and Accurate Provenance Analysis","version":1},"reference_index":43,"source":"pdf_text","source_observed_at":"2026-08-05T05:14:57.191746Z"},"links":{"citing_paper":"/paper/2509.05698"},"observation_digest":"sha256:680a4dc6f67be13d2c16795259b4cf24ef09354746f87190749ec194c281ac53","observation_id":"e661bf64-31b5-47d0-b1f2-138e9900815c","resolution":{"observed_at":"2026-08-05T05:14:58.405679Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:14:57.194092Z","title":"AttacKG: Constructing Technique Knowledge Graph from Cyber Threat Intelligence Reports,","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2509.05698","last_updated":"2025-09-06T12:25:06Z","snapshot_observed_at":"2026-08-07T07:24:50.563767Z","submitted_at":"2025-09-06T12:25:06Z","title":"KnowHow: Automatically Applying High-Level CTI Knowledge for Interpretable and Accurate Provenance Analysis","version":1},"reference_index":44,"source":"pdf_text","source_observed_at":"2026-08-05T05:14:57.194092Z"},"links":{"citing_paper":"/paper/2509.05698"},"observation_digest":"sha256:31944a6a57c34c224c1ed10ebc0670a2f18e1726d5ca5516a90f0953902975d3","observation_id":"4beaf113-8261-4562-abcf-1f1c39a53232","resolution":{"observed_at":"2026-08-05T05:14:57.194092Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:14:57.196505Z","title":"TREC: APT Tactic / Technique Recognition via Few-Shot Provenance Subgraph Learning,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2509.05698","last_updated":"2025-09-06T12:25:06Z","snapshot_observed_at":"2026-08-07T07:24:50.563767Z","submitted_at":"2025-09-06T12:25:06Z","title":"KnowHow: Automatically Applying High-Level CTI Knowledge for Interpretable and Accurate Provenance Analysis","version":1},"reference_index":45,"source":"pdf_text","source_observed_at":"2026-08-05T05:14:57.196505Z"},"links":{"citing_paper":"/paper/2509.05698"},"observation_digest":"sha256:137b05e225eae6e5081a5dec3a4218ac1d87d07469b45b4c027d082e509ffb1b","observation_id":"0d0d65e3-672c-49ae-8841-a4eda7857484","resolution":{"observed_at":"2026-08-05T05:14:57.196505Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:14:58.395923Z","title":"MANDIANT Threat Intelligence,","venue":null,"work_id":"6e62f8da-acac-43bd-b9a1-60c0ba5af66f","year":null},"citing_paper":{"arxiv_id":"2509.05698","last_updated":"2025-09-06T12:25:06Z","snapshot_observed_at":"2026-08-07T07:24:50.563767Z","submitted_at":"2025-09-06T12:25:06Z","title":"KnowHow: Automatically Applying High-Level CTI Knowledge for Interpretable and Accurate Provenance Analysis","version":1},"reference_index":46,"source":"pdf_text","source_observed_at":"2026-08-05T05:14:57.198902Z"},"links":{"citing_paper":"/paper/2509.05698"},"observation_digest":"sha256:33fc24e3ce2203b0940f629e136b601a50796f000dbbda13effd0a0f59aa6cd0","observation_id":"a9a51c0b-04a2-496c-a879-9c85fc7e3bd2","resolution":{"observed_at":"2026-08-05T05:14:58.398452Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:14:58.380309Z","title":"This Is Not a Test: APT41 Initiates Global Intrusion Campaign Using Multiple Exploits,","venue":null,"work_id":"20966a49-531b-478f-ac22-225beec3b73b","year":2020},"citing_paper":{"arxiv_id":"2509.05698","last_updated":"2025-09-06T12:25:06Z","snapshot_observed_at":"2026-08-07T07:24:50.563767Z","submitted_at":"2025-09-06T12:25:06Z","title":"KnowHow: Automatically Applying High-Level CTI Knowledge for Interpretable and Accurate Provenance Analysis","version":1},"reference_index":47,"source":"pdf_text","source_observed_at":"2026-08-05T05:14:57.203944Z"},"links":{"citing_paper":"/paper/2509.05698"},"observation_digest":"sha256:a4cf3671b6dbefb594a7d37bf734a5c647dafc26f7bdcee8c8210ac0429ab66b","observation_id":"7cb0b490-97fc-455f-91e3-daf0900e11b5","resolution":{"observed_at":"2026-08-05T05:14:58.383399Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:14:58.388365Z","title":"Available: https://www.mandiant.com/advantage/threa t-intelligence/","venue":null,"work_id":"1334b57c-2ef6-4c49-88aa-151df0d55572","year":null},"citing_paper":{"arxiv_id":"2509.05698","last_updated":"2025-09-06T12:25:06Z","snapshot_observed_at":"2026-08-07T07:24:50.563767Z","submitted_at":"2025-09-06T12:25:06Z","title":"KnowHow: Automatically Applying High-Level CTI Knowledge for Interpretable and Accurate Provenance Analysis","version":1},"reference_index":48,"source":"pdf_text","source_observed_at":"2026-08-05T05:14:57.201468Z"},"links":{"citing_paper":"/paper/2509.05698"},"observation_digest":"sha256:ce493e93a50712084b39eed27f249e1fffbd1de9e0c938d64e49f725f1c2c241","observation_id":"27505d5e-4276-4612-8893-04ae76fef14e","resolution":{"observed_at":"2026-08-05T05:14:58.391317Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:14:58.363836Z","title":"Unc3524: Eye spy on your email,","venue":null,"work_id":"3b23e9f1-ca59-482d-9582-6bc2bd54363c","year":2022},"citing_paper":{"arxiv_id":"2509.05698","last_updated":"2025-09-06T12:25:06Z","snapshot_observed_at":"2026-08-07T07:24:50.563767Z","submitted_at":"2025-09-06T12:25:06Z","title":"KnowHow: Automatically Applying High-Level CTI Knowledge for Interpretable and Accurate Provenance Analysis","version":1},"reference_index":49,"source":"pdf_text","source_observed_at":"2026-08-05T05:14:57.208419Z"},"links":{"citing_paper":"/paper/2509.05698"},"observation_digest":"sha256:3ffed501903dc1969dc2bbf6e21fd52cd5e7929e108225490ad5a15b7eb16432","observation_id":"bedf2657-9724-4337-8e34-4005e5ad4333","resolution":{"observed_at":"2026-08-05T05:14:58.366724Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:14:58.372279Z","title":"APT41, A DUAL ESPIONAGE AND CYBER CRIME OPERATION,","venue":null,"work_id":"a2c42b65-5b48-4f71-bd37-88552f787f6c","year":2022},"citing_paper":{"arxiv_id":"2509.05698","last_updated":"2025-09-06T12:25:06Z","snapshot_observed_at":"2026-08-07T07:24:50.563767Z","submitted_at":"2025-09-06T12:25:06Z","title":"KnowHow: Automatically Applying High-Level CTI Knowledge for Interpretable and Accurate Provenance Analysis","version":1},"reference_index":50,"source":"pdf_text","source_observed_at":"2026-08-05T05:14:57.206146Z"},"links":{"citing_paper":"/paper/2509.05698"},"observation_digest":"sha256:b0d5de76cf686cc32fcabe5e2a00353275af43c898d8b0c5dec79ab3fe840fde","observation_id":"06ae9107-9105-43b9-9eec-a5ed1f9d2ea3","resolution":{"observed_at":"2026-08-05T05:14:58.375012Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:14:58.349041Z","title":"Cyber Security & Threat Intelligence Webinars,","venue":null,"work_id":"4913f5fc-9cf6-41ee-930e-71e572fb3b39","year":2023},"citing_paper":{"arxiv_id":"2509.05698","last_updated":"2025-09-06T12:25:06Z","snapshot_observed_at":"2026-08-07T07:24:50.563767Z","submitted_at":"2025-09-06T12:25:06Z","title":"KnowHow: Automatically Applying High-Level CTI Knowledge for Interpretable and Accurate Provenance Analysis","version":1},"reference_index":51,"source":"pdf_text","source_observed_at":"2026-08-05T05:14:57.213395Z"},"links":{"citing_paper":"/paper/2509.05698"},"observation_digest":"sha256:d05b3c91e354bf980efaee41ac8ea02f19909dfc77e67cc783408e9b1d24957d","observation_id":"28379ba1-4483-45c8-92d3-86e85aa420d4","resolution":{"observed_at":"2026-08-05T05:14:58.352272Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:14:58.356757Z","title":"Apt43: North korean group uses cybercrime to fund espionage operations,","venue":null,"work_id":"52e4ddc2-b567-4bcc-ab46-5189fbb729ad","year":2023},"citing_paper":{"arxiv_id":"2509.05698","last_updated":"2025-09-06T12:25:06Z","snapshot_observed_at":"2026-08-07T07:24:50.563767Z","submitted_at":"2025-09-06T12:25:06Z","title":"KnowHow: Automatically Applying High-Level CTI Knowledge for Interpretable and Accurate Provenance Analysis","version":1},"reference_index":52,"source":"pdf_text","source_observed_at":"2026-08-05T05:14:57.211065Z"},"links":{"citing_paper":"/paper/2509.05698"},"observation_digest":"sha256:483fb48690909e231f09dd98f25159f3caaf183f8590263d6070fb000cd58a93","observation_id":"d6ff1e40-caec-46d6-9fa0-a5e0759126fd","resolution":{"observed_at":"2026-08-05T05:14:58.359117Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:14:58.328293Z","title":"ETW events in the common language runtime,","venue":null,"work_id":"de78ba86-794e-42fd-900c-562fb963a33c","year":2017},"citing_paper":{"arxiv_id":"2509.05698","last_updated":"2025-09-06T12:25:06Z","snapshot_observed_at":"2026-08-07T07:24:50.563767Z","submitted_at":"2025-09-06T12:25:06Z","title":"KnowHow: Automatically Applying High-Level CTI Knowledge for Interpretable and Accurate Provenance Analysis","version":1},"reference_index":53,"source":"pdf_text","source_observed_at":"2026-08-05T05:14:57.220698Z"},"links":{"citing_paper":"/paper/2509.05698"},"observation_digest":"sha256:d8e7ffa398852609589b5292857c58c857fe959fe7e866b048272c40bd185ae8","observation_id":"e17e544f-6182-4ca4-94d3-47db32deb26f","resolution":{"observed_at":"2026-08-05T05:14:58.330711Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:14:58.341673Z","title":"Targeted attack lifecycle,","venue":null,"work_id":"766af68c-4828-4d0c-8930-b4750d74ae65","year":2023},"citing_paper":{"arxiv_id":"2509.05698","last_updated":"2025-09-06T12:25:06Z","snapshot_observed_at":"2026-08-07T07:24:50.563767Z","submitted_at":"2025-09-06T12:25:06Z","title":"KnowHow: Automatically Applying High-Level CTI Knowledge for Interpretable and Accurate Provenance Analysis","version":1},"reference_index":54,"source":"pdf_text","source_observed_at":"2026-08-05T05:14:57.215850Z"},"links":{"citing_paper":"/paper/2509.05698"},"observation_digest":"sha256:158c398a28b8fdc2def34feaee10f12f1ae0f90518cf30bab3f6817b63d376a6","observation_id":"312edd54-e3ae-4e99-9736-1934d79d8dc7","resolution":{"observed_at":"2026-08-05T05:14:58.344167Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:14:58.335003Z","title":"Available: https://www.mandiant.com/resources/insight s/targeted-attack-lifecycle/","venue":null,"work_id":"d3eb9108-815a-4c74-be48-0d388200b2f5","year":null},"citing_paper":{"arxiv_id":"2509.05698","last_updated":"2025-09-06T12:25:06Z","snapshot_observed_at":"2026-08-07T07:24:50.563767Z","submitted_at":"2025-09-06T12:25:06Z","title":"KnowHow: Automatically Applying High-Level CTI Knowledge for Interpretable and Accurate Provenance Analysis","version":1},"reference_index":55,"source":"pdf_text","source_observed_at":"2026-08-05T05:14:57.218355Z"},"links":{"citing_paper":"/paper/2509.05698"},"observation_digest":"sha256:f7cf78f6bd376ae741e73b9ce96c81e12e0793bcb85130e91396b110c76920a8","observation_id":"32464af5-20a3-44e1-a8ce-a6ca85a07719","resolution":{"observed_at":"2026-08-05T05:14:58.337448Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:14:58.314298Z","title":"HOLMES: Real-Time APT Detection through Correlation of Suspicious Information Flows,","venue":null,"work_id":"d38fe4c6-688f-438c-8052-dec81fef3403","year":2019},"citing_paper":{"arxiv_id":"2509.05698","last_updated":"2025-09-06T12:25:06Z","snapshot_observed_at":"2026-08-07T07:24:50.563767Z","submitted_at":"2025-09-06T12:25:06Z","title":"KnowHow: Automatically Applying High-Level CTI Knowledge for Interpretable and Accurate Provenance Analysis","version":1},"reference_index":56,"source":"pdf_text","source_observed_at":"2026-08-05T05:14:57.227797Z"},"links":{"citing_paper":"/paper/2509.05698"},"observation_digest":"sha256:08718feda2b8ba0a49867d1186783fac952b394dcb4ad7bdb8333005bb9629be","observation_id":"bc83f7d4-0d78-4699-ad73-3834ac30fbd4","resolution":{"observed_at":"2026-08-05T05:14:58.316803Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:14:58.321240Z","title":"Efficient estimation of word representations in vector space,","venue":null,"work_id":"321c1c02-5b6f-4be7-bcdf-0727917265e6","year":2013},"citing_paper":{"arxiv_id":"2509.05698","last_updated":"2025-09-06T12:25:06Z","snapshot_observed_at":"2026-08-07T07:24:50.563767Z","submitted_at":"2025-09-06T12:25:06Z","title":"KnowHow: Automatically Applying High-Level CTI Knowledge for Interpretable and Accurate Provenance Analysis","version":1},"reference_index":57,"source":"pdf_text","source_observed_at":"2026-08-05T05:14:57.223029Z"},"links":{"citing_paper":"/paper/2509.05698"},"observation_digest":"sha256:d38244928064835bcc7c812fc8274a3f6a6acc7439e278e3644a93d9bc804deb","observation_id":"6ac5de4b-d26b-4a10-b8d0-61130087cc9f","resolution":{"observed_at":"2026-08-05T05:14:58.323787Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:14:57.225376Z","title":"POIROT: Aligning Attack Behavior with Kernel Audit Records for Cyber Threat Hunting,","venue":null,"work_id":null,"year":2019},"citing_paper":{"arxiv_id":"2509.05698","last_updated":"2025-09-06T12:25:06Z","snapshot_observed_at":"2026-08-07T07:24:50.563767Z","submitted_at":"2025-09-06T12:25:06Z","title":"KnowHow: Automatically Applying High-Level CTI Knowledge for Interpretable and Accurate Provenance Analysis","version":1},"reference_index":58,"source":"pdf_text","source_observed_at":"2026-08-05T05:14:57.225376Z"},"links":{"citing_paper":"/paper/2509.05698"},"observation_digest":"sha256:ec26017be11c32ae6ddfc1aeb91053fb4568854b25cc089295927cb5162b622a","observation_id":"9e5da44f-603f-4ba4-9c0f-4b093a3f3f91","resolution":{"observed_at":"2026-08-05T05:14:57.225376Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:14:58.292530Z","title":"Structured threat information expression,","venue":null,"work_id":"bbb2dfed-f820-4088-967d-c9da16588183","year":null},"citing_paper":{"arxiv_id":"2509.05698","last_updated":"2025-09-06T12:25:06Z","snapshot_observed_at":"2026-08-07T07:24:50.563767Z","submitted_at":"2025-09-06T12:25:06Z","title":"KnowHow: Automatically Applying High-Level CTI Knowledge for Interpretable and Accurate Provenance Analysis","version":1},"reference_index":59,"source":"pdf_text","source_observed_at":"2026-08-05T05:14:57.235104Z"},"links":{"citing_paper":"/paper/2509.05698"},"observation_digest":"sha256:734e087a647ca52f427e9fd9e9b92b948a2214854c8abe20d6f685738ead57d0","observation_id":"07a65480-3215-4ffc-9561-b2c5e7ab687f","resolution":{"observed_at":"2026-08-05T05:14:58.295683Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:14:58.307259Z","title":"MITRE ATT&CK,","venue":null,"work_id":"3c522366-098b-418c-9b4d-ed2fafb33313","year":2023},"citing_paper":{"arxiv_id":"2509.05698","last_updated":"2025-09-06T12:25:06Z","snapshot_observed_at":"2026-08-07T07:24:50.563767Z","submitted_at":"2025-09-06T12:25:06Z","title":"KnowHow: Automatically Applying High-Level CTI Knowledge for Interpretable and Accurate Provenance Analysis","version":1},"reference_index":60,"source":"pdf_text","source_observed_at":"2026-08-05T05:14:57.230380Z"},"links":{"citing_paper":"/paper/2509.05698"},"observation_digest":"sha256:e20fa0a3901764ebd0fa69ea2732ea9bc9108559312244041781c29c344bdaa9","observation_id":"784dbcc6-a29f-4ed9-af45-d77917420b6c","resolution":{"observed_at":"2026-08-05T05:14:58.309677Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:14:58.299953Z","title":"MITRE ATT&CK Tactic,","venue":null,"work_id":"fd293cbe-3e62-417e-a3eb-823c87d7d52b","year":2023},"citing_paper":{"arxiv_id":"2509.05698","last_updated":"2025-09-06T12:25:06Z","snapshot_observed_at":"2026-08-07T07:24:50.563767Z","submitted_at":"2025-09-06T12:25:06Z","title":"KnowHow: Automatically Applying High-Level CTI Knowledge for Interpretable and Accurate Provenance Analysis","version":1},"reference_index":61,"source":"pdf_text","source_observed_at":"2026-08-05T05:14:57.232733Z"},"links":{"citing_paper":"/paper/2509.05698"},"observation_digest":"sha256:1e9242347770a54aca00dc301f5ecb5dcd24ead88bf849d418f1559f5670918e","observation_id":"d635c793-576c-4a2b-9847-794cd12d65eb","resolution":{"observed_at":"2026-08-05T05:14:58.302396Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:14:58.264085Z","title":"CVE-2024-28085 Detail,","venue":null,"work_id":"a3184143-a264-433b-81ba-38a110587680","year":2024},"citing_paper":{"arxiv_id":"2509.05698","last_updated":"2025-09-06T12:25:06Z","snapshot_observed_at":"2026-08-07T07:24:50.563767Z","submitted_at":"2025-09-06T12:25:06Z","title":"KnowHow: Automatically Applying High-Level CTI Knowledge for Interpretable and Accurate Provenance Analysis","version":1},"reference_index":62,"source":"pdf_text","source_observed_at":"2026-08-05T05:14:57.245010Z"},"links":{"citing_paper":"/paper/2509.05698"},"observation_digest":"sha256:9b46c502d3c934099b8ed762d2e4ad51670ace3f50dff567b0ecd1e8172b7b78","observation_id":"b7ebdd0d-4e6e-4e8d-97da-75b344dddafc","resolution":{"observed_at":"2026-08-05T05:14:58.266475Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:14:58.285302Z","title":"Available: https://stixproject.github.io/","venue":null,"work_id":"5580b247-0786-4362-adf8-78cc2ecb5e2e","year":null},"citing_paper":{"arxiv_id":"2509.05698","last_updated":"2025-09-06T12:25:06Z","snapshot_observed_at":"2026-08-07T07:24:50.563767Z","submitted_at":"2025-09-06T12:25:06Z","title":"KnowHow: Automatically Applying High-Level CTI Knowledge for Interpretable and Accurate Provenance Analysis","version":1},"reference_index":63,"source":"pdf_text","source_observed_at":"2026-08-05T05:14:57.237573Z"},"links":{"citing_paper":"/paper/2509.05698"},"observation_digest":"sha256:2e7f902c04b62b158800aabfaeb4675c589b317c8eacaeb43c8308c9f272fb3e","observation_id":"75ca5d42-5343-4ef7-bfc0-b5dd8731824c","resolution":{"observed_at":"2026-08-05T05:14:58.287938Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:14:58.277862Z","title":"NICKEL targeting government organizations across Latin America and Europe,","venue":null,"work_id":"f04073f2-499c-44cc-a4ee-3ab358960a72","year":2021},"citing_paper":{"arxiv_id":"2509.05698","last_updated":"2025-09-06T12:25:06Z","snapshot_observed_at":"2026-08-07T07:24:50.563767Z","submitted_at":"2025-09-06T12:25:06Z","title":"KnowHow: Automatically Applying High-Level CTI Knowledge for Interpretable and Accurate Provenance Analysis","version":1},"reference_index":64,"source":"pdf_text","source_observed_at":"2026-08-05T05:14:57.240123Z"},"links":{"citing_paper":"/paper/2509.05698"},"observation_digest":"sha256:3ef64aa3858d556ed9ec4c3f2439ee2f841731dae128596d956b7e455ba9a2c2","observation_id":"aa022351-c54d-42f0-b02a-b51ee57f36f9","resolution":{"observed_at":"2026-08-05T05:14:58.280417Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:14:58.271091Z","title":"CVE-2023-22809 Detail,","venue":null,"work_id":"146a4c3e-cf25-4df6-b6e3-5dc170ba7105","year":2023},"citing_paper":{"arxiv_id":"2509.05698","last_updated":"2025-09-06T12:25:06Z","snapshot_observed_at":"2026-08-07T07:24:50.563767Z","submitted_at":"2025-09-06T12:25:06Z","title":"KnowHow: Automatically Applying High-Level CTI Knowledge for Interpretable and Accurate Provenance Analysis","version":1},"reference_index":65,"source":"pdf_text","source_observed_at":"2026-08-05T05:14:57.242392Z"},"links":{"citing_paper":"/paper/2509.05698"},"observation_digest":"sha256:eebe03ffa01f0632aa0460df5f83845596de4ddbb9014e1037d0cb614ab66ab3","observation_id":"eb63011e-681d-4856-ab97-79285a08ee79","resolution":{"observed_at":"2026-08-05T05:14:58.273350Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:14:58.235247Z","title":"A Topological Approach to Hierarchical Segmentation using Mean Shift,","venue":null,"work_id":"c4e9bae3-939f-4edf-929d-77d5c9291f33","year":2007},"citing_paper":{"arxiv_id":"2509.05698","last_updated":"2025-09-06T12:25:06Z","snapshot_observed_at":"2026-08-07T07:24:50.563767Z","submitted_at":"2025-09-06T12:25:06Z","title":"KnowHow: Automatically Applying High-Level CTI Knowledge for Interpretable and Accurate Provenance Analysis","version":1},"reference_index":66,"source":"pdf_text","source_observed_at":"2026-08-05T05:14:57.255263Z"},"links":{"citing_paper":"/paper/2509.05698"},"observation_digest":"sha256:04602e9acf83db6b932e5c38554476303ab8b23b612181bd5500ae6d5109f509","observation_id":"15179baa-ce30-45d3-82de-23a2e8fcf15c","resolution":{"observed_at":"2026-08-05T05:14:58.237744Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:14:58.256921Z","title":"National vulnerability database,","venue":null,"work_id":"a0266a02-369d-4bc9-ab26-e772c30db49a","year":2024},"citing_paper":{"arxiv_id":"2509.05698","last_updated":"2025-09-06T12:25:06Z","snapshot_observed_at":"2026-08-07T07:24:50.563767Z","submitted_at":"2025-09-06T12:25:06Z","title":"KnowHow: Automatically Applying High-Level CTI Knowledge for Interpretable and Accurate Provenance Analysis","version":1},"reference_index":67,"source":"pdf_text","source_observed_at":"2026-08-05T05:14:57.247474Z"},"links":{"citing_paper":"/paper/2509.05698"},"observation_digest":"sha256:9b39dc7c8cc13261b9f6ed1adbad9187a0c3a1991679282f96b558b3b8b173c4","observation_id":"19da984c-6b2f-4698-884a-1908cceb503a","resolution":{"observed_at":"2026-08-05T05:14:58.259630Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:14:58.249341Z","title":"Simulated-data,","venue":null,"work_id":"1b1aef6a-a1b9-40b8-a872-5382a2b200ad","year":2024},"citing_paper":{"arxiv_id":"2509.05698","last_updated":"2025-09-06T12:25:06Z","snapshot_observed_at":"2026-08-07T07:24:50.563767Z","submitted_at":"2025-09-06T12:25:06Z","title":"KnowHow: Automatically Applying High-Level CTI Knowledge for Interpretable and Accurate Provenance Analysis","version":1},"reference_index":68,"source":"pdf_text","source_observed_at":"2026-08-05T05:14:57.250090Z"},"links":{"citing_paper":"/paper/2509.05698"},"observation_digest":"sha256:e92086ad26c3971a0c7e92cb9a7ecfff9f0a2e31dd3bebc989b7cfbbe43152d9","observation_id":"1c02ae89-fa3d-4f3c-baca-093d6b664f67","resolution":{"observed_at":"2026-08-05T05:14:58.252180Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:14:58.242409Z","title":"ioc-parser,","venue":null,"work_id":"51a76d98-6462-4dbb-a958-6ec526117afb","year":2014},"citing_paper":{"arxiv_id":"2509.05698","last_updated":"2025-09-06T12:25:06Z","snapshot_observed_at":"2026-08-07T07:24:50.563767Z","submitted_at":"2025-09-06T12:25:06Z","title":"KnowHow: Automatically Applying High-Level CTI Knowledge for Interpretable and Accurate Provenance Analysis","version":1},"reference_index":69,"source":"pdf_text","source_observed_at":"2026-08-05T05:14:57.252765Z"},"links":{"citing_paper":"/paper/2509.05698"},"observation_digest":"sha256:63c3f81cbdefa826a6b9833e0b8c186ff74616ab1e5bf064ba8c26fba530271f","observation_id":"4d2d2459-eca0-42bc-9089-7208067a6c92","resolution":{"observed_at":"2026-08-05T05:14:58.244672Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:14:58.214054Z","title":"The linux audit framework","venue":null,"work_id":"3f0d5543-5fa5-4495-a6e0-e94f14458874","year":2023},"citing_paper":{"arxiv_id":"2509.05698","last_updated":"2025-09-06T12:25:06Z","snapshot_observed_at":"2026-08-07T07:24:50.563767Z","submitted_at":"2025-09-06T12:25:06Z","title":"KnowHow: Automatically Applying High-Level CTI Knowledge for Interpretable and Accurate Provenance Analysis","version":1},"reference_index":70,"source":"pdf_text","source_observed_at":"2026-08-05T05:14:57.265675Z"},"links":{"citing_paper":"/paper/2509.05698"},"observation_digest":"sha256:10986c7be667e0b23bbbcba6a986649beeba456a2af4515b0c341bc46fe46783","observation_id":"46c053ad-58ed-4e7a-9eca-f6bf34936ea7","resolution":{"observed_at":"2026-08-05T05:14:58.216529Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:14:58.228131Z","title":"Pymupdf: Python bindings for mupdf,","venue":null,"work_id":"ea2a4b9c-2015-41bf-b5dc-e41d415067c8","year":2021},"citing_paper":{"arxiv_id":"2509.05698","last_updated":"2025-09-06T12:25:06Z","snapshot_observed_at":"2026-08-07T07:24:50.563767Z","submitted_at":"2025-09-06T12:25:06Z","title":"KnowHow: Automatically Applying High-Level CTI Knowledge for Interpretable and Accurate Provenance Analysis","version":1},"reference_index":71,"source":"pdf_text","source_observed_at":"2026-08-05T05:14:57.257732Z"},"links":{"citing_paper":"/paper/2509.05698"},"observation_digest":"sha256:b999f886a53383a67928428ae441210ee19fba4b4554b3b4c12a5c4f69b4bad2","observation_id":"fe69e973-e18d-4c4a-b753-171b5a3a4986","resolution":{"observed_at":"2026-08-05T05:14:58.230671Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:14:57.260461Z","title":"What Are the Attackers Doing Now? Automating Cyberthreat Intelligence Extraction from Text on Pace with the Changing Threat Landscape: A Survey,","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2509.05698","last_updated":"2025-09-06T12:25:06Z","snapshot_observed_at":"2026-08-07T07:24:50.563767Z","submitted_at":"2025-09-06T12:25:06Z","title":"KnowHow: Automatically Applying High-Level CTI Knowledge for Interpretable and Accurate Provenance Analysis","version":1},"reference_index":72,"source":"pdf_text","source_observed_at":"2026-08-05T05:14:57.260461Z"},"links":{"citing_paper":"/paper/2509.05698"},"observation_digest":"sha256:9ee9fd19ed2a4bda85cbd5e606858ed820bf05a96dde785f03a66dff48fb270b","observation_id":"4883e00e-58f7-4c90-93f7-13f3f0f96cee","resolution":{"observed_at":"2026-08-05T05:14:57.260461Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:14:58.221230Z","title":"Atomic red team,","venue":null,"work_id":"0a36382f-0172-42fc-b34a-ea2e6844b85c","year":2021},"citing_paper":{"arxiv_id":"2509.05698","last_updated":"2025-09-06T12:25:06Z","snapshot_observed_at":"2026-08-07T07:24:50.563767Z","submitted_at":"2025-09-06T12:25:06Z","title":"KnowHow: Automatically Applying High-Level CTI Knowledge for Interpretable and Accurate Provenance Analysis","version":1},"reference_index":73,"source":"pdf_text","source_observed_at":"2026-08-05T05:14:57.263249Z"},"links":{"citing_paper":"/paper/2509.05698"},"observation_digest":"sha256:c1624778af1b2b08307ef8934f0354cfa3c822d4a273eb72c25eb0fe11a7d0be","observation_id":"8871819a-7400-4f50-82d6-26721cdf18c9","resolution":{"observed_at":"2026-08-05T05:14:58.223663Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:14:58.184402Z","title":"Extractor: Extracting attack behavior from threat reports,","venue":null,"work_id":"4a2a36e2-0cdb-4d46-a991-7c326d2ab054","year":2021},"citing_paper":{"arxiv_id":"2509.05698","last_updated":"2025-09-06T12:25:06Z","snapshot_observed_at":"2026-08-07T07:24:50.563767Z","submitted_at":"2025-09-06T12:25:06Z","title":"KnowHow: Automatically Applying High-Level CTI Knowledge for Interpretable and Accurate Provenance Analysis","version":1},"reference_index":74,"source":"pdf_text","source_observed_at":"2026-08-05T05:14:57.276654Z"},"links":{"citing_paper":"/paper/2509.05698"},"observation_digest":"sha256:7eb2bf71ad91fa37d08e1ed999cd1f24a4b5ce7998bd9da25f8d56dec9e2383e","observation_id":"cd7d7979-d57a-42dc-95b7-f59ba33ed62f","resolution":{"observed_at":"2026-08-05T05:14:58.186981Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:14:58.206305Z","title":"Machine actionable indicators of compromise,","venue":null,"work_id":"66b59626-090f-455c-a2bb-6b836fdf5598","year":2014},"citing_paper":{"arxiv_id":"2509.05698","last_updated":"2025-09-06T12:25:06Z","snapshot_observed_at":"2026-08-07T07:24:50.563767Z","submitted_at":"2025-09-06T12:25:06Z","title":"KnowHow: Automatically Applying High-Level CTI Knowledge for Interpretable and Accurate Provenance Analysis","version":1},"reference_index":75,"source":"pdf_text","source_observed_at":"2026-08-05T05:14:57.268700Z"},"links":{"citing_paper":"/paper/2509.05698"},"observation_digest":"sha256:5662ae118e5b3cf356fdd7acf976c0df07d799fce8ac91d806381fba2c06e21a","observation_id":"2b9828df-068d-437d-ae16-0a64d65d3139","resolution":{"observed_at":"2026-08-05T05:14:58.208951Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:14:58.199086Z","title":"Apt41 world tour 2021 on a tight schedule,","venue":null,"work_id":"6b87d713-649d-432b-bd5d-f5380ab71243","year":2021},"citing_paper":{"arxiv_id":"2509.05698","last_updated":"2025-09-06T12:25:06Z","snapshot_observed_at":"2026-08-07T07:24:50.563767Z","submitted_at":"2025-09-06T12:25:06Z","title":"KnowHow: Automatically Applying High-Level CTI Knowledge for Interpretable and Accurate Provenance Analysis","version":1},"reference_index":76,"source":"pdf_text","source_observed_at":"2026-08-05T05:14:57.271512Z"},"links":{"citing_paper":"/paper/2509.05698"},"observation_digest":"sha256:da6f6e4f201788815470cfbc074e7c533159f63ff184129c1a2af6d7b073c0d0","observation_id":"14d0380a-1f1a-440b-b7b0-7e2150235abc","resolution":{"observed_at":"2026-08-05T05:14:58.201708Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:14:58.191463Z","title":"Iranian Chafer APT Targeted Air Transportation and Government in Kuwait and Saudi Arabia,","venue":null,"work_id":"37ec9f0c-ee40-441f-9cb1-9dd2cbc2d54b","year":2020},"citing_paper":{"arxiv_id":"2509.05698","last_updated":"2025-09-06T12:25:06Z","snapshot_observed_at":"2026-08-07T07:24:50.563767Z","submitted_at":"2025-09-06T12:25:06Z","title":"KnowHow: Automatically Applying High-Level CTI Knowledge for Interpretable and Accurate Provenance Analysis","version":1},"reference_index":77,"source":"pdf_text","source_observed_at":"2026-08-05T05:14:57.273959Z"},"links":{"citing_paper":"/paper/2509.05698"},"observation_digest":"sha256:e185cbdef35646e0bf260bea6d6e6c9402daf39a7f79f6063957e76ffecad653","observation_id":"1307d373-e07c-437a-bb42-9ff426189dd2","resolution":{"observed_at":"2026-08-05T05:14:58.194559Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:14:58.154270Z","title":"Darkwatchman: A new evolution in fileless techniques,","venue":null,"work_id":"2d17d089-42ae-4846-8238-f6470c983a22","year":2021},"citing_paper":{"arxiv_id":"2509.05698","last_updated":"2025-09-06T12:25:06Z","snapshot_observed_at":"2026-08-07T07:24:50.563767Z","submitted_at":"2025-09-06T12:25:06Z","title":"KnowHow: Automatically Applying High-Level CTI Knowledge for Interpretable and Accurate Provenance Analysis","version":1},"reference_index":78,"source":"pdf_text","source_observed_at":"2026-08-05T05:14:57.287025Z"},"links":{"citing_paper":"/paper/2509.05698"},"observation_digest":"sha256:b4223278a5e57ffa7ac6fa1df9fa53c458638b43fb50e36d7b2f5c14308770dc","observation_id":"e23005a0-4479-4a67-bf12-9662179acc62","resolution":{"observed_at":"2026-08-05T05:14:58.156694Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:14:58.177272Z","title":"scikit-learn,","venue":null,"work_id":"18bee4f1-9ec5-4b59-bbe1-df522f5ab020","year":2023},"citing_paper":{"arxiv_id":"2509.05698","last_updated":"2025-09-06T12:25:06Z","snapshot_observed_at":"2026-08-07T07:24:50.563767Z","submitted_at":"2025-09-06T12:25:06Z","title":"KnowHow: Automatically Applying High-Level CTI Knowledge for Interpretable and Accurate Provenance Analysis","version":1},"reference_index":79,"source":"pdf_text","source_observed_at":"2026-08-05T05:14:57.279360Z"},"links":{"citing_paper":"/paper/2509.05698"},"observation_digest":"sha256:eb23b5690ef81212e24c7f51264948aa14497742352dd7d641f41f96a639ae1a","observation_id":"b854b60f-42f1-40e6-b112-1001b71b486c","resolution":{"observed_at":"2026-08-05T05:14:58.179708Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:14:58.167954Z","title":"Executable installers are vulnerable ˆWEVIL (case 7): 7z*.exe allows remote code execution with escalation of privilege,","venue":null,"work_id":"bbc8bcd3-9e30-4bd2-a117-c607750f222d","year":2015},"citing_paper":{"arxiv_id":"2509.05698","last_updated":"2025-09-06T12:25:06Z","snapshot_observed_at":"2026-08-07T07:24:50.563767Z","submitted_at":"2025-09-06T12:25:06Z","title":"KnowHow: Automatically Applying High-Level CTI Knowledge for Interpretable and Accurate Provenance Analysis","version":1},"reference_index":80,"source":"pdf_text","source_observed_at":"2026-08-05T05:14:57.281904Z"},"links":{"citing_paper":"/paper/2509.05698"},"observation_digest":"sha256:aa85d99c65fc0b208b7005852a3eb754bdd25d3c32fc377005679d66def79f7e","observation_id":"d69e99ab-85f8-4996-87ca-2ad1b0c22ea7","resolution":{"observed_at":"2026-08-05T05:14:58.170609Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:14:58.161044Z","title":"The baffling berserk bear: A decade’s activity targeting critical infrastructure,","venue":null,"work_id":"032b5450-ec62-4a6b-90b4-d8c2b0760efc","year":2021},"citing_paper":{"arxiv_id":"2509.05698","last_updated":"2025-09-06T12:25:06Z","snapshot_observed_at":"2026-08-07T07:24:50.563767Z","submitted_at":"2025-09-06T12:25:06Z","title":"KnowHow: Automatically Applying High-Level CTI Knowledge for Interpretable and Accurate Provenance Analysis","version":1},"reference_index":81,"source":"pdf_text","source_observed_at":"2026-08-05T05:14:57.284313Z"},"links":{"citing_paper":"/paper/2509.05698"},"observation_digest":"sha256:ef1d2e841a8bc89e59872ec03e347050842b952265a766904b22178168b5dbf9","observation_id":"477df4f9-0488-47b8-948c-18522de5efd6","resolution":{"observed_at":"2026-08-05T05:14:58.163602Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:14:58.117941Z","title":"[Online]","venue":null,"work_id":"9a01bcfc-a22c-494f-97f6-b3af573d778d","year":2013},"citing_paper":{"arxiv_id":"2509.05698","last_updated":"2025-09-06T12:25:06Z","snapshot_observed_at":"2026-08-07T07:24:50.563767Z","submitted_at":"2025-09-06T12:25:06Z","title":"KnowHow: Automatically Applying High-Level CTI Knowledge for Interpretable and Accurate Provenance Analysis","version":1},"reference_index":82,"source":"pdf_text","source_observed_at":"2026-08-05T05:14:57.300309Z"},"links":{"citing_paper":"/paper/2509.05698"},"observation_digest":"sha256:63852c6e49726d487ae6a3a6b2066953acc8ed169c567837c89f09009e0f7ef8","observation_id":"82ca8189-5f04-4557-a058-3bac59bd3a01","resolution":{"observed_at":"2026-08-05T05:14:58.120571Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:14:58.147239Z","title":"Survey of the state of security 2022,","venue":null,"work_id":"4808f87d-baba-42a1-bc36-83759fa37732","year":2022},"citing_paper":{"arxiv_id":"2509.05698","last_updated":"2025-09-06T12:25:06Z","snapshot_observed_at":"2026-08-07T07:24:50.563767Z","submitted_at":"2025-09-06T12:25:06Z","title":"KnowHow: Automatically Applying High-Level CTI Knowledge for Interpretable and Accurate Provenance Analysis","version":1},"reference_index":83,"source":"pdf_text","source_observed_at":"2026-08-05T05:14:57.289498Z"},"links":{"citing_paper":"/paper/2509.05698"},"observation_digest":"sha256:c4a860a156453f13db562ef66efc2f61ecf0e1a488279ba9d4f6c2a8423d24fe","observation_id":"bd1b7a74-9c9b-4ccb-8ae1-64d9054eb11f","resolution":{"observed_at":"2026-08-05T05:14:58.149526Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:14:58.140170Z","title":"Stanford CoreNLP,","venue":null,"work_id":"88cded34-135f-4030-a375-d8297ed305f8","year":null},"citing_paper":{"arxiv_id":"2509.05698","last_updated":"2025-09-06T12:25:06Z","snapshot_observed_at":"2026-08-07T07:24:50.563767Z","submitted_at":"2025-09-06T12:25:06Z","title":"KnowHow: Automatically Applying High-Level CTI Knowledge for Interpretable and Accurate Provenance Analysis","version":1},"reference_index":84,"source":"pdf_text","source_observed_at":"2026-08-05T05:14:57.292372Z"},"links":{"citing_paper":"/paper/2509.05698"},"observation_digest":"sha256:b9110d7ae197f21e47ed85c5ea81dcd1faa5cd5b49a537fe2e8ff6e284b8fcf8","observation_id":"ca577872-ddbb-4987-bada-63fe76086a2a","resolution":{"observed_at":"2026-08-05T05:14:58.142696Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:14:58.095122Z","title":"AppleJeus: Analysis of North Korea’s Cryptocurrency Malware,","venue":null,"work_id":"bb6b73c3-4a83-45ed-8f19-2d49cb90c71e","year":2021},"citing_paper":{"arxiv_id":"2509.05698","last_updated":"2025-09-06T12:25:06Z","snapshot_observed_at":"2026-08-07T07:24:50.563767Z","submitted_at":"2025-09-06T12:25:06Z","title":"KnowHow: Automatically Applying High-Level CTI Knowledge for Interpretable and Accurate Provenance Analysis","version":1},"reference_index":85,"source":"pdf_text","source_observed_at":"2026-08-05T05:14:57.307872Z"},"links":{"citing_paper":"/paper/2509.05698"},"observation_digest":"sha256:66bad71c9efd8a185e75b47f74868beea9f8d5e9eb7d763ce3f25e2fe91cc884","observation_id":"676a09c9-0605-480f-81c6-627943f281c5","resolution":{"observed_at":"2026-08-05T05:14:58.097480Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:14:58.125224Z","title":"3 Advanced Persistent Threat (APT) Examples You Should Know About,","venue":null,"work_id":"f78ee982-f249-4345-8798-7ad5d486aae8","year":2024},"citing_paper":{"arxiv_id":"2509.05698","last_updated":"2025-09-06T12:25:06Z","snapshot_observed_at":"2026-08-07T07:24:50.563767Z","submitted_at":"2025-09-06T12:25:06Z","title":"KnowHow: Automatically Applying High-Level CTI Knowledge for Interpretable and Accurate Provenance Analysis","version":1},"reference_index":86,"source":"pdf_text","source_observed_at":"2026-08-05T05:14:57.297713Z"},"links":{"citing_paper":"/paper/2509.05698"},"observation_digest":"sha256:a9bbcac785c09db8ac953b3a9a04a286663b00308ec827f09fc57f3764b23c42","observation_id":"1bf08251-95fd-470a-aaef-a84b50c95d5e","resolution":{"observed_at":"2026-08-05T05:14:58.127855Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:14:58.080002Z","title":"Infobert: Improving robustness of language models from an information theoretic perspective,","venue":null,"work_id":"94560f15-3b05-4943-bbc7-d36cab8bae06","year":2021},"citing_paper":{"arxiv_id":"2509.05698","last_updated":"2025-09-06T12:25:06Z","snapshot_observed_at":"2026-08-07T07:24:50.563767Z","submitted_at":"2025-09-06T12:25:06Z","title":"KnowHow: Automatically Applying High-Level CTI Knowledge for Interpretable and Accurate Provenance Analysis","version":1},"reference_index":87,"source":"pdf_text","source_observed_at":"2026-08-05T05:14:57.312905Z"},"links":{"citing_paper":"/paper/2509.05698"},"observation_digest":"sha256:4cb610e8242cba83740b8394421ec30d136cef3df1609e4aa936dcc8e8a0247d","observation_id":"76744656-a76a-480a-9477-173d54a23dcf","resolution":{"observed_at":"2026-08-05T05:14:58.082585Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:14:58.109527Z","title":"Flash: A comprehensive approach to intrusion detection via provenance graph representation learning,","venue":null,"work_id":"2ac32d0d-9cad-4dcc-9d10-e2ac1590144d","year":2024},"citing_paper":{"arxiv_id":"2509.05698","last_updated":"2025-09-06T12:25:06Z","snapshot_observed_at":"2026-08-07T07:24:50.563767Z","submitted_at":"2025-09-06T12:25:06Z","title":"KnowHow: Automatically Applying High-Level CTI Knowledge for Interpretable and Accurate Provenance Analysis","version":1},"reference_index":88,"source":"pdf_text","source_observed_at":"2026-08-05T05:14:57.302937Z"},"links":{"citing_paper":"/paper/2509.05698"},"observation_digest":"sha256:eb8f76a98a8b7811a5973fff48bf1012bde9a2c8d27baf5d809bedb5fd0896b0","observation_id":"02285be7-519d-42e5-af73-b5936916474d","resolution":{"observed_at":"2026-08-05T05:14:58.112222Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:14:58.102346Z","title":"Malware Analysis Report (MAR) - 10135536-B,","venue":null,"work_id":"42d105f6-7b9a-41d2-bb22-c1ac757fa708","year":2017},"citing_paper":{"arxiv_id":"2509.05698","last_updated":"2025-09-06T12:25:06Z","snapshot_observed_at":"2026-08-07T07:24:50.563767Z","submitted_at":"2025-09-06T12:25:06Z","title":"KnowHow: Automatically Applying High-Level CTI Knowledge for Interpretable and Accurate Provenance Analysis","version":1},"reference_index":89,"source":"pdf_text","source_observed_at":"2026-08-05T05:14:57.305406Z"},"links":{"citing_paper":"/paper/2509.05698"},"observation_digest":"sha256:6fcfa0f4f91ab1b147c66b058cfd8bca5415bface56aef721118aa4c64d13dc9","observation_id":"f51631a3-f03c-4bee-aa99-8625d9f813ed","resolution":{"observed_at":"2026-08-05T05:14:58.104988Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:14:58.056175Z","title":"SHADEW ATCHER: Recommendation-guided Cyber Threat Analysis using System Audit Records,","venue":null,"work_id":"9ed88ce9-133b-4417-a66a-a351d56b9cdb","year":2022},"citing_paper":{"arxiv_id":"2509.05698","last_updated":"2025-09-06T12:25:06Z","snapshot_observed_at":"2026-08-07T07:24:50.563767Z","submitted_at":"2025-09-06T12:25:06Z","title":"KnowHow: Automatically Applying High-Level CTI Knowledge for Interpretable and Accurate Provenance Analysis","version":1},"reference_index":90,"source":"pdf_text","source_observed_at":"2026-08-05T05:14:57.320239Z"},"links":{"citing_paper":"/paper/2509.05698"},"observation_digest":"sha256:9c38e23a8b176171975a3b74427c65cb48b0540aac3d04b9214af2e7866c7d7e","observation_id":"8a616f15-7ade-4cfe-b5a3-42947e943c2e","resolution":{"observed_at":"2026-08-05T05:14:58.059067Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:14:58.087615Z","title":"Where 2 worlds collide Bringing Mimikatz et al to UNIX,","venue":null,"work_id":"ef970f98-7a4b-4ec6-a569-74aedc6c08e8","year":2018},"citing_paper":{"arxiv_id":"2509.05698","last_updated":"2025-09-06T12:25:06Z","snapshot_observed_at":"2026-08-07T07:24:50.563767Z","submitted_at":"2025-09-06T12:25:06Z","title":"KnowHow: Automatically Applying High-Level CTI Knowledge for Interpretable and Accurate Provenance Analysis","version":1},"reference_index":91,"source":"pdf_text","source_observed_at":"2026-08-05T05:14:57.310135Z"},"links":{"citing_paper":"/paper/2509.05698"},"observation_digest":"sha256:476b7333f65660494a7ce8b48d31fb548bbaaebbccba9b707422b3b787b69473","observation_id":"a1ba2552-0a4e-4146-895b-1ce10dfdd1a1","resolution":{"observed_at":"2026-08-05T05:14:58.090175Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:14:58.072474Z","title":"You are what you do: Hunting stealthy malware via data provenance analysis","venue":null,"work_id":"cb24adb2-28d5-43eb-af42-bfb6b24a78e0","year":2020},"citing_paper":{"arxiv_id":"2509.05698","last_updated":"2025-09-06T12:25:06Z","snapshot_observed_at":"2026-08-07T07:24:50.563767Z","submitted_at":"2025-09-06T12:25:06Z","title":"KnowHow: Automatically Applying High-Level CTI Knowledge for Interpretable and Accurate Provenance Analysis","version":1},"reference_index":93,"source":"pdf_text","source_observed_at":"2026-08-05T05:14:57.315382Z"},"links":{"citing_paper":"/paper/2509.05698"},"observation_digest":"sha256:2db55a297e72260a3312daf2161e8021a90d1166f18067648fbf08ad6b34e64d","observation_id":"f5875aad-a439-4b48-b825-bbba6cfc1ee9","resolution":{"observed_at":"2026-08-05T05:14:58.075203Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:14:58.064290Z","title":"DEPCOMM: Graph Summarization on System Audit Logs for Attack Investigation,","venue":null,"work_id":"d41ba196-8499-476c-92bf-1296db120030","year":2022},"citing_paper":{"arxiv_id":"2509.05698","last_updated":"2025-09-06T12:25:06Z","snapshot_observed_at":"2026-08-07T07:24:50.563767Z","submitted_at":"2025-09-06T12:25:06Z","title":"KnowHow: Automatically Applying High-Level CTI Knowledge for Interpretable and Accurate Provenance Analysis","version":1},"reference_index":94,"source":"pdf_text","source_observed_at":"2026-08-05T05:14:57.317646Z"},"links":{"citing_paper":"/paper/2509.05698"},"observation_digest":"sha256:799b9143c4215e04f7b4d0d9f7b3b16c13a97e47a204fa0fd156de13adcf03a9","observation_id":"ecab4a37-cb63-4d35-8a26-2a28d7c2d087","resolution":{"observed_at":"2026-08-05T05:14:58.067163Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:14:58.046474Z","title":"APTSHIELD: A Stable, Efficient and Real-Time APT Detection System for Linux Hosts,","venue":null,"work_id":"5267e5dd-c8fe-40aa-bcbc-2cd046186218","year":2023},"citing_paper":{"arxiv_id":"2509.05698","last_updated":"2025-09-06T12:25:06Z","snapshot_observed_at":"2026-08-07T07:24:50.563767Z","submitted_at":"2025-09-06T12:25:06Z","title":"KnowHow: Automatically Applying High-Level CTI Knowledge for Interpretable and Accurate Provenance Analysis","version":1},"reference_index":96,"source":"pdf_text","source_observed_at":"2026-08-05T05:14:57.322743Z"},"links":{"citing_paper":"/paper/2509.05698"},"observation_digest":"sha256:c0403fedffe66a518639237f2dbe5e8fa164c0a09bf5b8c1b383425ff5eb3248","observation_id":"fbf7e188-9d56-40a4-beb8-46a32f015399","resolution":{"observed_at":"2026-08-05T05:14:58.049067Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:14:58.132630Z","title":"Available: https://stanfordnlp.github.io/CoreNLP/","venue":null,"work_id":"12191aee-7f8b-45e2-b0e6-efa936bc45a3","year":null},"citing_paper":{"arxiv_id":"2509.05698","last_updated":"2025-09-06T12:25:06Z","snapshot_observed_at":"2026-08-07T07:24:50.563767Z","submitted_at":"2025-09-06T12:25:06Z","title":"KnowHow: Automatically Applying High-Level CTI Knowledge for Interpretable and Accurate Provenance Analysis","version":1},"reference_index":2023,"source":"pdf_text","source_observed_at":"2026-08-05T05:14:57.295271Z"},"links":{"citing_paper":"/paper/2509.05698"},"observation_digest":"sha256:fe38d9ef9734ca643771cfe143c8c3bbf0d524043fb6e124b04756180f25374e","observation_id":"26dbdab5-78b4-432a-b98a-dc7955435e20","resolution":{"observed_at":"2026-08-05T05:14:58.135466Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:14:57.094860Z","title":"Available: https://www.cert.ssi.gouv.fr/uploads/CERTF R-2021-CTI-005.pdf/","venue":null,"work_id":null,"year":2021},"citing_paper":{"arxiv_id":"2509.05698","last_updated":"2025-09-06T12:25:06Z","snapshot_observed_at":"2026-08-07T07:24:50.563767Z","submitted_at":"2025-09-06T12:25:06Z","title":"KnowHow: Automatically Applying High-Level CTI Knowledge for Interpretable and Accurate Provenance Analysis","version":1},"reference_index":2024,"source":"pdf_text","source_observed_at":"2026-08-05T05:14:57.094860Z"},"links":{"citing_paper":"/paper/2509.05698"},"observation_digest":"sha256:21b371b5f14f63c011732b7c848e2ea3b5744fd8f9f4665509d38dc7f2c8a0ce","observation_id":"1893754d-8e4c-4a14-8514-65b65fe822a4","resolution":{"observed_at":"2026-08-05T05:14:57.094860Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}}],"paper":{"arxiv_id":"2509.05698","last_updated":"2025-09-06T12:25:06Z","latest_version":1,"primary_category":"cs.CR","snapshot_observed_at":"2026-08-07T07:24:50.563767Z","submitted_at":"2025-09-06T12:25:06Z","title":"KnowHow: Automatically Applying High-Level CTI Knowledge for Interpretable and Accurate Provenance Analysis"},"reference_resolution":{"displayed":96,"state_counts":{"malformed_identifier":0,"metadata_mismatch":2,"parse_uncertain":0,"unresolved":25,"verified_exact":0,"verified_fuzzy":69},"total_outbound_references":96},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"thesis":"As of 7 August 2026, this Paper Citation Record lists 96 of 96 outbound references and 1 inbound Pith citation observation for arXiv:2509.05698."}