{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2024:D545K4TC3VXCSJU3XLHM3XIE5O","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"1c99e8f3e43d75436f9113dda306af0afc69fa6ea0f16528d8ec3733af0d4d61","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2024-09-24T18:59:27Z","title_canon_sha256":"aba2c96945dbf0dbae9d72dd8c04ce1dcd5d081c00a3b677ddf8262c3a66ac89"},"schema_version":"1.0","source":{"id":"2409.16400","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2409.16400","created_at":"2026-07-05T09:11:33Z"},{"alias_kind":"arxiv_version","alias_value":"2409.16400v1","created_at":"2026-07-05T09:11:33Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2409.16400","created_at":"2026-07-05T09:11:33Z"},{"alias_kind":"pith_short_12","alias_value":"D545K4TC3VXC","created_at":"2026-07-05T09:11:33Z"},{"alias_kind":"pith_short_16","alias_value":"D545K4TC3VXCSJU3","created_at":"2026-07-05T09:11:33Z"},{"alias_kind":"pith_short_8","alias_value":"D545K4TC","created_at":"2026-07-05T09:11:33Z"}],"graph_snapshots":[{"event_id":"sha256:7cb22525f046593550de5b4aaa9ec8f3feb85827d69d200df076c7630808e4dc","target":"graph","created_at":"2026-07-05T09:11:33Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2409.16400/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"The current state of Advanced Persistent Threats (APT) attribution primarily relies on time-consuming manual processes. These include mapping incident artifacts onto threat attribution frameworks and employing expert reasoning to uncover the most likely responsible APT groups. This research aims to assist the threat analyst in the attribution process by presenting an attribution method named CAPTAIN (Comprehensive Advanced Persistent Threat AttrIbutioN). This novel APT attribution approach leverages the Tactics, Techniques, and Procedures (TTPs) employed by various APT groups in past attacks. ","authors_text":"Bikash Saha, Nanda Rani, Sandeep Kumar Shukla, Vikas Maurya","cross_cats":[],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2024-09-24T18:59:27Z","title":"Chasing the Shadows: TTPs in Action to Attribute Advanced Persistent Threats"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2409.16400","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:95332d67d3fdcdbe0ccf26178034355ceae3e3e3d5c7901a73c7c6e9ff756562","target":"record","created_at":"2026-07-05T09:11:33Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"1c99e8f3e43d75436f9113dda306af0afc69fa6ea0f16528d8ec3733af0d4d61","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2024-09-24T18:59:27Z","title_canon_sha256":"aba2c96945dbf0dbae9d72dd8c04ce1dcd5d081c00a3b677ddf8262c3a66ac89"},"schema_version":"1.0","source":{"id":"2409.16400","kind":"arxiv","version":1}},"canonical_sha256":"1f79d57262dd6e29269bbacecddd04eba03c31467bfb3de209f1791562330e95","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"1f79d57262dd6e29269bbacecddd04eba03c31467bfb3de209f1791562330e95","first_computed_at":"2026-07-05T09:11:33.085401Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T09:11:33.085401Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"uVVKdoMlXJe4moZQ4MEHpYwyPw6SyB6fvFV0ZsrfZdziaGfpI9XfwLS6hUSmf6XOZNdHM51SCRAofzyPWmk8AA==","signature_status":"signed_v1","signed_at":"2026-07-05T09:11:33.085809Z","signed_message":"canonical_sha256_bytes"},"source_id":"2409.16400","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:95332d67d3fdcdbe0ccf26178034355ceae3e3e3d5c7901a73c7c6e9ff756562","sha256:7cb22525f046593550de5b4aaa9ec8f3feb85827d69d200df076c7630808e4dc"],"state_sha256":"168d6b88c51233f5acc160d5b5c32cba7146812cb156be357089a42d34c9f790"}