{"as_of":"2026-08-08T05:53:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:c472f7954c7ba3074f79e892799afdaaa85350480a2f011007def5b289338b07","coverage":[{"denominator":60,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":60,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-06T00:12:45.339878Z","state":"measured"},{"denominator":60,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":60,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-07T06:34:17.273281+00:00","state":"measured"},{"denominator":0,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":0,"source":"paper_references, paper_reference_links","source_observed_at":null,"state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":0,"source":"cited_works","source_observed_at":null,"state":"measured"}],"external_citation_measurements":[],"inbound":[],"links":{"evidence":"/evidence","html":"/paper/2608.01454/citation-record","integrity":"/paper/2608.01454/integrity","json":"/paper/2608.01454/citation-record.json","paper":"/paper/2608.01454"},"outbound":[{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:12:52.614089Z","title":"Provenance-based in- trusion detection systems: A survey,","venue":null,"work_id":"fe3a3e86-f68d-4abf-b76b-5d64e079e5d4","year":2022},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":1,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:41.160900Z"},"links":{"citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:7e8acaf36cfa5ce9f60bba525486e3d07dd35ac77a9828233a47d9bf72255757","observation_id":"1b2534e7-e672-48d6-89e0-39727d96d701","resolution":{"observed_at":"2026-08-06T00:12:52.691610Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:12:52.427097Z","title":"Are we there yet? an industrial viewpoint on provenance-based endpoint detection and response tools,","venue":null,"work_id":"25226f12-5268-441c-a860-ece9a5e79ef6","year":2023},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":2,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:41.252207Z"},"links":{"citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:a6932c82e8ea605019dde6a03e4af5af629b308cebf1d40a1d425f18ea4d68fa","observation_id":"98c97d73-1d67-43dd-b241-c19105a18bb5","resolution":{"observed_at":"2026-08-06T00:12:52.490430Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:12:52.237803Z","title":"SLEUTH: Real-time attack scenario reconstruction from COTS audit data,","venue":null,"work_id":"1fe2c4b1-292a-405c-9a7b-c72441a8df97","year":2017},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":3,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:41.315830Z"},"links":{"citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:ea3592f4e23fced9595075d7c81bb14fcefda5d9a9e92876ce7ad24fd88a1d8c","observation_id":"014bc13f-f0b5-4875-9526-f2dd8b852303","resolution":{"observed_at":"2026-08-06T00:12:52.345366Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:12:52.094625Z","title":"HOLMES: Real-time APT detection through correlation of suspicious information flows,","venue":null,"work_id":"268d5594-45f0-43d5-b4df-79b59a4ab234","year":2019},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":4,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:41.358735Z"},"links":{"citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:1ffce9369aafa74faadc82172f58c158c184fe865efc0261b5832c6316799d49","observation_id":"081d34ce-49d4-4d64-8413-551b679cffc5","resolution":{"observed_at":"2026-08-06T00:12:52.152844Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:12:51.925083Z","title":"Graph neural networks for intrusion detection: A survey,","venue":null,"work_id":"9ca8812d-4355-436b-bab8-e82d5a859292","year":2023},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":5,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:41.460075Z"},"links":{"citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:27e3c98fb7c0d87f5ec9250f871b2c30f9c796f3fd014bac5cadaae845d8b9be","observation_id":"b311dc26-245c-4469-84bb-8fb834565b0e","resolution":{"observed_at":"2026-08-06T00:12:52.012334Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:12:51.786118Z","title":"KAIROS: Practical intrusion detection and investigation using whole- system provenance,","venue":null,"work_id":"ec10673a-98ff-403d-b5f3-9b449c73276f","year":2024},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":6,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:41.529829Z"},"links":{"citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:59907d1b12fa523d148db1c132c26fa1ec333994879cbe2bc7054dd32a5df4eb","observation_id":"28c913c6-7489-46f3-9d79-8b430dbdfe45","resolution":{"observed_at":"2026-08-06T00:12:51.852889Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:12:51.643932Z","title":"THREATRACE: Detecting and tracing host-based threats in node level through provenance graph learning,","venue":null,"work_id":"134a38d5-beaf-4b91-9699-799558e2bb7f","year":2022},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":7,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:41.589431Z"},"links":{"citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:57be79309159a49670276056bb5525248713c214c3443d29e05db99a81a07720","observation_id":"57564db8-8b78-48af-9613-782fb9a0d7de","resolution":{"observed_at":"2026-08-06T00:12:51.729272Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"6731.37461","doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:12:45.852426Z","title":"On the reproducibility of provenance-based intrusion detection that uses deep learning,","venue":null,"work_id":"15b11678-4e12-4975-95ef-fc23a806588a","year":2025},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":8,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:41.622204Z"},"links":{"citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:3acfec3c76f4a533def6913d02244de05349633e8142d388e9a312a3922c0cd6","observation_id":"bfc4c7c5-d544-4ff6-886c-3f5ffdf1643f","resolution":{"observed_at":"2026-08-06T00:12:45.932569Z","resolver_source":"raw_fallback","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:12:51.489808Z","title":"Sometimes simpler is better: A comprehensive analysis of state-of-the-art provenance-based intrusion detection systems,","venue":null,"work_id":"54d1ec86-a77a-4d31-80a5-8e8d11138cbe","year":2025},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":9,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:41.683413Z"},"links":{"citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:3d2274b7b9651fd69de895da82878856553f7339ca8e272508495d5d0739255c","observation_id":"d583f4ce-ffed-4405-87ed-a29a8c0955f7","resolution":{"observed_at":"2026-08-06T00:12:51.557232Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:12:51.322586Z","title":"What we talk about when we talk about logs: Understanding the effects of dataset quality on endpoint threat detection research,","venue":null,"work_id":"60c26be4-f33a-4bf3-9412-513c22e665d5","year":2025},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:41.768339Z"},"links":{"citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:2354463e730ab4ebbae7ae6ca7246fb592b01d34c4f9e2024136172970661c25","observation_id":"ffa7a138-40ae-4934-b34d-aae264bdb4fe","resolution":{"observed_at":"2026-08-06T00:12:51.395012Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:12:41.816860Z","title":"On the forensic validity of approximated audit logs,","venue":null,"work_id":null,"year":2020},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":11,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:41.816860Z"},"links":{"citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:04edeac3fc2f4847dd9d2c8040f96d903b5e230c98a7f68313beff5aa9a5382d","observation_id":"68a231a9-cf9c-4a5c-840e-8881cf72fbdb","resolution":{"observed_at":"2026-08-06T00:12:41.816860Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:12:41.908831Z","title":"Shortcut learning in deep neural networks,","venue":null,"work_id":null,"year":2020},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":12,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:41.908831Z"},"links":{"citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:66b1f1c50caf5d097a65c81697312f13ee184d5b5af508d27b7f4d9766ba410a","observation_id":"31df0c72-4f68-4d0e-b267-369010e1d746","resolution":{"observed_at":"2026-08-06T00:12:41.908831Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:12:51.137691Z","title":"ORTHRUS: Achieving high quality of attribution in provenance-based intrusion detection systems,","venue":null,"work_id":"fd615367-34d0-4b47-8987-540e4b831bea","year":2025},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":13,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:41.962118Z"},"links":{"citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:707d359358058e7e78d102dc63554eb2cda6ec4187f698cfcd19fee9ac37c230","observation_id":"398fe4c0-2b44-4991-aafe-276d73b4720e","resolution":{"observed_at":"2026-08-06T00:12:51.201616Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:12:50.984976Z","title":"NoDoze: Combatting threat alert fatigue with automated provenance triage,","venue":null,"work_id":"0c27ac31-6a9c-4adb-8521-1e0368b5f760","year":2019},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":14,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:42.018467Z"},"links":{"citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:3930c378a8cb6ab38efe5d6eb1586e4f27dd10cc8d7915e7890e1118e7240ce7","observation_id":"a66f594c-388c-4de3-9a74-e21cd1251432","resolution":{"observed_at":"2026-08-06T00:12:51.060852Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:12:50.850771Z","title":"Back-Propagating system dependency impact for attack investigation,","venue":null,"work_id":"126739e6-122e-486b-9e41-9a2fdd4e3e8c","year":2022},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":15,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:42.150437Z"},"links":{"citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:d2f8e5f1dcc6607de49fb410fb6e92f6d22673a8fd36598ea85d3f7cffe709cd","observation_id":"19e194f4-3f25-4c0e-88c3-7a1c44a28dbe","resolution":{"observed_at":"2026-08-06T00:12:50.921794Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:12:50.709825Z","title":"NODLINK: An online system for fine-grained apt attack detection and investigation,","venue":null,"work_id":"00cf2584-78f3-4b1b-bed7-9ae03ca6aa59","year":2024},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":16,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:42.190903Z"},"links":{"citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:bf2b9f361bd293304ab1540cb2504b3a624b7a8af5605b2b6ddd237584e4c0ae","observation_id":"309684a1-d780-40a6-ac80-03f61b054ede","resolution":{"observed_at":"2026-08-06T00:12:50.783299Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:12:42.219769Z","title":"Dos and don’ts of machine learning in computer security,","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":17,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:42.219769Z"},"links":{"citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:61e0472825b6f72f39e06f4b96674387e00e5ace31111d7cc6d93c356f43264c","observation_id":"fa5112cd-33b8-4f85-88ea-0ce5ab7a2755","resolution":{"observed_at":"2026-08-06T00:12:42.219769Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:12:50.531719Z","title":"Transparent computing engagement 3 data release,","venue":null,"work_id":"4c235646-1801-416a-92c1-e1c2e5877b12","year":2018},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":18,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:42.261558Z"},"links":{"citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:7663eb74ad11d78ffa151bf388250d4cd825ceeb8f2fa3761b1a4bfcba60c358","observation_id":"b6e70a15-8dca-4536-bc71-b82b5e68ea24","resolution":{"observed_at":"2026-08-06T00:12:50.587011Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:12:50.376960Z","title":"REAPr: Recovery every attack process,","venue":null,"work_id":"1e8418e6-1020-4b2c-95af-b1c46b2fbf60","year":2023},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":19,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:42.344739Z"},"links":{"citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:03e244214914b6eeb6b81b9eaa69a32e86aaae715b0474397aa86253fec3b7fc","observation_id":"384d63fe-4220-43c8-b976-5998713fafec","resolution":{"observed_at":"2026-08-06T00:12:50.474000Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2401.01341","last_updated":"2023-10-03T16:46:54Z","snapshot_observed_at":"2026-08-07T09:30:25.048465Z","submitted_at":"2023-10-03T16:46:54Z","title":"ATLASv2: ATLAS Attack Engagements, Version 2","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2401.01341","snapshot_observed_at":"2026-08-06T00:12:42.400804Z","title":"ATLASv2: Atlas attack engagements, version 2,","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":20,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:42.400804Z"},"links":{"cited_paper":"/paper/2401.01341","citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:18d3f31e8de9c1e43439e5bd715ffe82bea2e096bb8f602422a2e35a60620f10","observation_id":"8082b64b-40cc-4ee0-a338-61ed37012353","resolution":{"observed_at":"2026-08-06T00:12:42.400804Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:12:50.175798Z","title":"How to effectively trace provenance on windows endpoint detection & response telemetry,","venue":null,"work_id":"66fece34-0465-45f3-9d74-971d4444e42d","year":2026},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":21,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:42.458312Z"},"links":{"citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:2796b8bf7939c705c464bfe204f54fdc056af999c46b63171023e3688849291d","observation_id":"ba49a220-ad07-4dbd-89e8-7423264bf2a5","resolution":{"observed_at":"2026-08-06T00:12:50.244315Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:12:49.983330Z","title":"SPADE: Support for provenance auditing in distributed environments,","venue":null,"work_id":"0d470a3d-dced-46d4-b967-95d9f4ea8802","year":2012},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":22,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:42.557089Z"},"links":{"citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:24c9f214806a5fe942266595fe002920fdfe05fd80efc4908497b8537226882c","observation_id":"4d9d56f6-bbcf-4e75-a50d-342b5b4e04e7","resolution":{"observed_at":"2026-08-06T00:12:50.075333Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:12:49.810376Z","title":"Practical whole-system provenance capture,","venue":null,"work_id":"04c41fb5-2eab-4613-bc8d-46929a2411d8","year":2017},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":23,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:42.606910Z"},"links":{"citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:e00303c2c4584e4e4b10d5eb14469dabcab093d54a26f684bd7aaa55d59e7a84","observation_id":"078e3ad3-9a76-42cc-ba7f-27878d15cde8","resolution":{"observed_at":"2026-08-06T00:12:49.887090Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:12:42.724756Z","title":"Trustworthy Whole- System provenance for the linux kernel,","venue":null,"work_id":null,"year":2015},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":24,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:42.724756Z"},"links":{"citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:2deeaded37eaf59e9d91607dc1ce2752387c7298a1ed2a59b2b7ca8df927fa15","observation_id":"1c389a06-d7c4-4039-9d82-197e15daa6d7","resolution":{"observed_at":"2026-08-06T00:12:42.724756Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:12:49.617207Z","title":"Loggc: garbage collecting audit log,","venue":null,"work_id":"894feef2-a68e-4a97-8bf2-3c5607919c92","year":2013},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":25,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:42.830699Z"},"links":{"citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:013d35b48ff3b17cabac863d2278d3b34a087e3ea897ace51c7511dea13a3a90","observation_id":"6e5af8c3-4017-4041-8be1-eafd7dc0a266","resolution":{"observed_at":"2026-08-06T00:12:49.714635Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:12:49.433928Z","title":"High accuracy attack provenance via binary-based execution partition,","venue":null,"work_id":"f45dc5d1-5db9-4f71-adb4-3a15a8217517","year":2013},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":26,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:42.895706Z"},"links":{"citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:0d9783f30ea30f33dd96994d0923f642b4b3d201ec854e1421dac313cffc6ead","observation_id":"5a2182e3-c245-4834-8eef-f96bde56f6a8","resolution":{"observed_at":"2026-08-06T00:12:49.523997Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:12:42.961980Z","title":"High fidelity data reduction for big data security dependency analyses,","venue":null,"work_id":null,"year":2016},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":27,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:42.961980Z"},"links":{"citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:2a7c69b242ba7721c47f5172d12c314bfb46f89b0753b44e5f051152d283aaba","observation_id":"49df516c-23f0-4e9d-b3c9-c95197c068d2","resolution":{"observed_at":"2026-08-06T00:12:42.961980Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:12:49.298128Z","title":"Towards a timely causality analysis for enterprise security,","venue":null,"work_id":"d09641ad-63d6-4645-8e83-7113fe9bb1cb","year":2018},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":28,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:43.011954Z"},"links":{"citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:2f89cb2b076a86c82dab7df33c74d6018aa12ea330abc0682ff92387939ad481","observation_id":"fa2f49b0-76b1-45e6-804e-a6b1c0886d99","resolution":{"observed_at":"2026-08-06T00:12:49.364034Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:12:49.204623Z","title":"W ATSON: Abstracting behaviors from audit logs via aggregation of contextual semantics,","venue":null,"work_id":"745fa1da-2b0f-4198-9e3a-226b808021db","year":2021},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":29,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:43.109348Z"},"links":{"citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:f14e003e54e1c18a181935382c2dc9cdf20561148a7e3344dc7abf8e04e59d27","observation_id":"8864fcf1-f417-4aea-ba39-fce16ae2497d","resolution":{"observed_at":"2026-08-06T00:12:49.247072Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:12:49.090091Z","title":"DeepLog: Anomaly detection and diagnosis from system logs through deep learning,","venue":null,"work_id":"8edcd61a-c4a2-404f-8e15-5849210a4518","year":2017},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":30,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:43.162226Z"},"links":{"citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:397abf73a227b21348188161f8f147c80b8e3b361f2b82924f5608c90680ba3b","observation_id":"2c8da824-15bc-41a8-8fdd-d3e75db6057b","resolution":{"observed_at":"2026-08-06T00:12:49.138030Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:12:43.236308Z","title":"Logbert: Log anomaly detection via bert,","venue":null,"work_id":null,"year":2021},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":31,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:43.236308Z"},"links":{"citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:55b661e03cb72d4ea5d427b4af07b3ac873a14794a9c45ac670a018e976a2d52","observation_id":"ca22fd31-f60c-4a52-8ee3-b7daa313a44d","resolution":{"observed_at":"2026-08-06T00:12:43.236308Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:12:48.981432Z","title":"Unicorn: Runtime provenance-based detector for advanced persistent threats,","venue":null,"work_id":"ee3c3b66-2c22-4b7f-876f-a550ce4c37ce","year":2020},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":32,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:43.288466Z"},"links":{"citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:0cec2cb4b2050bd8153f7816ca3e9e432e0844f1b29a163454420fb2a6564d35","observation_id":"817068f6-d3c9-4b24-9c84-8fbf1f897b22","resolution":{"observed_at":"2026-08-06T00:12:49.022650Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:12:48.841423Z","title":"You are what you do: Hunting stealthy malware via data provenance analysis,","venue":null,"work_id":"f4110aae-2439-48f6-8223-0774a5638408","year":2020},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":33,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:43.353304Z"},"links":{"citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:b508366343e0c523d5a4c428f3a3d7de4efcd9895e453cdb499b86ef9311f496","observation_id":"cbb42c45-b1e5-4c75-969d-bb37a4bf647e","resolution":{"observed_at":"2026-08-06T00:12:48.902383Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:12:48.638614Z","title":"MAGIC: Detecting advanced persistent threats via masked graph representation learning,","venue":null,"work_id":"e145fe4f-843f-4f58-966c-e959d4f61a2b","year":2024},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":34,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:43.450297Z"},"links":{"citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:1d53a57a1cf320dae2ef9c78422a5225277ac5ed65ae327e806ed1ce29cb4e84","observation_id":"c347928f-6746-4ebb-8f42-dcb10f5e98e9","resolution":{"observed_at":"2026-08-06T00:12:48.736900Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:12:48.440299Z","title":"Flash: A comprehensive approach to intrusion detection via provenance graph representation learning,","venue":null,"work_id":"6a7dd7bb-9860-450a-a75e-79d70c0611cf","year":2024},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":35,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:43.548591Z"},"links":{"citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:60e15913bf6a42eae2255dbc9ba331bc6c50d0ebb11d3574ffc8c1264e8c3cb7","observation_id":"d9de7929-3d37-499f-ad09-65429f726d7e","resolution":{"observed_at":"2026-08-06T00:12:48.530584Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:12:48.240691Z","title":"R-caid: Embedding root cause analysis within provenance-based intrusion detection,","venue":null,"work_id":"d2c1748e-b5ba-4dc2-b0f9-6dd285d91028","year":2024},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":36,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:43.623182Z"},"links":{"citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:cabe763c89aaa8ea7d3b25505ba4b3c55925bb3e10cf165c6c6a34058cb9b45f","observation_id":"518464f2-9bf4-4cc5-950e-8ad3fe6978be","resolution":{"observed_at":"2026-08-06T00:12:48.328184Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:12:43.689445Z","title":"The relationship between precision-recall and roc curves,","venue":null,"work_id":null,"year":2006},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":37,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:43.689445Z"},"links":{"citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:39849f3e6e8121830a70993ea03c2612041b244da7e7bce705fea2c11dde9b19","observation_id":"a660ef32-ceeb-4133-962d-4f96970811de","resolution":{"observed_at":"2026-08-06T00:12:43.689445Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:12:48.018932Z","title":"The precision-recall plot is more informa- tive than the ROC plot when evaluating binary classifiers on imbalanced datasets,","venue":null,"work_id":"699c972a-9b2f-4f24-b098-979fac9ffbf3","year":2015},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":38,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:43.756642Z"},"links":{"citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:e34a711e9faabde4236ab2f0bbc3cf93091c49b2475b71baf3c6650aca3c7df6","observation_id":"878e8b01-7f42-4ddd-9746-a07b099e58fa","resolution":{"observed_at":"2026-08-06T00:12:48.133903Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:12:47.791467Z","title":"The advantages of the Matthews correlation coefficient (MCC) over F1 score and accuracy in binary classification evaluation,","venue":null,"work_id":"08017bf3-9dbf-4675-98f9-d674e22cb5fe","year":2020},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":39,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:43.841500Z"},"links":{"citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:502a1bc0cd6ce49b956f4dcbde009df0355f78dbfb34f2391de8ade6a91acd4c","observation_id":"eac5dabe-bbc9-43b9-a83b-f70be375ea83","resolution":{"observed_at":"2026-08-06T00:12:47.912820Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:12:47.556498Z","title":"TESSERACT: Eliminating experimental bias in malware classification across space and time (extended version),","venue":null,"work_id":"5b13f47d-b5e2-4291-b640-00a983790262","year":null},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":40,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:43.943587Z"},"links":{"citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:f30fd534f2946bb9df0362e3a9a490e9fdc3cc4a24991fc7e29e6d46dc302d44","observation_id":"9c6f43c3-6e4c-471b-8fb4-4836901aa0cf","resolution":{"observed_at":"2026-08-06T00:12:47.671281Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:12:47.434775Z","title":"SoK: Pragmatic assessment of machine learning for network intrusion detection,","venue":null,"work_id":"221bf46c-8a24-47fa-9482-6022337c8777","year":2023},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":41,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:44.070227Z"},"links":{"citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:013f648e9b926920d5c3dca6f54207e35babfcc274a10be13cdfd4d685bc1ee3","observation_id":"5fcbca1c-a2d7-4a27-8582-b33706da386b","resolution":{"observed_at":"2026-08-06T00:12:47.488415Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:12:47.337472Z","title":"Reporting score distributions makes a difference: Performance study of lstm-networks for sequence tagging,","venue":null,"work_id":"1a5f0316-28a7-4c89-a75f-e82ad5c354ae","year":2017},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":42,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:44.145158Z"},"links":{"citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:63d57326c342b2ee27c5c874d73f5b2f7380d93425528b78d26e228428a752df","observation_id":"ce8503cc-bd4d-4196-8fc8-cda7aa5c144a","resolution":{"observed_at":"2026-08-06T00:12:47.372132Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:12:47.210366Z","title":"Accounting for variance in machine learning benchmarks,","venue":null,"work_id":"61341dd0-c736-4b95-88e6-3864776882d8","year":2021},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":43,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:44.217483Z"},"links":{"citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:375787ee99abf81b4c54dec3a6fb66edfda4ac968806202315ddb288f35f795a","observation_id":"d797dbc1-fe65-44e4-aa57-8ae18cb42e19","resolution":{"observed_at":"2026-08-06T00:12:47.271093Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:12:47.087736Z","title":"ATLAS: A sequence-based learning approach for attack investigation,","venue":null,"work_id":"a2536e0a-ac99-421f-8ff5-108f42de697d","year":2021},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":44,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:44.322975Z"},"links":{"citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:80ac58e55626823bf4f8f0ccfb8f2fd0023ee27de550d06d33938e1584a928d2","observation_id":"30d1f2f5-e5b3-407c-b2ac-3aa28af46cf6","resolution":{"observed_at":"2026-08-06T00:12:47.122348Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:12:46.978729Z","title":"A new hope for darpa optc,","venue":null,"work_id":"426b55a9-54e2-4bbe-ace5-5621efd3606a","year":2025},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":45,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:44.400531Z"},"links":{"citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:6bf05b1632e9c5a01cacf5bb12d4ece9dd728025e9ac92e35a1de40f0a080689","observation_id":"a5724c73-9983-40bb-bfb8-77df8c70a2d6","resolution":{"observed_at":"2026-08-06T00:12:47.023073Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:12:44.459624Z","title":"A mathematical theory of communication,","venue":null,"work_id":null,"year":1948},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":46,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:44.459624Z"},"links":{"citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:c2c27aae66c66c9e2eba1d9eeb007ca968f9b4ba4bf248fbb6b6210a57554899","observation_id":"cdae3c81-148e-4413-adc2-213d4c701500","resolution":{"observed_at":"2026-08-06T00:12:44.459624Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:12:46.841014Z","title":"Survivalism: Systematic analysis of Windows malware living- off-the-land,","venue":null,"work_id":"b78dda5a-4fd6-486b-8d40-737917fa403f","year":2021},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":47,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:44.518711Z"},"links":{"citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:156bb1912288c20e09f44d3b3f074f0bbd185d4ddfab08855c13487770ad4d7c","observation_id":"d41d2e39-d3ca-40b5-b797-9f851fe0009a","resolution":{"observed_at":"2026-08-06T00:12:46.913789Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:12:46.678187Z","title":"Self-supervised learning of graph representations for network intrusion detection,","venue":null,"work_id":"20d6e862-a6d3-4704-8124-4ff382053715","year":2025},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":48,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:44.600615Z"},"links":{"citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:73c9b6e146417e1a043574f43cce47e56ce5231aea4072477507a0c5ff882421","observation_id":"cc61a368-ea8c-416f-a613-4d0a5e386c39","resolution":{"observed_at":"2026-08-06T00:12:46.747486Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:12:46.537324Z","title":"E- GraphSAGE: A graph neural network based intrusion detection system for IoT,","venue":null,"work_id":"f45f96e7-3c07-4d2f-b2d7-381aa26592dc","year":2022},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":49,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:44.687439Z"},"links":{"citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:bd31d0b79a363adf0ec5a87fdb672a0db0cbf863daa7daeb8860e999c8a676bc","observation_id":"7fab8737-07e1-4e1b-a694-82727c9141be","resolution":{"observed_at":"2026-08-06T00:12:46.594080Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:12:44.758185Z","title":"Attention is all you need,","venue":null,"work_id":null,"year":2017},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":50,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:44.758185Z"},"links":{"citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:dd1a7a4bf12b47cad4834b7ea2094a7b105aa7d486b2309c8611529d7c8042ae","observation_id":"39fae256-bedb-426e-b059-148129e59ebb","resolution":{"observed_at":"2026-08-06T00:12:44.758185Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"1301.3781","last_updated":"2013-09-07T00:30:40Z","snapshot_observed_at":"2026-07-06T03:04:11.148340Z","submitted_at":"2013-01-16T18:24:43Z","title":"Efficient Estimation of Word Representations in Vector Space","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"1301.3781","snapshot_observed_at":"2026-08-06T00:12:44.815942Z","title":"Efficient estimation of word representations in vector space,","venue":null,"work_id":null,"year":2013},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":51,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:44.815942Z"},"links":{"cited_paper":"/paper/1301.3781","citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:ce2aa444d642f2c0eb3303995e091e5f42bf69cf39ac43060dc4c4dc9e9781fd","observation_id":"465093ae-7a6d-4c2c-b48b-4b7642618196","resolution":{"observed_at":"2026-08-06T00:12:44.815942Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:12:46.408511Z","title":"PIDSMaker: An ml framework for building provenance- based intrusion detection systems,","venue":null,"work_id":"2b1e51d5-bd9e-48e4-ae45-0e1a716b9d05","year":2025},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":52,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:44.878240Z"},"links":{"citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:62678a9aa18d78d616ab3dce5c6b3169ac46c66f4ffa0e46bb09ea35c6b44914","observation_id":"517f5e5f-8ea7-44f5-b810-f0a53eca5e9e","resolution":{"observed_at":"2026-08-06T00:12:46.454123Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:12:46.299069Z","title":"MAGIC: Official implementation,","venue":null,"work_id":"7484ac6b-09d8-4d30-b960-5706a4ab39e5","year":2024},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":53,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:44.938287Z"},"links":{"citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:e7868bbd36f9df8b71069f8fd7700cb36625fcc911d313401988e3792a9a4dee","observation_id":"c6ff909b-ad66-4dd9-b3f1-1b4b23daa5d2","resolution":{"observed_at":"2026-08-06T00:12:46.340069Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:12:44.998573Z","title":"PyTorch: An imperative style, high-performance deep learning library,","venue":null,"work_id":null,"year":2019},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":54,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:44.998573Z"},"links":{"citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:545e93f553e7e84c840a9c7d69415f4be9b914d0104d776143853a075785dd6a","observation_id":"c5d7783f-995e-4c65-94fc-d4a6b16c7930","resolution":{"observed_at":"2026-08-06T00:12:44.998573Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"1903.02428","last_updated":"2019-04-25T10:06:09Z","snapshot_observed_at":"2026-08-02T18:54:43.326912Z","submitted_at":"2019-03-06T14:50:02Z","title":"Fast Graph Representation Learning with PyTorch Geometric","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"1903.02428","snapshot_observed_at":"2026-08-06T00:12:45.066398Z","title":"Fast graph representation learning with PyTorch Geometric,","venue":null,"work_id":null,"year":2019},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":55,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:45.066398Z"},"links":{"cited_paper":"/paper/1903.02428","citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:e695e20298d445d50619f80bced9a546657c1d1a6997051ed26340f09bb8d2c0","observation_id":"7acf3fce-6595-4174-b44a-f44838b9ed54","resolution":{"observed_at":"2026-08-06T00:12:45.066398Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:12:45.133827Z","title":"Decoupled weight decay regularization,","venue":null,"work_id":null,"year":2019},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":56,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:45.133827Z"},"links":{"citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:f8aef5a22209e3d59d858351c3658a88056854b10e4a4a24c1dc7f63c9be0f40","observation_id":"e0fe0935-6403-45dc-b53e-2e69506286a3","resolution":{"observed_at":"2026-08-06T00:12:45.133827Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:12:46.137883Z","title":"Datasheets for datasets,","venue":null,"work_id":"20a09dae-ac64-4432-9ae2-76641969307a","year":2021},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":57,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:45.212720Z"},"links":{"citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:02478a3d6878204ef18df47fd92e8d438f68bff98d3ef8ebaee17f390188ff7e","observation_id":"e814970b-1a85-4f59-ad7e-52324320c762","resolution":{"observed_at":"2026-08-06T00:12:46.207367Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:12:46.028090Z","title":"The Menlo Report: Ethical principles guiding information and communication technology research,","venue":null,"work_id":"b6beb565-8f98-4ed8-960b-9e1ebb7cea72","year":2012},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":58,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:45.286712Z"},"links":{"citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:2ffdc3e3d242eada66f651a42bfa0907ee1ae128572d09185f15147e412cfd1a","observation_id":"7712aa8d-b2a5-43fc-af26-6b98f82b9b88","resolution":{"observed_at":"2026-08-06T00:12:46.080576Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:12:45.339878Z","title":"Fast memory-efficient anomaly detection in streaming heterogeneous graphs,","venue":null,"work_id":null,"year":2016},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":59,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:45.339878Z"},"links":{"citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:185eb0440a8b7aa1d2d8497d22c8450795475c1278d8e7ddb52686826452fa22","observation_id":"c8fc40f3-198a-4837-82cd-d7d1048d2491","resolution":{"observed_at":"2026-08-06T00:12:45.339878Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2402.01359","last_updated":"2025-04-09T12:32:21Z","snapshot_observed_at":"2026-07-06T17:24:16.787573Z","submitted_at":"2024-02-02T12:27:32Z","title":"TESSERACT: Eliminating Experimental Bias in Malware Classification across Space and Time (Extended Version)","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.01359","snapshot_observed_at":"2026-08-06T00:12:44.013859Z","title":"Available: https://arxiv.org/abs/2402.01359","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":2025,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:44.013859Z"},"links":{"cited_paper":"/paper/2402.01359","citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:c9284b05932a2973da2ef11a03855d48ef4319cd360a5bf3b30ae47bfb7c42c6","observation_id":"682bef6d-5863-4aa0-bdcd-db50a4b18a78","resolution":{"observed_at":"2026-08-06T00:12:44.013859Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}}],"paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","latest_version":1,"primary_category":"cs.CR","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection"},"reference_resolution":{"displayed":60,"state_counts":{"malformed_identifier":0,"metadata_mismatch":1,"parse_uncertain":0,"unresolved":16,"verified_exact":0,"verified_fuzzy":43},"total_outbound_references":60},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"thesis":"As of 8 August 2026, this Paper Citation Record lists 60 of 60 outbound references and 0 inbound Pith citation observations for arXiv:2608.01454."}