{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2017:CCX3YEOIOR2V2L4JXRONNJFMZF","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"b7c2b3f16450d06d2c74302f752c57cad497bd770ea33c7d48184ffd2339e4d6","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2017-12-20T19:04:28Z","title_canon_sha256":"32beff2d810f8ecd5d757a0152a28c0f1656ca0798f44b49bce1f5044882088a"},"schema_version":"1.0","source":{"id":"1712.07671","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"1712.07671","created_at":"2026-05-18T00:27:31Z"},{"alias_kind":"arxiv_version","alias_value":"1712.07671v1","created_at":"2026-05-18T00:27:31Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.1712.07671","created_at":"2026-05-18T00:27:31Z"},{"alias_kind":"pith_short_12","alias_value":"CCX3YEOIOR2V","created_at":"2026-05-18T12:31:10Z"},{"alias_kind":"pith_short_16","alias_value":"CCX3YEOIOR2V2L4J","created_at":"2026-05-18T12:31:10Z"},{"alias_kind":"pith_short_8","alias_value":"CCX3YEOI","created_at":"2026-05-18T12:31:10Z"}],"graph_snapshots":[{"event_id":"sha256:a5d5af1b32ec6c5efbefcd6bf1a1a7da5acd3073b3b38baac6f3afd070f53258","target":"graph","created_at":"2026-05-18T00:27:31Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"paper":{"abstract_excerpt":"A forensics investigation after a breach often uncovers network and host indicators of compromise (IOCs) that can be deployed to sensors to allow early detection of the adversary in the future. Over time, the adversary will change tactics, techniques, and procedures (TTPs), which will also change the data generated. If the IOCs are not kept up-to-date with the adversary's new TTPs, the adversary will no longer be detected once all of the IOCs become invalid. Tracking the Known (TTK) is the problem of keeping IOCs, in this case regular expressions (regexes), up-to-date with a dynamic adversary.","authors_text":"Conrad D. James, David R. Follett, James B. Aimone, Joe B. Ingram, John H. Naegle, Jonathan A. Cox, Justin E. Doak (JD), Kevin R. Dixon, Sam A. Mulder","cross_cats":[],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2017-12-20T19:04:28Z","title":"Tracking Cyber Adversaries with Adaptive Indicators of Compromise"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"1712.07671","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:4c9acb210deeab8c76defe06c5367d4fcf36bd08c08688c46e74b8f1b50e23ee","target":"record","created_at":"2026-05-18T00:27:31Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"b7c2b3f16450d06d2c74302f752c57cad497bd770ea33c7d48184ffd2339e4d6","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2017-12-20T19:04:28Z","title_canon_sha256":"32beff2d810f8ecd5d757a0152a28c0f1656ca0798f44b49bce1f5044882088a"},"schema_version":"1.0","source":{"id":"1712.07671","kind":"arxiv","version":1}},"canonical_sha256":"10afbc11c874755d2f89bc5cd6a4acc95cbf60e707e57efad92e51f33e8202a6","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"10afbc11c874755d2f89bc5cd6a4acc95cbf60e707e57efad92e51f33e8202a6","first_computed_at":"2026-05-18T00:27:31.277754Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-05-18T00:27:31.277754Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"p/FGF0GMxbb3RS7pGdBS0au+U7BnIx17SADXPhP39S5Pt5lcVhSOpmuVWKC967n2bsB/4FywmAO+oghuTs3gDg==","signature_status":"signed_v1","signed_at":"2026-05-18T00:27:31.278449Z","signed_message":"canonical_sha256_bytes"},"source_id":"1712.07671","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:4c9acb210deeab8c76defe06c5367d4fcf36bd08c08688c46e74b8f1b50e23ee","sha256:a5d5af1b32ec6c5efbefcd6bf1a1a7da5acd3073b3b38baac6f3afd070f53258"],"state_sha256":"d85ed14d8487bc21bf29038583990f94ca0e35bd5b979a9d5772ba4e4fd01f6d"}