{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2024:52Z6IQXSSQMTVZE4A73UHZ7TZJ","short_pith_number":"pith:52Z6IQXS","canonical_record":{"source":{"id":"2407.18832","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2024-07-26T15:51:49Z","cross_cats_sorted":[],"title_canon_sha256":"18eadf68202485a38faee6564b950a7240263cdb2f72e0e98468ad1fad194269","abstract_canon_sha256":"9562d5a9cea5c10f36432435a37e71374325446086ac504af4fbb81ecb580c37"},"schema_version":"1.0"},"canonical_sha256":"eeb3e442f294193ae49c07f743e7f3ca6ff64c389fc32587f1343dc518925c8a","source":{"kind":"arxiv","id":"2407.18832","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2407.18832","created_at":"2026-05-18T03:09:46Z"},{"alias_kind":"arxiv_version","alias_value":"2407.18832v1","created_at":"2026-05-18T03:09:46Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2407.18832","created_at":"2026-05-18T03:09:46Z"},{"alias_kind":"pith_short_12","alias_value":"52Z6IQXSSQMT","created_at":"2026-05-18T12:33:37Z"},{"alias_kind":"pith_short_16","alias_value":"52Z6IQXSSQMTVZE4","created_at":"2026-05-18T12:33:37Z"},{"alias_kind":"pith_short_8","alias_value":"52Z6IQXS","created_at":"2026-05-18T12:33:37Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2024:52Z6IQXSSQMTVZE4A73UHZ7TZJ","target":"record","payload":{"canonical_record":{"source":{"id":"2407.18832","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2024-07-26T15:51:49Z","cross_cats_sorted":[],"title_canon_sha256":"18eadf68202485a38faee6564b950a7240263cdb2f72e0e98468ad1fad194269","abstract_canon_sha256":"9562d5a9cea5c10f36432435a37e71374325446086ac504af4fbb81ecb580c37"},"schema_version":"1.0"},"canonical_sha256":"eeb3e442f294193ae49c07f743e7f3ca6ff64c389fc32587f1343dc518925c8a","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-05-18T03:09:46.751295Z","signature_b64":"Bm2zEktkifz5wQtLv4IlMjH2ZKrjzqNFyt7Vtix3KpwQxJ2HmsEePTgFTOq06c/bHWkO+Y7NLVwRqwCNS14jBA==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"eeb3e442f294193ae49c07f743e7f3ca6ff64c389fc32587f1343dc518925c8a","last_reissued_at":"2026-05-18T03:09:46.750516Z","signature_status":"signed_v1","first_computed_at":"2026-05-18T03:09:46.750516Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2407.18832","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-05-18T03:09:46Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"OoPxArK4k0nIi1ABFeAFcu3lRouLJ9zHdGAQczodsufkYlyRldiC7DxqQGJIyFWMc3leVtBpwmCXnL3YcFl/BQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-06-26T04:36:14.629635Z"},"content_sha256":"7d3d49c9b4283821e7d0e0d291ee5cde0f9e58080a39a4c4c57300f3c5ecc19f","schema_version":"1.0","event_id":"sha256:7d3d49c9b4283821e7d0e0d291ee5cde0f9e58080a39a4c4c57300f3c5ecc19f"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2024:52Z6IQXSSQMTVZE4A73UHZ7TZJ","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Accurate and Scalable Detection and Investigation of Cyber Persistence Threats","license":"http://creativecommons.org/licenses/by/4.0/","headline":"","cross_cats":[],"primary_cat":"cs.CR","authors_text":"Kaibin Bao, Mati Ur Rehman, Muhammad Shoaib, Qi Liu, Veit Hagenmeyer, Wajih Ul Hassan","submitted_at":"2024-07-26T15:51:49Z","abstract_excerpt":"In Advanced Persistent Threat (APT) attacks, achieving stealthy persistence within target systems is often crucial for an attacker's success. This persistence allows adversaries to maintain prolonged access, often evading detection mechanisms. Recognizing its pivotal role in the APT lifecycle, this paper introduces Cyber Persistence Detector (CPD), a novel system dedicated to detecting cyber persistence through provenance analytics. CPD is founded on the insight that persistent operations typically manifest in two phases: the \"persistence setup\" and the subsequent \"persistence execution\". By c"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2407.18832","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-05-18T03:09:46Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"do7jMCGCprCODnCrxoexHrBlOk7ZRLeD9Iqh7tzDGLncP+nZTgHkW4LIM4Fr8XGp1HH549O/ZFbbYGdGYsBRCA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-06-26T04:36:14.630030Z"},"content_sha256":"5511d9e3f11db6c58d39a9bd46cafc0fc5023d2f145589025103babdd5256207","schema_version":"1.0","event_id":"sha256:5511d9e3f11db6c58d39a9bd46cafc0fc5023d2f145589025103babdd5256207"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/52Z6IQXSSQMTVZE4A73UHZ7TZJ/bundle.json","state_url":"https://pith.science/pith/52Z6IQXSSQMTVZE4A73UHZ7TZJ/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/52Z6IQXSSQMTVZE4A73UHZ7TZJ/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-06-26T04:36:14Z","links":{"resolver":"https://pith.science/pith/52Z6IQXSSQMTVZE4A73UHZ7TZJ","bundle":"https://pith.science/pith/52Z6IQXSSQMTVZE4A73UHZ7TZJ/bundle.json","state":"https://pith.science/pith/52Z6IQXSSQMTVZE4A73UHZ7TZJ/state.json","well_known_bundle":"https://pith.science/.well-known/pith/52Z6IQXSSQMTVZE4A73UHZ7TZJ/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2024:52Z6IQXSSQMTVZE4A73UHZ7TZJ","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"9562d5a9cea5c10f36432435a37e71374325446086ac504af4fbb81ecb580c37","cross_cats_sorted":[],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2024-07-26T15:51:49Z","title_canon_sha256":"18eadf68202485a38faee6564b950a7240263cdb2f72e0e98468ad1fad194269"},"schema_version":"1.0","source":{"id":"2407.18832","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2407.18832","created_at":"2026-05-18T03:09:46Z"},{"alias_kind":"arxiv_version","alias_value":"2407.18832v1","created_at":"2026-05-18T03:09:46Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2407.18832","created_at":"2026-05-18T03:09:46Z"},{"alias_kind":"pith_short_12","alias_value":"52Z6IQXSSQMT","created_at":"2026-05-18T12:33:37Z"},{"alias_kind":"pith_short_16","alias_value":"52Z6IQXSSQMTVZE4","created_at":"2026-05-18T12:33:37Z"},{"alias_kind":"pith_short_8","alias_value":"52Z6IQXS","created_at":"2026-05-18T12:33:37Z"}],"graph_snapshots":[{"event_id":"sha256:5511d9e3f11db6c58d39a9bd46cafc0fc5023d2f145589025103babdd5256207","target":"graph","created_at":"2026-05-18T03:09:46Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"paper":{"abstract_excerpt":"In Advanced Persistent Threat (APT) attacks, achieving stealthy persistence within target systems is often crucial for an attacker's success. This persistence allows adversaries to maintain prolonged access, often evading detection mechanisms. Recognizing its pivotal role in the APT lifecycle, this paper introduces Cyber Persistence Detector (CPD), a novel system dedicated to detecting cyber persistence through provenance analytics. CPD is founded on the insight that persistent operations typically manifest in two phases: the \"persistence setup\" and the subsequent \"persistence execution\". By c","authors_text":"Kaibin Bao, Mati Ur Rehman, Muhammad Shoaib, Qi Liu, Veit Hagenmeyer, Wajih Ul Hassan","cross_cats":[],"headline":"","license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2024-07-26T15:51:49Z","title":"Accurate and Scalable Detection and Investigation of Cyber Persistence Threats"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2407.18832","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:7d3d49c9b4283821e7d0e0d291ee5cde0f9e58080a39a4c4c57300f3c5ecc19f","target":"record","created_at":"2026-05-18T03:09:46Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"9562d5a9cea5c10f36432435a37e71374325446086ac504af4fbb81ecb580c37","cross_cats_sorted":[],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2024-07-26T15:51:49Z","title_canon_sha256":"18eadf68202485a38faee6564b950a7240263cdb2f72e0e98468ad1fad194269"},"schema_version":"1.0","source":{"id":"2407.18832","kind":"arxiv","version":1}},"canonical_sha256":"eeb3e442f294193ae49c07f743e7f3ca6ff64c389fc32587f1343dc518925c8a","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"eeb3e442f294193ae49c07f743e7f3ca6ff64c389fc32587f1343dc518925c8a","first_computed_at":"2026-05-18T03:09:46.750516Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-05-18T03:09:46.750516Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"Bm2zEktkifz5wQtLv4IlMjH2ZKrjzqNFyt7Vtix3KpwQxJ2HmsEePTgFTOq06c/bHWkO+Y7NLVwRqwCNS14jBA==","signature_status":"signed_v1","signed_at":"2026-05-18T03:09:46.751295Z","signed_message":"canonical_sha256_bytes"},"source_id":"2407.18832","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:7d3d49c9b4283821e7d0e0d291ee5cde0f9e58080a39a4c4c57300f3c5ecc19f","sha256:5511d9e3f11db6c58d39a9bd46cafc0fc5023d2f145589025103babdd5256207"],"state_sha256":"865cac30e06e6b52684200e03b10d9d196112e9c834c7dda8df7bcf832f8ee64"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"WocWWr3P9ag68bTYDnYUWZARL0/1HFJTAgXP0zf6MYpiWXtqCrFS+BlWvtkWjENay64/LSgsVMOUJUmtaNXPBQ==","signed_message":"bundle_sha256_bytes","signed_at":"2026-06-26T04:36:14.632835Z","bundle_sha256":"96f1cf4471ff9558dccd56040e69c0971a1515e6f8cdb783cdccf0b1a200a8e8"}}