{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2025:5JGVDLAFCURF4JJYSJJQYF576S","short_pith_number":"pith:5JGVDLAF","canonical_record":{"source":{"id":"2505.06701","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2025-05-10T16:56:17Z","cross_cats_sorted":["cs.LG"],"title_canon_sha256":"fff3bc1a66b465978c29df06bc7692f40b5a33933699b154109c80dccbaf20df","abstract_canon_sha256":"663c9af533266804c7f960d83814764ac1c5f80540b982459564c2b308bc77d7"},"schema_version":"1.0"},"canonical_sha256":"ea4d51ac0515225e253892530c17bff480762af5abe99684210992fc0c0930bb","source":{"kind":"arxiv","id":"2505.06701","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2505.06701","created_at":"2026-07-05T11:01:14Z"},{"alias_kind":"arxiv_version","alias_value":"2505.06701v1","created_at":"2026-07-05T11:01:14Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2505.06701","created_at":"2026-07-05T11:01:14Z"},{"alias_kind":"pith_short_12","alias_value":"5JGVDLAFCURF","created_at":"2026-07-05T11:01:14Z"},{"alias_kind":"pith_short_16","alias_value":"5JGVDLAFCURF4JJY","created_at":"2026-07-05T11:01:14Z"},{"alias_kind":"pith_short_8","alias_value":"5JGVDLAF","created_at":"2026-07-05T11:01:14Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2025:5JGVDLAFCURF4JJYSJJQYF576S","target":"record","payload":{"canonical_record":{"source":{"id":"2505.06701","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2025-05-10T16:56:17Z","cross_cats_sorted":["cs.LG"],"title_canon_sha256":"fff3bc1a66b465978c29df06bc7692f40b5a33933699b154109c80dccbaf20df","abstract_canon_sha256":"663c9af533266804c7f960d83814764ac1c5f80540b982459564c2b308bc77d7"},"schema_version":"1.0"},"canonical_sha256":"ea4d51ac0515225e253892530c17bff480762af5abe99684210992fc0c0930bb","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T11:01:14.514815Z","signature_b64":"kH+oubWCVChoPAUX8Z9s8BlEDBRdP8T6u5UUbm4AWNWcsxFlRn5XoMnidEmxFfX46Xjlebem4tbwKdIlRFCJAA==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"ea4d51ac0515225e253892530c17bff480762af5abe99684210992fc0c0930bb","last_reissued_at":"2026-07-05T11:01:14.514326Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T11:01:14.514326Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2505.06701","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T11:01:14Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"BeMp4JGCaPZVEzVT/eVumzhFJuoTVjV4vh1/iR+EXD6jcvJujhK2xR2dzKnacj0ginxtwqsC8clgSBXcW34ZBw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-18T03:53:55.545223Z"},"content_sha256":"d02b9944be56f5748ee15d0ce6cf08daa22a256156a3d6121ad749af7b544f87","schema_version":"1.0","event_id":"sha256:d02b9944be56f5748ee15d0ce6cf08daa22a256156a3d6121ad749af7b544f87"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2025:5JGVDLAFCURF4JJYSJJQYF576S","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"RuleGenie: SIEM Detection Rule Set Optimization","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":["cs.LG"],"primary_cat":"cs.CR","authors_text":"Akansha Shukla, Asaf Shabtai, Parth Atulbhai Gandhi, Yuval Elovici","submitted_at":"2025-05-10T16:56:17Z","abstract_excerpt":"SIEM systems serve as a critical hub, employing rule-based logic to detect and respond to threats. Redundant or overlapping rules in SIEM systems lead to excessive false alerts, degrading analyst performance due to alert fatigue, and increase computational overhead and response latency for actual threats. As a result, optimizing SIEM rule sets is essential for efficient operations. Despite the importance of such optimization, research in this area is limited, with current practices relying on manual optimization methods that are both time-consuming and error-prone due to the scale and complexi"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2505.06701","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2505.06701/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T11:01:14Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"tazqqES/tqBix1mhb5UuaY0hWp8UXdbA00wOhT9V98GytiwNDHD0UpnAwfFOwyXj2IGHuC9BaXFjJq5PYpJhBg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-18T03:53:55.545834Z"},"content_sha256":"da478ed571ff7317a919b2e964f398f7487c0d69eb7753ae398ccb464b7ffcb8","schema_version":"1.0","event_id":"sha256:da478ed571ff7317a919b2e964f398f7487c0d69eb7753ae398ccb464b7ffcb8"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/5JGVDLAFCURF4JJYSJJQYF576S/bundle.json","state_url":"https://pith.science/pith/5JGVDLAFCURF4JJYSJJQYF576S/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/5JGVDLAFCURF4JJYSJJQYF576S/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-18T03:53:55Z","links":{"resolver":"https://pith.science/pith/5JGVDLAFCURF4JJYSJJQYF576S","bundle":"https://pith.science/pith/5JGVDLAFCURF4JJYSJJQYF576S/bundle.json","state":"https://pith.science/pith/5JGVDLAFCURF4JJYSJJQYF576S/state.json","well_known_bundle":"https://pith.science/.well-known/pith/5JGVDLAFCURF4JJYSJJQYF576S/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2025:5JGVDLAFCURF4JJYSJJQYF576S","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"663c9af533266804c7f960d83814764ac1c5f80540b982459564c2b308bc77d7","cross_cats_sorted":["cs.LG"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2025-05-10T16:56:17Z","title_canon_sha256":"fff3bc1a66b465978c29df06bc7692f40b5a33933699b154109c80dccbaf20df"},"schema_version":"1.0","source":{"id":"2505.06701","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2505.06701","created_at":"2026-07-05T11:01:14Z"},{"alias_kind":"arxiv_version","alias_value":"2505.06701v1","created_at":"2026-07-05T11:01:14Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2505.06701","created_at":"2026-07-05T11:01:14Z"},{"alias_kind":"pith_short_12","alias_value":"5JGVDLAFCURF","created_at":"2026-07-05T11:01:14Z"},{"alias_kind":"pith_short_16","alias_value":"5JGVDLAFCURF4JJY","created_at":"2026-07-05T11:01:14Z"},{"alias_kind":"pith_short_8","alias_value":"5JGVDLAF","created_at":"2026-07-05T11:01:14Z"}],"graph_snapshots":[{"event_id":"sha256:da478ed571ff7317a919b2e964f398f7487c0d69eb7753ae398ccb464b7ffcb8","target":"graph","created_at":"2026-07-05T11:01:14Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2505.06701/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"SIEM systems serve as a critical hub, employing rule-based logic to detect and respond to threats. Redundant or overlapping rules in SIEM systems lead to excessive false alerts, degrading analyst performance due to alert fatigue, and increase computational overhead and response latency for actual threats. As a result, optimizing SIEM rule sets is essential for efficient operations. Despite the importance of such optimization, research in this area is limited, with current practices relying on manual optimization methods that are both time-consuming and error-prone due to the scale and complexi","authors_text":"Akansha Shukla, Asaf Shabtai, Parth Atulbhai Gandhi, Yuval Elovici","cross_cats":["cs.LG"],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2025-05-10T16:56:17Z","title":"RuleGenie: SIEM Detection Rule Set Optimization"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2505.06701","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:d02b9944be56f5748ee15d0ce6cf08daa22a256156a3d6121ad749af7b544f87","target":"record","created_at":"2026-07-05T11:01:14Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"663c9af533266804c7f960d83814764ac1c5f80540b982459564c2b308bc77d7","cross_cats_sorted":["cs.LG"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2025-05-10T16:56:17Z","title_canon_sha256":"fff3bc1a66b465978c29df06bc7692f40b5a33933699b154109c80dccbaf20df"},"schema_version":"1.0","source":{"id":"2505.06701","kind":"arxiv","version":1}},"canonical_sha256":"ea4d51ac0515225e253892530c17bff480762af5abe99684210992fc0c0930bb","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"ea4d51ac0515225e253892530c17bff480762af5abe99684210992fc0c0930bb","first_computed_at":"2026-07-05T11:01:14.514326Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T11:01:14.514326Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"kH+oubWCVChoPAUX8Z9s8BlEDBRdP8T6u5UUbm4AWNWcsxFlRn5XoMnidEmxFfX46Xjlebem4tbwKdIlRFCJAA==","signature_status":"signed_v1","signed_at":"2026-07-05T11:01:14.514815Z","signed_message":"canonical_sha256_bytes"},"source_id":"2505.06701","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:d02b9944be56f5748ee15d0ce6cf08daa22a256156a3d6121ad749af7b544f87","sha256:da478ed571ff7317a919b2e964f398f7487c0d69eb7753ae398ccb464b7ffcb8"],"state_sha256":"cc46dfe67d09e00927d86f7ec47cdd9217c143ba7ab2ca2c255d8cf4be35434a"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"fmJvm7JTrteWMDg6fn/KCPDTFxrL5gEJfq1BSoiPxVxPqzfgLOVYf6gK/Q4J+4rS55kEQMWewYv34VBCRvoiBQ==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-18T03:53:55.551473Z","bundle_sha256":"39d0a70eca1b1de8d313d2cfc6f5acc3a09ce51002f8b1d5c0ac10f2889032db"}}