{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2019:BJ42INKV5WIPGXNUTHYADIHN7Q","short_pith_number":"pith:BJ42INKV","canonical_record":{"source":{"id":"1908.04856","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2019-08-13T20:59:33Z","cross_cats_sorted":[],"title_canon_sha256":"c09589165cf7ce09e3f5f0750caffba569e6212d9fb0765c73d8f15915d7d730","abstract_canon_sha256":"a911fc22eb613a91473270637ed5adf4f1bf34538903e8cad3a918f18eeed970"},"schema_version":"1.0"},"canonical_sha256":"0a79a43555ed90f35db499f001a0edfc244758f02825881a1b2c8032f8e7b8f0","source":{"kind":"arxiv","id":"1908.04856","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"1908.04856","created_at":"2026-07-04T23:55:57Z"},{"alias_kind":"arxiv_version","alias_value":"1908.04856v1","created_at":"2026-07-04T23:55:57Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.1908.04856","created_at":"2026-07-04T23:55:57Z"},{"alias_kind":"pith_short_12","alias_value":"BJ42INKV5WIP","created_at":"2026-07-04T23:55:57Z"},{"alias_kind":"pith_short_16","alias_value":"BJ42INKV5WIPGXNU","created_at":"2026-07-04T23:55:57Z"},{"alias_kind":"pith_short_8","alias_value":"BJ42INKV","created_at":"2026-07-04T23:55:57Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2019:BJ42INKV5WIPGXNUTHYADIHN7Q","target":"record","payload":{"canonical_record":{"source":{"id":"1908.04856","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2019-08-13T20:59:33Z","cross_cats_sorted":[],"title_canon_sha256":"c09589165cf7ce09e3f5f0750caffba569e6212d9fb0765c73d8f15915d7d730","abstract_canon_sha256":"a911fc22eb613a91473270637ed5adf4f1bf34538903e8cad3a918f18eeed970"},"schema_version":"1.0"},"canonical_sha256":"0a79a43555ed90f35db499f001a0edfc244758f02825881a1b2c8032f8e7b8f0","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-04T23:55:57.528658Z","signature_b64":"aWY65V/JzZc56NBbnk8dKkbz3tkxpafCeIyg7NMIZtjp+YsXIQHhlRJWot3+8DRvS34Da0Uo0daVUjivWh4YCQ==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"0a79a43555ed90f35db499f001a0edfc244758f02825881a1b2c8032f8e7b8f0","last_reissued_at":"2026-07-04T23:55:57.528227Z","signature_status":"signed_v1","first_computed_at":"2026-07-04T23:55:57.528227Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"1908.04856","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-04T23:55:57Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"fgj2pd8+6KfAFHoLzedp4VYyZ6PJ7je36BifGL4G1zzbNwUN1BZSOAPD4Mw/yzV3muTmyCV5eWCxLxE+bYD4Aw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-12T17:00:37.539417Z"},"content_sha256":"8831d6c03f6a5382b428588cec16b93d92d658879f7a1bdaebebc216378d59d0","schema_version":"1.0","event_id":"sha256:8831d6c03f6a5382b428588cec16b93d92d658879f7a1bdaebebc216378d59d0"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2019:BJ42INKV5WIPGXNUTHYADIHN7Q","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Exploit Prediction Scoring System (EPSS)","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":[],"primary_cat":"cs.CR","authors_text":"Benjamin Edwards, Idris Adjerid, Jay Jacobs, Michael Roytman, Sasha Romanosky","submitted_at":"2019-08-13T20:59:33Z","abstract_excerpt":"Despite the massive investments in information security technologies and research over the past decades, the information security industry is still immature. In particular, the prioritization of remediation efforts within vulnerability management programs predominantly relies on a mixture of subjective expert opinion, severity scores, and incomplete data. Compounding the need for prioritization is the increase in the number of vulnerabilities the average enterprise has to remediate. This paper produces the first open, data-driven framework for assessing vulnerability threat, that is, the proba"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"1908.04856","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/1908.04856/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-04T23:55:57Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"/8fz+5nr/FidAGhUtVezUY3rFMz7m7TzsV2l2UAqgeFlqa84ejcNQP6/7gWDQ3NRINz3d64Ny6jLDqxjcZFPCg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-12T17:00:37.540000Z"},"content_sha256":"c13b93c39b9eae8e74c89e797d6bdfa48c326fe146b7fee74ea6bd24fe3ea065","schema_version":"1.0","event_id":"sha256:c13b93c39b9eae8e74c89e797d6bdfa48c326fe146b7fee74ea6bd24fe3ea065"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/BJ42INKV5WIPGXNUTHYADIHN7Q/bundle.json","state_url":"https://pith.science/pith/BJ42INKV5WIPGXNUTHYADIHN7Q/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/BJ42INKV5WIPGXNUTHYADIHN7Q/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-12T17:00:37Z","links":{"resolver":"https://pith.science/pith/BJ42INKV5WIPGXNUTHYADIHN7Q","bundle":"https://pith.science/pith/BJ42INKV5WIPGXNUTHYADIHN7Q/bundle.json","state":"https://pith.science/pith/BJ42INKV5WIPGXNUTHYADIHN7Q/state.json","well_known_bundle":"https://pith.science/.well-known/pith/BJ42INKV5WIPGXNUTHYADIHN7Q/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2019:BJ42INKV5WIPGXNUTHYADIHN7Q","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"a911fc22eb613a91473270637ed5adf4f1bf34538903e8cad3a918f18eeed970","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2019-08-13T20:59:33Z","title_canon_sha256":"c09589165cf7ce09e3f5f0750caffba569e6212d9fb0765c73d8f15915d7d730"},"schema_version":"1.0","source":{"id":"1908.04856","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"1908.04856","created_at":"2026-07-04T23:55:57Z"},{"alias_kind":"arxiv_version","alias_value":"1908.04856v1","created_at":"2026-07-04T23:55:57Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.1908.04856","created_at":"2026-07-04T23:55:57Z"},{"alias_kind":"pith_short_12","alias_value":"BJ42INKV5WIP","created_at":"2026-07-04T23:55:57Z"},{"alias_kind":"pith_short_16","alias_value":"BJ42INKV5WIPGXNU","created_at":"2026-07-04T23:55:57Z"},{"alias_kind":"pith_short_8","alias_value":"BJ42INKV","created_at":"2026-07-04T23:55:57Z"}],"graph_snapshots":[{"event_id":"sha256:c13b93c39b9eae8e74c89e797d6bdfa48c326fe146b7fee74ea6bd24fe3ea065","target":"graph","created_at":"2026-07-04T23:55:57Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/1908.04856/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Despite the massive investments in information security technologies and research over the past decades, the information security industry is still immature. In particular, the prioritization of remediation efforts within vulnerability management programs predominantly relies on a mixture of subjective expert opinion, severity scores, and incomplete data. Compounding the need for prioritization is the increase in the number of vulnerabilities the average enterprise has to remediate. This paper produces the first open, data-driven framework for assessing vulnerability threat, that is, the proba","authors_text":"Benjamin Edwards, Idris Adjerid, Jay Jacobs, Michael Roytman, Sasha Romanosky","cross_cats":[],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2019-08-13T20:59:33Z","title":"Exploit Prediction Scoring System (EPSS)"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"1908.04856","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:8831d6c03f6a5382b428588cec16b93d92d658879f7a1bdaebebc216378d59d0","target":"record","created_at":"2026-07-04T23:55:57Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"a911fc22eb613a91473270637ed5adf4f1bf34538903e8cad3a918f18eeed970","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2019-08-13T20:59:33Z","title_canon_sha256":"c09589165cf7ce09e3f5f0750caffba569e6212d9fb0765c73d8f15915d7d730"},"schema_version":"1.0","source":{"id":"1908.04856","kind":"arxiv","version":1}},"canonical_sha256":"0a79a43555ed90f35db499f001a0edfc244758f02825881a1b2c8032f8e7b8f0","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"0a79a43555ed90f35db499f001a0edfc244758f02825881a1b2c8032f8e7b8f0","first_computed_at":"2026-07-04T23:55:57.528227Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-04T23:55:57.528227Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"aWY65V/JzZc56NBbnk8dKkbz3tkxpafCeIyg7NMIZtjp+YsXIQHhlRJWot3+8DRvS34Da0Uo0daVUjivWh4YCQ==","signature_status":"signed_v1","signed_at":"2026-07-04T23:55:57.528658Z","signed_message":"canonical_sha256_bytes"},"source_id":"1908.04856","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:8831d6c03f6a5382b428588cec16b93d92d658879f7a1bdaebebc216378d59d0","sha256:c13b93c39b9eae8e74c89e797d6bdfa48c326fe146b7fee74ea6bd24fe3ea065"],"state_sha256":"4e88cb021f673b098b4359d79cd2665c9dfb3d1ab7eae00b2acb630ff72cba4e"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"uLxDMY0x2+OFtxcJ5gx1sM4xtCr1TXKd67TE+nqN+HgDfMfHb3IixefGRYN4OuuBCYoYHjWNP7O9uWjk2KH6Bw==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-12T17:00:37.544949Z","bundle_sha256":"ed1dba2a285e01295f04aa327507ac2909b5e7773549304ab4440ad12b725e49"}}