{"record_type":"pith_number_record","schema_url":"https://pith.science/schemas/pith-number/v1.json","pith_number":"pith:2017:AFIDQBIYOV5JQIJ3IB4ACAVBOO","short_pith_number":"pith:AFIDQBIY","schema_version":"1.0","canonical_sha256":"0150380518757a98213b40780102a173a85b404791cc6f508c808ed16126397e","source":{"kind":"arxiv","id":"1712.00557","version":1},"attestation_state":"computed","paper":{"title":"Recurrent Neural Network Language Models for Open Vocabulary Event-Level Cyber Anomaly Detection","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":["cs.CR"],"primary_cat":"cs.NE","authors_text":"Aaron Tuor, Brian Hutchinson, Nicolas Knowles, Nicole Nichols, Rob Jasper, Ryan Baerwolf","submitted_at":"2017-12-02T06:08:35Z","abstract_excerpt":"Automated analysis methods are crucial aids for monitoring and defending a network to protect the sensitive or confidential data it hosts. This work introduces a flexible, powerful, and unsupervised approach to detecting anomalous behavior in computer and network logs, one that largely eliminates domain-dependent feature engineering employed by existing methods. By treating system logs as threads of interleaved \"sentences\" (event log lines) to train online unsupervised neural network language models, our approach provides an adaptive model of normal network behavior. We compare the effectivene"},"verification_status":{"content_addressed":true,"pith_receipt":true,"author_attested":false,"weak_author_claims":0,"strong_author_claims":0,"externally_anchored":false,"storage_verified":false,"citation_signatures":0,"replication_records":0,"graph_snapshot":true,"references_resolved":false,"formal_links_present":false},"canonical_record":{"source":{"id":"1712.00557","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.NE","submitted_at":"2017-12-02T06:08:35Z","cross_cats_sorted":["cs.CR"],"title_canon_sha256":"83b2087ab1e668ac73382586818df2ec4feb3ee949dbd38c0f32cd15b32aa7bc","abstract_canon_sha256":"1f68858243e67840cc95279d2fe7ff233d15982fa80da47ac1028169e7c910c8"},"schema_version":"1.0"},"receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-05-18T00:29:04.905660Z","signature_b64":"DBcIEHgfMpzJZdyGjvcsw5GAqdwteBcvMnf7wrG98tjFOY6sC2XMfd4AvCgrq0SDSoa29HXkhR5eexgVBVf6Bg==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"0150380518757a98213b40780102a173a85b404791cc6f508c808ed16126397e","last_reissued_at":"2026-05-18T00:29:04.904907Z","signature_status":"signed_v1","first_computed_at":"2026-05-18T00:29:04.904907Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"graph_snapshot":{"paper":{"title":"Recurrent Neural Network Language Models for Open Vocabulary Event-Level Cyber Anomaly Detection","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":["cs.CR"],"primary_cat":"cs.NE","authors_text":"Aaron Tuor, Brian Hutchinson, Nicolas Knowles, Nicole Nichols, Rob Jasper, Ryan Baerwolf","submitted_at":"2017-12-02T06:08:35Z","abstract_excerpt":"Automated analysis methods are crucial aids for monitoring and defending a network to protect the sensitive or confidential data it hosts. This work introduces a flexible, powerful, and unsupervised approach to detecting anomalous behavior in computer and network logs, one that largely eliminates domain-dependent feature engineering employed by existing methods. By treating system logs as threads of interleaved \"sentences\" (event log lines) to train online unsupervised neural network language models, our approach provides an adaptive model of normal network behavior. We compare the effectivene"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"1712.00557","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"aliases":[{"alias_kind":"arxiv","alias_value":"1712.00557","created_at":"2026-05-18T00:29:04.905032+00:00"},{"alias_kind":"arxiv_version","alias_value":"1712.00557v1","created_at":"2026-05-18T00:29:04.905032+00:00"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.1712.00557","created_at":"2026-05-18T00:29:04.905032+00:00"},{"alias_kind":"pith_short_12","alias_value":"AFIDQBIYOV5J","created_at":"2026-05-18T12:31:05.417338+00:00"},{"alias_kind":"pith_short_16","alias_value":"AFIDQBIYOV5JQIJ3","created_at":"2026-05-18T12:31:05.417338+00:00"},{"alias_kind":"pith_short_8","alias_value":"AFIDQBIY","created_at":"2026-05-18T12:31:05.417338+00:00"}],"events":[],"event_summary":{},"paper_claims":[],"inbound_citations":{"count":0,"internal_anchor_count":0,"sample":[]},"formal_canon":{"evidence_count":0,"sample":[],"anchors":[]},"links":{"html":"https://pith.science/pith/AFIDQBIYOV5JQIJ3IB4ACAVBOO","json":"https://pith.science/pith/AFIDQBIYOV5JQIJ3IB4ACAVBOO.json","graph_json":"https://pith.science/api/pith-number/AFIDQBIYOV5JQIJ3IB4ACAVBOO/graph.json","events_json":"https://pith.science/api/pith-number/AFIDQBIYOV5JQIJ3IB4ACAVBOO/events.json","paper":"https://pith.science/paper/AFIDQBIY"},"agent_actions":{"view_html":"https://pith.science/pith/AFIDQBIYOV5JQIJ3IB4ACAVBOO","download_json":"https://pith.science/pith/AFIDQBIYOV5JQIJ3IB4ACAVBOO.json","view_paper":"https://pith.science/paper/AFIDQBIY","resolve_alias":"https://pith.science/api/pith-number/resolve?arxiv=1712.00557&json=true","fetch_graph":"https://pith.science/api/pith-number/AFIDQBIYOV5JQIJ3IB4ACAVBOO/graph.json","fetch_events":"https://pith.science/api/pith-number/AFIDQBIYOV5JQIJ3IB4ACAVBOO/events.json","actions":{"anchor_timestamp":"https://pith.science/pith/AFIDQBIYOV5JQIJ3IB4ACAVBOO/action/timestamp_anchor","attest_storage":"https://pith.science/pith/AFIDQBIYOV5JQIJ3IB4ACAVBOO/action/storage_attestation","attest_author":"https://pith.science/pith/AFIDQBIYOV5JQIJ3IB4ACAVBOO/action/author_attestation","sign_citation":"https://pith.science/pith/AFIDQBIYOV5JQIJ3IB4ACAVBOO/action/citation_signature","submit_replication":"https://pith.science/pith/AFIDQBIYOV5JQIJ3IB4ACAVBOO/action/replication_record"}},"created_at":"2026-05-18T00:29:04.905032+00:00","updated_at":"2026-05-18T00:29:04.905032+00:00"}