{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2022:3CJENRERB5Z5N6CXDPHQNU3FSI","short_pith_number":"pith:3CJENRER","canonical_record":{"source":{"id":"2211.14642","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2022-11-26T19:03:35Z","cross_cats_sorted":[],"title_canon_sha256":"d4e4b02dd19f56ec595a674b97b6e48c12c886ef3d10870ea5571be376036b7b","abstract_canon_sha256":"4f67ee170064b31e79095cd128bcba7968b35f5d7ac335cd07c64cc32fc06408"},"schema_version":"1.0"},"canonical_sha256":"d89246c4910f73d6f8571bcf06d365920849360989ad2111adc7027fc6f09ac3","source":{"kind":"arxiv","id":"2211.14642","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2211.14642","created_at":"2026-07-05T05:19:42Z"},{"alias_kind":"arxiv_version","alias_value":"2211.14642v1","created_at":"2026-07-05T05:19:42Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2211.14642","created_at":"2026-07-05T05:19:42Z"},{"alias_kind":"pith_short_12","alias_value":"3CJENRERB5Z5","created_at":"2026-07-05T05:19:42Z"},{"alias_kind":"pith_short_16","alias_value":"3CJENRERB5Z5N6CX","created_at":"2026-07-05T05:19:42Z"},{"alias_kind":"pith_short_8","alias_value":"3CJENRER","created_at":"2026-07-05T05:19:42Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2022:3CJENRERB5Z5N6CXDPHQNU3FSI","target":"record","payload":{"canonical_record":{"source":{"id":"2211.14642","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2022-11-26T19:03:35Z","cross_cats_sorted":[],"title_canon_sha256":"d4e4b02dd19f56ec595a674b97b6e48c12c886ef3d10870ea5571be376036b7b","abstract_canon_sha256":"4f67ee170064b31e79095cd128bcba7968b35f5d7ac335cd07c64cc32fc06408"},"schema_version":"1.0"},"canonical_sha256":"d89246c4910f73d6f8571bcf06d365920849360989ad2111adc7027fc6f09ac3","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T05:19:42.090694Z","signature_b64":"LRUExDeni2+stFIMObYUVDc3FSTOx+c6BGTJaABWao5bGmmBGtkgDwCSDvgF5vgQvoRqwYBxFQoPAAyQIcMYDQ==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"d89246c4910f73d6f8571bcf06d365920849360989ad2111adc7027fc6f09ac3","last_reissued_at":"2026-07-05T05:19:42.090292Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T05:19:42.090292Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2211.14642","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T05:19:42Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"kewq7Dg+sQcmUfrdWdZ6vc+p2BZHcB1zYVIpKwgkX1IRfeYl714GH75Lt/RkV9w8hLQN4P7kvKNvv+ExOHhEAg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-07-31T18:18:38.279596Z"},"content_sha256":"c00b956f2b91bde55921af5336e27548f5c4698aee70fcd5f4b6e88a9f10ebfb","schema_version":"1.0","event_id":"sha256:c00b956f2b91bde55921af5336e27548f5c4698aee70fcd5f4b6e88a9f10ebfb"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2022:3CJENRERB5Z5N6CXDPHQNU3FSI","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"SCAPHY: Detecting Modern ICS Attacks by Correlating Behaviors in SCADA and PHYsical","license":"http://creativecommons.org/licenses/by/4.0/","headline":"","cross_cats":[],"primary_cat":"cs.CR","authors_text":"Kandy Phan, Keaton Sadoski, Moses Ike, Romuald Valme, Wenke Lee","submitted_at":"2022-11-26T19:03:35Z","abstract_excerpt":"Modern Industrial Control Systems (ICS) attacks evade existing tools by using knowledge of ICS processes to blend their activities with benign Supervisory Control and Data Acquisition (SCADA) operation, causing physical world damages. We present SCAPHY to detect ICS attacks in SCADA by leveraging the unique execution phases of SCADA to identify the limited set of legitimate behaviors to control the physical world in different phases, which differentiates from attackers activities. For example, it is typical for SCADA to setup ICS device objects during initialization, but anomalous during proce"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2211.14642","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2211.14642/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T05:19:42Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"wZVWYQzSKw3kK1XGHW38fpK6sRvUkEckASBW/e3/T/+7gbvYYo4cxmui/CHjmW/vOnDphslJiYxEfQwgJckPBg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-07-31T18:18:38.279899Z"},"content_sha256":"8e5ab19c85253b5b3c0d2778ea955be81cf9acb2c25dff11a56d17f3ffc2c1f9","schema_version":"1.0","event_id":"sha256:8e5ab19c85253b5b3c0d2778ea955be81cf9acb2c25dff11a56d17f3ffc2c1f9"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/3CJENRERB5Z5N6CXDPHQNU3FSI/bundle.json","state_url":"https://pith.science/pith/3CJENRERB5Z5N6CXDPHQNU3FSI/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/3CJENRERB5Z5N6CXDPHQNU3FSI/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-07-31T18:18:38Z","links":{"resolver":"https://pith.science/pith/3CJENRERB5Z5N6CXDPHQNU3FSI","bundle":"https://pith.science/pith/3CJENRERB5Z5N6CXDPHQNU3FSI/bundle.json","state":"https://pith.science/pith/3CJENRERB5Z5N6CXDPHQNU3FSI/state.json","well_known_bundle":"https://pith.science/.well-known/pith/3CJENRERB5Z5N6CXDPHQNU3FSI/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2022:3CJENRERB5Z5N6CXDPHQNU3FSI","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"4f67ee170064b31e79095cd128bcba7968b35f5d7ac335cd07c64cc32fc06408","cross_cats_sorted":[],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2022-11-26T19:03:35Z","title_canon_sha256":"d4e4b02dd19f56ec595a674b97b6e48c12c886ef3d10870ea5571be376036b7b"},"schema_version":"1.0","source":{"id":"2211.14642","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2211.14642","created_at":"2026-07-05T05:19:42Z"},{"alias_kind":"arxiv_version","alias_value":"2211.14642v1","created_at":"2026-07-05T05:19:42Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2211.14642","created_at":"2026-07-05T05:19:42Z"},{"alias_kind":"pith_short_12","alias_value":"3CJENRERB5Z5","created_at":"2026-07-05T05:19:42Z"},{"alias_kind":"pith_short_16","alias_value":"3CJENRERB5Z5N6CX","created_at":"2026-07-05T05:19:42Z"},{"alias_kind":"pith_short_8","alias_value":"3CJENRER","created_at":"2026-07-05T05:19:42Z"}],"graph_snapshots":[{"event_id":"sha256:8e5ab19c85253b5b3c0d2778ea955be81cf9acb2c25dff11a56d17f3ffc2c1f9","target":"graph","created_at":"2026-07-05T05:19:42Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2211.14642/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Modern Industrial Control Systems (ICS) attacks evade existing tools by using knowledge of ICS processes to blend their activities with benign Supervisory Control and Data Acquisition (SCADA) operation, causing physical world damages. We present SCAPHY to detect ICS attacks in SCADA by leveraging the unique execution phases of SCADA to identify the limited set of legitimate behaviors to control the physical world in different phases, which differentiates from attackers activities. For example, it is typical for SCADA to setup ICS device objects during initialization, but anomalous during proce","authors_text":"Kandy Phan, Keaton Sadoski, Moses Ike, Romuald Valme, Wenke Lee","cross_cats":[],"headline":"","license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2022-11-26T19:03:35Z","title":"SCAPHY: Detecting Modern ICS Attacks by Correlating Behaviors in SCADA and PHYsical"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2211.14642","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:c00b956f2b91bde55921af5336e27548f5c4698aee70fcd5f4b6e88a9f10ebfb","target":"record","created_at":"2026-07-05T05:19:42Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"4f67ee170064b31e79095cd128bcba7968b35f5d7ac335cd07c64cc32fc06408","cross_cats_sorted":[],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2022-11-26T19:03:35Z","title_canon_sha256":"d4e4b02dd19f56ec595a674b97b6e48c12c886ef3d10870ea5571be376036b7b"},"schema_version":"1.0","source":{"id":"2211.14642","kind":"arxiv","version":1}},"canonical_sha256":"d89246c4910f73d6f8571bcf06d365920849360989ad2111adc7027fc6f09ac3","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"d89246c4910f73d6f8571bcf06d365920849360989ad2111adc7027fc6f09ac3","first_computed_at":"2026-07-05T05:19:42.090292Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T05:19:42.090292Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"LRUExDeni2+stFIMObYUVDc3FSTOx+c6BGTJaABWao5bGmmBGtkgDwCSDvgF5vgQvoRqwYBxFQoPAAyQIcMYDQ==","signature_status":"signed_v1","signed_at":"2026-07-05T05:19:42.090694Z","signed_message":"canonical_sha256_bytes"},"source_id":"2211.14642","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:c00b956f2b91bde55921af5336e27548f5c4698aee70fcd5f4b6e88a9f10ebfb","sha256:8e5ab19c85253b5b3c0d2778ea955be81cf9acb2c25dff11a56d17f3ffc2c1f9"],"state_sha256":"b59e5e26f5334f1a4c18c9b84552901b369aaa9de90e2268625025db13f62f8b"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"V+1VabjT1OBAmGkDnM1gr3FPXBxJsO5oHSQpSpywQnj4oZuF+SzZJgtTl0gHWIiSQ+PWPPglN9DjKd9Cs4PMCg==","signed_message":"bundle_sha256_bytes","signed_at":"2026-07-31T18:18:38.283757Z","bundle_sha256":"41cbe1412c7dd4e2dabfe7e051a9af5686cc3500257feb4efb0e845f71140805"}}