{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2023:CERW5O7FGAWCLVJUSFDDVJ2YAI","short_pith_number":"pith:CERW5O7F","canonical_record":{"source":{"id":"2308.05034","kind":"arxiv","version":3},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2023-08-09T16:04:55Z","cross_cats_sorted":["cs.LG"],"title_canon_sha256":"7a357825f2ad0a9fb2ec6816b65cb54be8a9ade91540b1e54b00058ebf6f4b79","abstract_canon_sha256":"e40d1349dffa8deecd89b47fa0626c09839a788da0834385c2f0e7ebfa1c8848"},"schema_version":"1.0"},"canonical_sha256":"11236ebbe5302c25d53491463aa7580215e5536df1de1551bd60a41010a304a6","source":{"kind":"arxiv","id":"2308.05034","version":3},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2308.05034","created_at":"2026-07-05T06:55:05Z"},{"alias_kind":"arxiv_version","alias_value":"2308.05034v3","created_at":"2026-07-05T06:55:05Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2308.05034","created_at":"2026-07-05T06:55:05Z"},{"alias_kind":"pith_short_12","alias_value":"CERW5O7FGAWC","created_at":"2026-07-05T06:55:05Z"},{"alias_kind":"pith_short_16","alias_value":"CERW5O7FGAWCLVJU","created_at":"2026-07-05T06:55:05Z"},{"alias_kind":"pith_short_8","alias_value":"CERW5O7F","created_at":"2026-07-05T06:55:05Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2023:CERW5O7FGAWCLVJUSFDDVJ2YAI","target":"record","payload":{"canonical_record":{"source":{"id":"2308.05034","kind":"arxiv","version":3},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2023-08-09T16:04:55Z","cross_cats_sorted":["cs.LG"],"title_canon_sha256":"7a357825f2ad0a9fb2ec6816b65cb54be8a9ade91540b1e54b00058ebf6f4b79","abstract_canon_sha256":"e40d1349dffa8deecd89b47fa0626c09839a788da0834385c2f0e7ebfa1c8848"},"schema_version":"1.0"},"canonical_sha256":"11236ebbe5302c25d53491463aa7580215e5536df1de1551bd60a41010a304a6","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T06:55:05.315043Z","signature_b64":"07e8ZBIGaHZtKQNdxXW/ElyIId3WNhxFfm2EzW37cteSKGzH87SBtUeVLf+wGdc7yQUIzRVF1aWreqfi94reAg==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"11236ebbe5302c25d53491463aa7580215e5536df1de1551bd60a41010a304a6","last_reissued_at":"2026-07-05T06:55:05.314510Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T06:55:05.314510Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2308.05034","source_version":3,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T06:55:05Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"G1X4y9LWw9PlTSl81iYlWl6VlZfGMeDVVjKDVj7Z8N0pgjTp3P0MelrwCmNcZQuHNMNXU4HKDlhZLbJ/BBKzBw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-07-12T00:52:38.282918Z"},"content_sha256":"311e9670f649e889eca3c4cfff78386576bc1ccedb9e8766b15e67341244221f","schema_version":"1.0","event_id":"sha256:311e9670f649e889eca3c4cfff78386576bc1ccedb9e8766b15e67341244221f"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2023:CERW5O7FGAWCLVJUSFDDVJ2YAI","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Kairos: Practical Intrusion Detection and Investigation using Whole-system Provenance","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":["cs.LG"],"primary_cat":"cs.CR","authors_text":"Degang Sun, Jinyuan Liang, Qiujian Lv, Thomas Pasquier, Xueyuan Han, Yan Wang, Zijun Cheng","submitted_at":"2023-08-09T16:04:55Z","abstract_excerpt":"Provenance graphs are structured audit logs that describe the history of a system's execution. Recent studies have explored a variety of techniques to analyze provenance graphs for automated host intrusion detection, focusing particularly on advanced persistent threats. Sifting through their design documents, we identify four common dimensions that drive the development of provenance-based intrusion detection systems (PIDSes): scope (can PIDSes detect modern attacks that infiltrate across application boundaries?), attack agnosticity (can PIDSes detect novel attacks without a priori knowledge o"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2308.05034","kind":"arxiv","version":3},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2308.05034/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T06:55:05Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"Kp9zmS56TqXZ2Sgrbu/z1idsT0qmWpptAYkuaPc+DRonGEabWV7H8oCDHOoBrjoalvCDzSPbFBIhJaHaqWOSCA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-07-12T00:52:38.283574Z"},"content_sha256":"9cf0e9caecfe42d724b659a085e2f934220565878783decac775056f62d147d9","schema_version":"1.0","event_id":"sha256:9cf0e9caecfe42d724b659a085e2f934220565878783decac775056f62d147d9"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/CERW5O7FGAWCLVJUSFDDVJ2YAI/bundle.json","state_url":"https://pith.science/pith/CERW5O7FGAWCLVJUSFDDVJ2YAI/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/CERW5O7FGAWCLVJUSFDDVJ2YAI/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-07-12T00:52:38Z","links":{"resolver":"https://pith.science/pith/CERW5O7FGAWCLVJUSFDDVJ2YAI","bundle":"https://pith.science/pith/CERW5O7FGAWCLVJUSFDDVJ2YAI/bundle.json","state":"https://pith.science/pith/CERW5O7FGAWCLVJUSFDDVJ2YAI/state.json","well_known_bundle":"https://pith.science/.well-known/pith/CERW5O7FGAWCLVJUSFDDVJ2YAI/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2023:CERW5O7FGAWCLVJUSFDDVJ2YAI","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"e40d1349dffa8deecd89b47fa0626c09839a788da0834385c2f0e7ebfa1c8848","cross_cats_sorted":["cs.LG"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2023-08-09T16:04:55Z","title_canon_sha256":"7a357825f2ad0a9fb2ec6816b65cb54be8a9ade91540b1e54b00058ebf6f4b79"},"schema_version":"1.0","source":{"id":"2308.05034","kind":"arxiv","version":3}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2308.05034","created_at":"2026-07-05T06:55:05Z"},{"alias_kind":"arxiv_version","alias_value":"2308.05034v3","created_at":"2026-07-05T06:55:05Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2308.05034","created_at":"2026-07-05T06:55:05Z"},{"alias_kind":"pith_short_12","alias_value":"CERW5O7FGAWC","created_at":"2026-07-05T06:55:05Z"},{"alias_kind":"pith_short_16","alias_value":"CERW5O7FGAWCLVJU","created_at":"2026-07-05T06:55:05Z"},{"alias_kind":"pith_short_8","alias_value":"CERW5O7F","created_at":"2026-07-05T06:55:05Z"}],"graph_snapshots":[{"event_id":"sha256:9cf0e9caecfe42d724b659a085e2f934220565878783decac775056f62d147d9","target":"graph","created_at":"2026-07-05T06:55:05Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2308.05034/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Provenance graphs are structured audit logs that describe the history of a system's execution. Recent studies have explored a variety of techniques to analyze provenance graphs for automated host intrusion detection, focusing particularly on advanced persistent threats. Sifting through their design documents, we identify four common dimensions that drive the development of provenance-based intrusion detection systems (PIDSes): scope (can PIDSes detect modern attacks that infiltrate across application boundaries?), attack agnosticity (can PIDSes detect novel attacks without a priori knowledge o","authors_text":"Degang Sun, Jinyuan Liang, Qiujian Lv, Thomas Pasquier, Xueyuan Han, Yan Wang, Zijun Cheng","cross_cats":["cs.LG"],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2023-08-09T16:04:55Z","title":"Kairos: Practical Intrusion Detection and Investigation using Whole-system Provenance"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2308.05034","kind":"arxiv","version":3},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:311e9670f649e889eca3c4cfff78386576bc1ccedb9e8766b15e67341244221f","target":"record","created_at":"2026-07-05T06:55:05Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"e40d1349dffa8deecd89b47fa0626c09839a788da0834385c2f0e7ebfa1c8848","cross_cats_sorted":["cs.LG"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2023-08-09T16:04:55Z","title_canon_sha256":"7a357825f2ad0a9fb2ec6816b65cb54be8a9ade91540b1e54b00058ebf6f4b79"},"schema_version":"1.0","source":{"id":"2308.05034","kind":"arxiv","version":3}},"canonical_sha256":"11236ebbe5302c25d53491463aa7580215e5536df1de1551bd60a41010a304a6","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"11236ebbe5302c25d53491463aa7580215e5536df1de1551bd60a41010a304a6","first_computed_at":"2026-07-05T06:55:05.314510Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T06:55:05.314510Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"07e8ZBIGaHZtKQNdxXW/ElyIId3WNhxFfm2EzW37cteSKGzH87SBtUeVLf+wGdc7yQUIzRVF1aWreqfi94reAg==","signature_status":"signed_v1","signed_at":"2026-07-05T06:55:05.315043Z","signed_message":"canonical_sha256_bytes"},"source_id":"2308.05034","source_kind":"arxiv","source_version":3}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:311e9670f649e889eca3c4cfff78386576bc1ccedb9e8766b15e67341244221f","sha256:9cf0e9caecfe42d724b659a085e2f934220565878783decac775056f62d147d9"],"state_sha256":"19c934d014d82fceaf7eb254a308960d3c35fca4a5588175349f600838361d6f"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"pTil6aj0UlGfL8Doem9V8JxhQJ7ChW32IPDviSQGyGY9mHamQsoEKVeNYvWGcZpnoF/Er4xUCfJAHarfiJlsDA==","signed_message":"bundle_sha256_bytes","signed_at":"2026-07-12T00:52:38.287459Z","bundle_sha256":"6daf51f81ef6bb2ac4b30d0d568db0f72e67c394e78f81dd55a28bb6f554ae15"}}