{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2025:65MOTBULO6LCS2MC42VPXLP37J","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"81dcf5ffd0293a989a561938a9d03ad611d5e0708b71cb00ea098708c9bbc218","cross_cats_sorted":[],"license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","primary_cat":"cs.CR","submitted_at":"2025-09-06T12:25:06Z","title_canon_sha256":"a09cd7b302fe1149e7dbf810dddacca395f8ee2cc66ea911c29fd990aed943a7"},"schema_version":"1.0","source":{"id":"2509.05698","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2509.05698","created_at":"2026-07-05T12:06:22Z"},{"alias_kind":"arxiv_version","alias_value":"2509.05698v1","created_at":"2026-07-05T12:06:22Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2509.05698","created_at":"2026-07-05T12:06:22Z"},{"alias_kind":"pith_short_12","alias_value":"65MOTBULO6LC","created_at":"2026-07-05T12:06:22Z"},{"alias_kind":"pith_short_16","alias_value":"65MOTBULO6LCS2MC","created_at":"2026-07-05T12:06:22Z"},{"alias_kind":"pith_short_8","alias_value":"65MOTBUL","created_at":"2026-07-05T12:06:22Z"}],"graph_snapshots":[{"event_id":"sha256:17a794487abe018effcc92414f65405eb02552a1b4da5809a9cfc9b316b05250","target":"graph","created_at":"2026-07-05T12:06:22Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2509.05698/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"High-level natural language knowledge in CTI reports, such as the ATT&CK framework, is beneficial to counter APT attacks. However, how to automatically apply the high-level knowledge in CTI reports in realistic attack detection systems, such as provenance analysis systems, is still an open problem. The challenge stems from the semantic gap between the knowledge and the low-level security logs: while the knowledge in CTI reports is written in natural language, attack detection systems can only process low-level system events like file accesses or network IP manipulations. Manual approaches can ","authors_text":"Ding Li, Jiaping Gui, Peng Jiang, Shaofei Li, Yuhan Meng","cross_cats":[],"headline":"","license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","primary_cat":"cs.CR","submitted_at":"2025-09-06T12:25:06Z","title":"KnowHow: Automatically Applying High-Level CTI Knowledge for Interpretable and Accurate Provenance Analysis"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2509.05698","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:8d583057ff4438821db6e7f29b90acaf0f2e982487147c8b245adf1b282d1178","target":"record","created_at":"2026-07-05T12:06:22Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"81dcf5ffd0293a989a561938a9d03ad611d5e0708b71cb00ea098708c9bbc218","cross_cats_sorted":[],"license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","primary_cat":"cs.CR","submitted_at":"2025-09-06T12:25:06Z","title_canon_sha256":"a09cd7b302fe1149e7dbf810dddacca395f8ee2cc66ea911c29fd990aed943a7"},"schema_version":"1.0","source":{"id":"2509.05698","kind":"arxiv","version":1}},"canonical_sha256":"f758e9868b7796296982e6aafbadfbfa4e94f820bdc67500dc228646062df675","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"f758e9868b7796296982e6aafbadfbfa4e94f820bdc67500dc228646062df675","first_computed_at":"2026-07-05T12:06:22.633131Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T12:06:22.633131Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"q7WxnmSnlmQ00IOv+n4V0uDv99k+opgoU1T+8jWs7WQu0SYT8umdUVk2TMwGB6Ah+kDrI0mFKvvdHJWkIHd2Ag==","signature_status":"signed_v1","signed_at":"2026-07-05T12:06:22.633530Z","signed_message":"canonical_sha256_bytes"},"source_id":"2509.05698","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:8d583057ff4438821db6e7f29b90acaf0f2e982487147c8b245adf1b282d1178","sha256:17a794487abe018effcc92414f65405eb02552a1b4da5809a9cfc9b316b05250"],"state_sha256":"7f75ceec37e1baddae4c742a0fb46b44018a10c42d0ba02d0cc65770ecb311c7"}