Paper Citation Record · LEDGER

UNICORN: Runtime Provenance-Based Detector for Advanced Persistent Threats

As of 23 August 2026, this Paper Citation Record lists 0 of 0 outbound references and 19 inbound Pith citation observations for arXiv:2001.01525.

A citation records a reference. It does not transfer a finding from one paper to another.

pith.paper-citation-record.v1
2001.01525 v2

Coverage vector

measured 0 of 0 reference resolution

Typed states for the displayed outbound observations.

Source: paper_references, paper_reference_links

measured 19 of 19 standing notices

One-hop event checks from named stored sources.

Source: scholarly_work_events, retraction_status_cache, observed 2026-08-23T06:30:58.430688+00:00

measured 19 of 19 inbound itemization

Pith citing papers itemized under the disclosed page cap.

Source: paper_references, paper_reference_links, observed 2026-08-15T21:26:28.900445Z

measured 0 of 1 external citation measurements

A source-named dated measurement, never combined with another source.

Source: arxiv_reference, observed 2026-07-04T00:59:19.781532Z

Reference resolution

0 of 0 outbound references displayed

verified exact0
verified fuzzy0
unresolved0
parse uncertain0
malformed identifier0
metadata mismatch0

External citation measurements

No source-named external measurement is stored.

Outbound references

No outbound reference observations are available for this paper version.

Pith citing papers

Observation 3c1f6159-bbe7-4256-85e9-00f0488e9683 · inbound

Lateral Movement Detection via Time-aware Subgraph Classification on Authentication Logs cites this paper.

Lateral Movement Detection via Time-aware Subgraph Classification on Authentication Logs UNICORN: Runtime Provenance-Based Detector for Advanced Persistent Threats

Reference 7

Resolution: unresolved; no resolver link, observed 2026-08-12T19:51:05.841570Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation 147d4949-5fc2-473c-91ba-7506aa795d1d · inbound

LESS: Efficient Log Storage System Based on Learned Model and Minimum Attribute Tree cites this paper.

LESS: Efficient Log Storage System Based on Learned Model and Minimum Attribute Tree UNICORN: Runtime Provenance-Based Detector for Advanced Persistent Threats

Reference 21

Resolution: unresolved; no resolver link, observed 2026-08-12T12:40:02.859208Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation d8a2a2ad-f575-483f-98d0-af0276653407 · inbound

DEHYDRATOR: Enhancing Provenance Graph Storage via Hierarchical Encoding and Sequence Generation cites this paper.

DEHYDRATOR: Enhancing Provenance Graph Storage via Hierarchical Encoding and Sequence Generation UNICORN: Runtime Provenance-Based Detector for Advanced Persistent Threats

Reference 86

Resolution: unresolved; no resolver link, observed 2026-08-10T22:57:59.147004Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation 7e380d65-5964-4270-b7b5-d58ce0c9c275 · inbound

CONTINUUM: Detecting APT Attacks through Spatial-Temporal Graph Neural Networks cites this paper.

CONTINUUM: Detecting APT Attacks through Spatial-Temporal Graph Neural Networks UNICORN: Runtime Provenance-Based Detector for Advanced Persistent Threats

Reference 2020

Resolution: unresolved; no resolver link, observed 2026-08-10T22:03:56.877656Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation 8412b63d-9651-4f54-8baf-42d9f62bb07f · inbound

SHIELD: APT Detection and Intelligent Explanation Using LLM cites this paper.

SHIELD: APT Detection and Intelligent Explanation Using LLM UNICORN: Runtime Provenance-Based Detector for Advanced Persistent Threats

Reference 11

Resolution: unresolved; no resolver link, observed 2026-08-09T12:32:14.618870Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation 0b9b2143-adee-4a6e-b74b-f0618df4b33b · inbound

Automated Alert Classification and Triage (AACT): An Intelligent System for the Prioritisation of Cybersecurity Alerts cites this paper.

Automated Alert Classification and Triage (AACT): An Intelligent System for the Prioritisation of Cybersecurity Alerts UNICORN: Runtime Provenance-Based Detector for Advanced Persistent Threats

Reference 8

Resolution: unresolved; no resolver link, observed 2026-08-15T21:26:28.900445Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation edd38a61-420c-4184-8aa8-98a7399bf680 · inbound

Attack Effect Model based Malicious Behavior Detection cites this paper.

Attack Effect Model based Malicious Behavior Detection UNICORN: Runtime Provenance-Based Detector for Advanced Persistent Threats

Reference 19

Resolution: unresolved; no resolver link, observed 2026-08-07T10:36:24.529868Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation 4060b7be-2d21-41d2-84da-10ae75ec5c64 · inbound

No Data? No Problem: Synthesizing Security Graphs for Better Intrusion Detection cites this paper.

No Data? No Problem: Synthesizing Security Graphs for Better Intrusion Detection UNICORN: Runtime Provenance-Based Detector for Advanced Persistent Threats

Reference 21

Resolution: verified exact; arxiv_id, observed 2026-05-19T10:42:15.299355Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.

Observation 74a3cc14-fef0-4b38-964a-d0098fadd308 · inbound

From Alerts to Intelligence: A Novel LLM-Aided Framework for Host-based Intrusion Detection cites this paper.

From Alerts to Intelligence: A Novel LLM-Aided Framework for Host-based Intrusion Detection UNICORN: Runtime Provenance-Based Detector for Advanced Persistent Threats

Reference 24

Resolution: unresolved; no resolver link, observed 2026-08-06T17:29:56.676292Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation 8601ab0e-4514-46d9-a344-f5b8501e39d3 · inbound

An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models cites this paper.

An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models UNICORN: Runtime Provenance-Based Detector for Advanced Persistent Threats

Reference 29

Resolution: unresolved; no resolver link, observed 2026-08-05T12:48:07.322575Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation 84dc3c01-1093-4721-9796-18519bb88836 · inbound

The Procedural Semantics Gap in Structured CTI: A Measurement-Driven STIX Analysis for APT Emulation cites this paper.

The Procedural Semantics Gap in Structured CTI: A Measurement-Driven STIX Analysis for APT Emulation UNICORN: Runtime Provenance-Based Detector for Advanced Persistent Threats

Reference 18

Resolution: verified exact; arxiv_id, observed 2026-05-16T22:28:37.200734Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.

Observation 24618e1e-0f9e-4588-9eda-d4876be45f3e · inbound

GRASP -- Graph-Based Anomaly Detection Through Self-Supervised Classification cites this paper.

GRASP -- Graph-Based Anomaly Detection Through Self-Supervised Classification UNICORN: Runtime Provenance-Based Detector for Advanced Persistent Threats

Reference 26

Resolution: metadata mismatch; arxiv_id, observed 2026-05-11T03:05:53.284663Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.

Observation 6bfd83f7-b3fb-49e3-bba6-5a186fd1b41e · inbound

PhishSigma++: Malicious Email Detection with Typed Entity Relations cites this paper.

PhishSigma++: Malicious Email Detection with Typed Entity Relations UNICORN: Runtime Provenance-Based Detector for Advanced Persistent Threats

Reference 30

Resolution: metadata mismatch; arxiv_id, observed 2026-05-13T01:27:02.609321Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.

Observation 33583dff-4a4c-4a1f-a7f6-b45906539a4b · inbound

GenAI-Driven Threat Detection with Microsoft Security Copilot cites this paper.

GenAI-Driven Threat Detection with Microsoft Security Copilot UNICORN: Runtime Provenance-Based Detector for Advanced Persistent Threats

Reference 18

Resolution: verified exact; arxiv_id, observed 2026-05-21T04:29:34.242906Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.

Observation 510b4dd1-5ec9-4cea-bd29-ff356f11a1e4 · inbound

GenAI-Driven Threat Detection with Microsoft Security Copilot cites this paper.

GenAI-Driven Threat Detection with Microsoft Security Copilot UNICORN: Runtime Provenance-Based Detector for Advanced Persistent Threats

Reference 18

Resolution: verified exact; arxiv_id, observed 2026-05-25T06:35:25.278129Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.

Observation cf306283-de80-4687-8f8f-39d597e14cce · inbound

HunterAgent: Neuro-Symbolic Attack Trace Reconstruction under Anti-Forensics cites this paper.

HunterAgent: Neuro-Symbolic Attack Trace Reconstruction under Anti-Forensics UNICORN: Runtime Provenance-Based Detector for Advanced Persistent Threats

Reference 28

Resolution: metadata mismatch; arxiv_id, observed 2026-06-29T07:13:17.137260Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.

Observation 659526d4-ea54-4e23-9791-ed5fe884e4f5 · inbound

TGCM: Topic-Guided Consistency Modeling for One-Step Disentanglement of Interleaved APT Technique Sequences cites this paper.

TGCM: Topic-Guided Consistency Modeling for One-Step Disentanglement of Interleaved APT Technique Sequences UNICORN: Runtime Provenance-Based Detector for Advanced Persistent Threats

Reference 27

Resolution: metadata mismatch; arxiv_id, observed 2026-07-04T00:59:19.783965Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.

Observation 18b1bb7e-915e-4662-bd94-e5e51db2cc77 · inbound

TGCM: Topic-Guided Consistency Modeling for One-Step Disentanglement of Interleaved APT Technique Sequences cites this paper.

TGCM: Topic-Guided Consistency Modeling for One-Step Disentanglement of Interleaved APT Technique Sequences UNICORN: Runtime Provenance-Based Detector for Advanced Persistent Threats

Reference 27

Resolution: unresolved; no resolver link, observed 2026-08-02T11:04:28.488701Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation 39bd96c5-6d75-4480-a913-ffde30f43026 · inbound

Mutate to Bypass: Autonomous Endpoint Evasion via Knowledge-Driven Multi-Agent Orchestration cites this paper.

Mutate to Bypass: Autonomous Endpoint Evasion via Knowledge-Driven Multi-Agent Orchestration UNICORN: Runtime Provenance-Based Detector for Advanced Persistent Threats

Reference 2020

Resolution: unresolved; no resolver link, observed 2026-08-15T15:11:10.114848Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.