{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2024:26SAETSFGIJJ5R2ANMDE5PMWKL","short_pith_number":"pith:26SAETSF","canonical_record":{"source":{"id":"2405.02826","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2024-05-05T06:25:52Z","cross_cats_sorted":[],"title_canon_sha256":"8509f4c8df0df83836ae35b3457c87b5389baa647ebfec33e8d94142bd28a647","abstract_canon_sha256":"a486d37be182f3ec6649c811b6277a9f9c0b8c98b6d3d8a648984c669b6bce6b"},"schema_version":"1.0"},"canonical_sha256":"d7a4024e4532129ec7406b064ebd9652d9745e80fd064250863697dd79ec97e7","source":{"kind":"arxiv","id":"2405.02826","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2405.02826","created_at":"2026-07-05T08:15:54Z"},{"alias_kind":"arxiv_version","alias_value":"2405.02826v1","created_at":"2026-07-05T08:15:54Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2405.02826","created_at":"2026-07-05T08:15:54Z"},{"alias_kind":"pith_short_12","alias_value":"26SAETSFGIJJ","created_at":"2026-07-05T08:15:54Z"},{"alias_kind":"pith_short_16","alias_value":"26SAETSFGIJJ5R2A","created_at":"2026-07-05T08:15:54Z"},{"alias_kind":"pith_short_8","alias_value":"26SAETSF","created_at":"2026-07-05T08:15:54Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2024:26SAETSFGIJJ5R2ANMDE5PMWKL","target":"record","payload":{"canonical_record":{"source":{"id":"2405.02826","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2024-05-05T06:25:52Z","cross_cats_sorted":[],"title_canon_sha256":"8509f4c8df0df83836ae35b3457c87b5389baa647ebfec33e8d94142bd28a647","abstract_canon_sha256":"a486d37be182f3ec6649c811b6277a9f9c0b8c98b6d3d8a648984c669b6bce6b"},"schema_version":"1.0"},"canonical_sha256":"d7a4024e4532129ec7406b064ebd9652d9745e80fd064250863697dd79ec97e7","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T08:15:54.503999Z","signature_b64":"lJUBY0liwpIg0pnccIeinW/pVy/ykKr1uHThavCFs/an7dMzTysmT2pBh/SuwKE2oR9+t8iDIomuWUsNl1XfAg==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"d7a4024e4532129ec7406b064ebd9652d9745e80fd064250863697dd79ec97e7","last_reissued_at":"2026-07-05T08:15:54.503485Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T08:15:54.503485Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2405.02826","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T08:15:54Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"pOSp8IXW6n1kXVFSf5x8G2obFftgmK7KXojv6/1BjLxIkY/vvopPcWctFQN4bNIF8lyfTWovAkACqgPW6dtwAw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-05T02:48:47.951951Z"},"content_sha256":"ef04318a387d7a625c7bb6f95f9cba2a650a6768b6264ef6f109db5f926025f7","schema_version":"1.0","event_id":"sha256:ef04318a387d7a625c7bb6f95f9cba2a650a6768b6264ef6f109db5f926025f7"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2024:26SAETSFGIJJ5R2ANMDE5PMWKL","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Nip in the Bud: Forecasting and Interpreting Post-exploitation Attacks in Real-time through Cyber Threat Intelligence Reports","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":[],"primary_cat":"cs.CR","authors_text":"Aohan Zheng, Chunlin Xiong, Jie Ying, Mingqi Lv, Qixuan Yuan, Tiantian Zhu, Tieming Chen, Wenrui Cheng, Yan Chen","submitted_at":"2024-05-05T06:25:52Z","abstract_excerpt":"Advanced Persistent Threat (APT) attacks have caused significant damage worldwide. Various Endpoint Detection and Response (EDR) systems are deployed by enterprises to fight against potential threats. However, EDR suffers from high false positives. In order not to affect normal operations, analysts need to investigate and filter detection results before taking countermeasures, in which heavy manual labor and alarm fatigue cause analysts miss optimal response time, thereby leading to information leakage and destruction. Therefore, we propose Endpoint Forecasting and Interpreting (EFI), a real-t"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2405.02826","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2405.02826/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T08:15:54Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"bJVT0XFyCzObxhzZhrHZYfZ2tJxO9iQiPXdnwLSkdK8IqPq1RQhnWlfPWWJNLvEVt0rxDurq0C/4M1Zgnv4uDg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-05T02:48:47.952459Z"},"content_sha256":"3404104f9ea5f9030b35462a1e99dfcd96a85b2980bc3c594ec8864763be5676","schema_version":"1.0","event_id":"sha256:3404104f9ea5f9030b35462a1e99dfcd96a85b2980bc3c594ec8864763be5676"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/26SAETSFGIJJ5R2ANMDE5PMWKL/bundle.json","state_url":"https://pith.science/pith/26SAETSFGIJJ5R2ANMDE5PMWKL/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/26SAETSFGIJJ5R2ANMDE5PMWKL/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-05T02:48:47Z","links":{"resolver":"https://pith.science/pith/26SAETSFGIJJ5R2ANMDE5PMWKL","bundle":"https://pith.science/pith/26SAETSFGIJJ5R2ANMDE5PMWKL/bundle.json","state":"https://pith.science/pith/26SAETSFGIJJ5R2ANMDE5PMWKL/state.json","well_known_bundle":"https://pith.science/.well-known/pith/26SAETSFGIJJ5R2ANMDE5PMWKL/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2024:26SAETSFGIJJ5R2ANMDE5PMWKL","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"a486d37be182f3ec6649c811b6277a9f9c0b8c98b6d3d8a648984c669b6bce6b","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2024-05-05T06:25:52Z","title_canon_sha256":"8509f4c8df0df83836ae35b3457c87b5389baa647ebfec33e8d94142bd28a647"},"schema_version":"1.0","source":{"id":"2405.02826","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2405.02826","created_at":"2026-07-05T08:15:54Z"},{"alias_kind":"arxiv_version","alias_value":"2405.02826v1","created_at":"2026-07-05T08:15:54Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2405.02826","created_at":"2026-07-05T08:15:54Z"},{"alias_kind":"pith_short_12","alias_value":"26SAETSFGIJJ","created_at":"2026-07-05T08:15:54Z"},{"alias_kind":"pith_short_16","alias_value":"26SAETSFGIJJ5R2A","created_at":"2026-07-05T08:15:54Z"},{"alias_kind":"pith_short_8","alias_value":"26SAETSF","created_at":"2026-07-05T08:15:54Z"}],"graph_snapshots":[{"event_id":"sha256:3404104f9ea5f9030b35462a1e99dfcd96a85b2980bc3c594ec8864763be5676","target":"graph","created_at":"2026-07-05T08:15:54Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2405.02826/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Advanced Persistent Threat (APT) attacks have caused significant damage worldwide. Various Endpoint Detection and Response (EDR) systems are deployed by enterprises to fight against potential threats. However, EDR suffers from high false positives. In order not to affect normal operations, analysts need to investigate and filter detection results before taking countermeasures, in which heavy manual labor and alarm fatigue cause analysts miss optimal response time, thereby leading to information leakage and destruction. Therefore, we propose Endpoint Forecasting and Interpreting (EFI), a real-t","authors_text":"Aohan Zheng, Chunlin Xiong, Jie Ying, Mingqi Lv, Qixuan Yuan, Tiantian Zhu, Tieming Chen, Wenrui Cheng, Yan Chen","cross_cats":[],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2024-05-05T06:25:52Z","title":"Nip in the Bud: Forecasting and Interpreting Post-exploitation Attacks in Real-time through Cyber Threat Intelligence Reports"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2405.02826","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:ef04318a387d7a625c7bb6f95f9cba2a650a6768b6264ef6f109db5f926025f7","target":"record","created_at":"2026-07-05T08:15:54Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"a486d37be182f3ec6649c811b6277a9f9c0b8c98b6d3d8a648984c669b6bce6b","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2024-05-05T06:25:52Z","title_canon_sha256":"8509f4c8df0df83836ae35b3457c87b5389baa647ebfec33e8d94142bd28a647"},"schema_version":"1.0","source":{"id":"2405.02826","kind":"arxiv","version":1}},"canonical_sha256":"d7a4024e4532129ec7406b064ebd9652d9745e80fd064250863697dd79ec97e7","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"d7a4024e4532129ec7406b064ebd9652d9745e80fd064250863697dd79ec97e7","first_computed_at":"2026-07-05T08:15:54.503485Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T08:15:54.503485Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"lJUBY0liwpIg0pnccIeinW/pVy/ykKr1uHThavCFs/an7dMzTysmT2pBh/SuwKE2oR9+t8iDIomuWUsNl1XfAg==","signature_status":"signed_v1","signed_at":"2026-07-05T08:15:54.503999Z","signed_message":"canonical_sha256_bytes"},"source_id":"2405.02826","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:ef04318a387d7a625c7bb6f95f9cba2a650a6768b6264ef6f109db5f926025f7","sha256:3404104f9ea5f9030b35462a1e99dfcd96a85b2980bc3c594ec8864763be5676"],"state_sha256":"cd160cd3ea0ecc9c896df86ee2eacd3eb9637a490ab17d478a643c56e02be69c"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"r9ZWn2Y0JmSVB56h6jA/nrLfzj8RMURnNfHyEbT7CK9l2Wc3uKYThMEUH7gnDItC+Lx1U/QTrVg7MYZq16+mAw==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-05T02:48:47.956848Z","bundle_sha256":"1f6c60d4bc0b46e1227233228f662c0d7d1fea0d844486110595eff6392551f8"}}