{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2025:4GQLPNYRMVGLZ4ID7EMDGSDRTI","short_pith_number":"pith:4GQLPNYR","canonical_record":{"source":{"id":"2509.01271","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2025-09-01T08:57:01Z","cross_cats_sorted":[],"title_canon_sha256":"b9bbb4eddb4415a3b5d0682068504aec6c702f517db7419beceeba62626be161","abstract_canon_sha256":"2c4e2130af669e7d1ac00b2d2b210d4e48b625c9c013f057be7a0d2be6ec0925"},"schema_version":"1.0"},"canonical_sha256":"e1a0b7b711654cbcf103f9183348719a314828ef1e47409fd159e7fb13c5d7d3","source":{"kind":"arxiv","id":"2509.01271","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2509.01271","created_at":"2026-07-05T12:02:57Z"},{"alias_kind":"arxiv_version","alias_value":"2509.01271v1","created_at":"2026-07-05T12:02:57Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2509.01271","created_at":"2026-07-05T12:02:57Z"},{"alias_kind":"pith_short_12","alias_value":"4GQLPNYRMVGL","created_at":"2026-07-05T12:02:57Z"},{"alias_kind":"pith_short_16","alias_value":"4GQLPNYRMVGLZ4ID","created_at":"2026-07-05T12:02:57Z"},{"alias_kind":"pith_short_8","alias_value":"4GQLPNYR","created_at":"2026-07-05T12:02:57Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2025:4GQLPNYRMVGLZ4ID7EMDGSDRTI","target":"record","payload":{"canonical_record":{"source":{"id":"2509.01271","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2025-09-01T08:57:01Z","cross_cats_sorted":[],"title_canon_sha256":"b9bbb4eddb4415a3b5d0682068504aec6c702f517db7419beceeba62626be161","abstract_canon_sha256":"2c4e2130af669e7d1ac00b2d2b210d4e48b625c9c013f057be7a0d2be6ec0925"},"schema_version":"1.0"},"canonical_sha256":"e1a0b7b711654cbcf103f9183348719a314828ef1e47409fd159e7fb13c5d7d3","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T12:02:57.307035Z","signature_b64":"5OsHdyI4LzERk7FsJkEiYG7Mt4d7YMhvukdPpLMlwyJPiPTMMvVzLyhLpkN9p9HP0gYYwiOUXwRBweIKRtiyAg==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"e1a0b7b711654cbcf103f9183348719a314828ef1e47409fd159e7fb13c5d7d3","last_reissued_at":"2026-07-05T12:02:57.306616Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T12:02:57.306616Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2509.01271","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T12:02:57Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"2wX0ewPDd50H2t8OxWFVb3/DeFCOBAkwCZXAonhz03yd+9J2dR1WPqrNOGe70shec0XRK3K9DjYiY0+0454wBg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-07-10T03:12:24.794089Z"},"content_sha256":"fe69b81436fece5e1247b84c404a05e2ff30f6da4d951c1b140620070fa867a4","schema_version":"1.0","event_id":"sha256:fe69b81436fece5e1247b84c404a05e2ff30f6da4d951c1b140620070fa867a4"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2025:4GQLPNYRMVGLZ4ID7EMDGSDRTI","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":[],"primary_cat":"cs.CR","authors_text":"Degang Sun, Peizhuo Lv, Qiujian Lv, Rujie Dai, Weiqing Huang, Xiaofeng Wang, Yan Wang, Yingjiu Li, Yuanyuan Qiao, Yujiang Gui","submitted_at":"2025-09-01T08:57:01Z","abstract_excerpt":"Advanced Persistent Threats (APTs) are prolonged, stealthy intrusions by skilled adversaries that compromise high-value systems to steal data or disrupt operations. Reconstructing complete attack chains from massive, heterogeneous logs is essential for effective attack investigation, yet existing methods suffer from poor platform generality, limited generalization to evolving tactics, and an inability to produce analyst-ready reports. Large Language Models (LLMs) offer strong semantic understanding and summarization capabilities, but in this domain they struggle to capture the long-range, cros"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2509.01271","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2509.01271/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T12:02:57Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"D4LPo/cOWkvCie8Y8RCiQDNZqBYD92lob3NgsmKrED+aupqLDMRduKSgJ8udbfQJ+CS8alY9+83e6jlEFfKaBg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-07-10T03:12:24.794483Z"},"content_sha256":"6156ff6dd0f987c71a8643655665b2e0cd5babb851242ba1dc98a4760b74f8db","schema_version":"1.0","event_id":"sha256:6156ff6dd0f987c71a8643655665b2e0cd5babb851242ba1dc98a4760b74f8db"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/4GQLPNYRMVGLZ4ID7EMDGSDRTI/bundle.json","state_url":"https://pith.science/pith/4GQLPNYRMVGLZ4ID7EMDGSDRTI/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/4GQLPNYRMVGLZ4ID7EMDGSDRTI/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-07-10T03:12:24Z","links":{"resolver":"https://pith.science/pith/4GQLPNYRMVGLZ4ID7EMDGSDRTI","bundle":"https://pith.science/pith/4GQLPNYRMVGLZ4ID7EMDGSDRTI/bundle.json","state":"https://pith.science/pith/4GQLPNYRMVGLZ4ID7EMDGSDRTI/state.json","well_known_bundle":"https://pith.science/.well-known/pith/4GQLPNYRMVGLZ4ID7EMDGSDRTI/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2025:4GQLPNYRMVGLZ4ID7EMDGSDRTI","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"2c4e2130af669e7d1ac00b2d2b210d4e48b625c9c013f057be7a0d2be6ec0925","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2025-09-01T08:57:01Z","title_canon_sha256":"b9bbb4eddb4415a3b5d0682068504aec6c702f517db7419beceeba62626be161"},"schema_version":"1.0","source":{"id":"2509.01271","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2509.01271","created_at":"2026-07-05T12:02:57Z"},{"alias_kind":"arxiv_version","alias_value":"2509.01271v1","created_at":"2026-07-05T12:02:57Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2509.01271","created_at":"2026-07-05T12:02:57Z"},{"alias_kind":"pith_short_12","alias_value":"4GQLPNYRMVGL","created_at":"2026-07-05T12:02:57Z"},{"alias_kind":"pith_short_16","alias_value":"4GQLPNYRMVGLZ4ID","created_at":"2026-07-05T12:02:57Z"},{"alias_kind":"pith_short_8","alias_value":"4GQLPNYR","created_at":"2026-07-05T12:02:57Z"}],"graph_snapshots":[{"event_id":"sha256:6156ff6dd0f987c71a8643655665b2e0cd5babb851242ba1dc98a4760b74f8db","target":"graph","created_at":"2026-07-05T12:02:57Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2509.01271/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Advanced Persistent Threats (APTs) are prolonged, stealthy intrusions by skilled adversaries that compromise high-value systems to steal data or disrupt operations. Reconstructing complete attack chains from massive, heterogeneous logs is essential for effective attack investigation, yet existing methods suffer from poor platform generality, limited generalization to evolving tactics, and an inability to produce analyst-ready reports. Large Language Models (LLMs) offer strong semantic understanding and summarization capabilities, but in this domain they struggle to capture the long-range, cros","authors_text":"Degang Sun, Peizhuo Lv, Qiujian Lv, Rujie Dai, Weiqing Huang, Xiaofeng Wang, Yan Wang, Yingjiu Li, Yuanyuan Qiao, Yujiang Gui","cross_cats":[],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2025-09-01T08:57:01Z","title":"An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2509.01271","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:fe69b81436fece5e1247b84c404a05e2ff30f6da4d951c1b140620070fa867a4","target":"record","created_at":"2026-07-05T12:02:57Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"2c4e2130af669e7d1ac00b2d2b210d4e48b625c9c013f057be7a0d2be6ec0925","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2025-09-01T08:57:01Z","title_canon_sha256":"b9bbb4eddb4415a3b5d0682068504aec6c702f517db7419beceeba62626be161"},"schema_version":"1.0","source":{"id":"2509.01271","kind":"arxiv","version":1}},"canonical_sha256":"e1a0b7b711654cbcf103f9183348719a314828ef1e47409fd159e7fb13c5d7d3","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"e1a0b7b711654cbcf103f9183348719a314828ef1e47409fd159e7fb13c5d7d3","first_computed_at":"2026-07-05T12:02:57.306616Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T12:02:57.306616Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"5OsHdyI4LzERk7FsJkEiYG7Mt4d7YMhvukdPpLMlwyJPiPTMMvVzLyhLpkN9p9HP0gYYwiOUXwRBweIKRtiyAg==","signature_status":"signed_v1","signed_at":"2026-07-05T12:02:57.307035Z","signed_message":"canonical_sha256_bytes"},"source_id":"2509.01271","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:fe69b81436fece5e1247b84c404a05e2ff30f6da4d951c1b140620070fa867a4","sha256:6156ff6dd0f987c71a8643655665b2e0cd5babb851242ba1dc98a4760b74f8db"],"state_sha256":"2da26da582f6f44f20a3d1fe250216d2afcec7ebf7b0ab08281f4380b8fdcb09"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"+s1vl8OjygbRK+EGSlIQZL97y2thmwEvsD4/8/ob8iOEl0ddToUV+OSB1Ln7KDsxyDOehso5a+YV7VLFr0D8BA==","signed_message":"bundle_sha256_bytes","signed_at":"2026-07-10T03:12:24.796371Z","bundle_sha256":"c9968dc96ffe21a71f3261b31ab9ca40a46c00a2164b011253972b5a4706c5ed"}}