{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2023:DFBMAVYIQZ4TOG7CHEJZV5LMQA","short_pith_number":"pith:DFBMAVYI","canonical_record":{"source":{"id":"2309.00700","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","primary_cat":"cs.CR","submitted_at":"2023-09-01T18:46:00Z","cross_cats_sorted":[],"title_canon_sha256":"61e6655a50ef6f45cb897551b75fb8d5f3a2c1e41731239b8f90ef6fabf43beb","abstract_canon_sha256":"9cfeabfa25347e60655adf259e8d2562062803cd1497bf6a1f8363fae84ca6f9"},"schema_version":"1.0"},"canonical_sha256":"1942c057088679371be239139af56c80061c1f215bbe4de6fd0ef8dc56a1c087","source":{"kind":"arxiv","id":"2309.00700","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2309.00700","created_at":"2026-07-05T06:47:05Z"},{"alias_kind":"arxiv_version","alias_value":"2309.00700v1","created_at":"2026-07-05T06:47:05Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2309.00700","created_at":"2026-07-05T06:47:05Z"},{"alias_kind":"pith_short_12","alias_value":"DFBMAVYIQZ4T","created_at":"2026-07-05T06:47:05Z"},{"alias_kind":"pith_short_16","alias_value":"DFBMAVYIQZ4TOG7C","created_at":"2026-07-05T06:47:05Z"},{"alias_kind":"pith_short_8","alias_value":"DFBMAVYI","created_at":"2026-07-05T06:47:05Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2023:DFBMAVYIQZ4TOG7CHEJZV5LMQA","target":"record","payload":{"canonical_record":{"source":{"id":"2309.00700","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","primary_cat":"cs.CR","submitted_at":"2023-09-01T18:46:00Z","cross_cats_sorted":[],"title_canon_sha256":"61e6655a50ef6f45cb897551b75fb8d5f3a2c1e41731239b8f90ef6fabf43beb","abstract_canon_sha256":"9cfeabfa25347e60655adf259e8d2562062803cd1497bf6a1f8363fae84ca6f9"},"schema_version":"1.0"},"canonical_sha256":"1942c057088679371be239139af56c80061c1f215bbe4de6fd0ef8dc56a1c087","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T06:47:05.723514Z","signature_b64":"KIDnTCthgyMA6B+8wDnjmCwa6wxLA+VIoC4fzVL0wPNzGXM+IcUObVeg1r0r3O30NFGkh0p8JaDXausqAzzsBQ==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"1942c057088679371be239139af56c80061c1f215bbe4de6fd0ef8dc56a1c087","last_reissued_at":"2026-07-05T06:47:05.723010Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T06:47:05.723010Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2309.00700","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T06:47:05Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"pLqNOKeczyey5fYjKBmNZarqph+6o5QVjBmt4BmCdn7MmP4hK085NiOWCZD34sHrGMMMQRB2TgAhTluO9FHaCg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-07-31T23:22:56.067930Z"},"content_sha256":"d5d5537681652d3c7b6323aa6485bd7fb843d11582e8f8a75ff5e9e6aa577e23","schema_version":"1.0","event_id":"sha256:d5d5537681652d3c7b6323aa6485bd7fb843d11582e8f8a75ff5e9e6aa577e23"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2023:DFBMAVYIQZ4TOG7CHEJZV5LMQA","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Cross-temporal Detection of Novel Ransomware Campaigns: A Multi-Modal Alert Approach","license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","headline":"","cross_cats":[],"primary_cat":"cs.CR","authors_text":"Abdul Rahman, Cheng Wang, Christopher Redino, Dhruv Nandakumar, Edward Bowen, Prabhat Kumar Kushwaha, Sathvik Murli, Shalini Israni, Tarun Singh","submitted_at":"2023-09-01T18:46:00Z","abstract_excerpt":"We present a novel approach to identify ransomware campaigns derived from attack timelines representations within victim networks. Malicious activity profiles developed from multiple alert sources support the construction of alert graphs. This approach enables an effective and scalable representation of the attack timelines where individual nodes represent malicious activity detections with connections describing the potential attack paths. This work demonstrates adaptability to different attack patterns through implementing a novel method for parsing and classifying alert graphs while maintai"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2309.00700","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2309.00700/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T06:47:05Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"gdAf9KDxIEYyOW698HLV6eRjjTkftZr5+JIdNRrcpcYjAxT71uwZ/Ge7uxz2xyeNtB6DVHYJSMfSzcSuqQ1uDA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-07-31T23:22:56.068364Z"},"content_sha256":"17a1dc72664bb3de996e3039de2e21a0d8a2997f5981fd8f643180a5ccf868fa","schema_version":"1.0","event_id":"sha256:17a1dc72664bb3de996e3039de2e21a0d8a2997f5981fd8f643180a5ccf868fa"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/DFBMAVYIQZ4TOG7CHEJZV5LMQA/bundle.json","state_url":"https://pith.science/pith/DFBMAVYIQZ4TOG7CHEJZV5LMQA/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/DFBMAVYIQZ4TOG7CHEJZV5LMQA/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-07-31T23:22:56Z","links":{"resolver":"https://pith.science/pith/DFBMAVYIQZ4TOG7CHEJZV5LMQA","bundle":"https://pith.science/pith/DFBMAVYIQZ4TOG7CHEJZV5LMQA/bundle.json","state":"https://pith.science/pith/DFBMAVYIQZ4TOG7CHEJZV5LMQA/state.json","well_known_bundle":"https://pith.science/.well-known/pith/DFBMAVYIQZ4TOG7CHEJZV5LMQA/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2023:DFBMAVYIQZ4TOG7CHEJZV5LMQA","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"9cfeabfa25347e60655adf259e8d2562062803cd1497bf6a1f8363fae84ca6f9","cross_cats_sorted":[],"license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","primary_cat":"cs.CR","submitted_at":"2023-09-01T18:46:00Z","title_canon_sha256":"61e6655a50ef6f45cb897551b75fb8d5f3a2c1e41731239b8f90ef6fabf43beb"},"schema_version":"1.0","source":{"id":"2309.00700","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2309.00700","created_at":"2026-07-05T06:47:05Z"},{"alias_kind":"arxiv_version","alias_value":"2309.00700v1","created_at":"2026-07-05T06:47:05Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2309.00700","created_at":"2026-07-05T06:47:05Z"},{"alias_kind":"pith_short_12","alias_value":"DFBMAVYIQZ4T","created_at":"2026-07-05T06:47:05Z"},{"alias_kind":"pith_short_16","alias_value":"DFBMAVYIQZ4TOG7C","created_at":"2026-07-05T06:47:05Z"},{"alias_kind":"pith_short_8","alias_value":"DFBMAVYI","created_at":"2026-07-05T06:47:05Z"}],"graph_snapshots":[{"event_id":"sha256:17a1dc72664bb3de996e3039de2e21a0d8a2997f5981fd8f643180a5ccf868fa","target":"graph","created_at":"2026-07-05T06:47:05Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2309.00700/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"We present a novel approach to identify ransomware campaigns derived from attack timelines representations within victim networks. Malicious activity profiles developed from multiple alert sources support the construction of alert graphs. This approach enables an effective and scalable representation of the attack timelines where individual nodes represent malicious activity detections with connections describing the potential attack paths. This work demonstrates adaptability to different attack patterns through implementing a novel method for parsing and classifying alert graphs while maintai","authors_text":"Abdul Rahman, Cheng Wang, Christopher Redino, Dhruv Nandakumar, Edward Bowen, Prabhat Kumar Kushwaha, Sathvik Murli, Shalini Israni, Tarun Singh","cross_cats":[],"headline":"","license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","primary_cat":"cs.CR","submitted_at":"2023-09-01T18:46:00Z","title":"Cross-temporal Detection of Novel Ransomware Campaigns: A Multi-Modal Alert Approach"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2309.00700","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:d5d5537681652d3c7b6323aa6485bd7fb843d11582e8f8a75ff5e9e6aa577e23","target":"record","created_at":"2026-07-05T06:47:05Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"9cfeabfa25347e60655adf259e8d2562062803cd1497bf6a1f8363fae84ca6f9","cross_cats_sorted":[],"license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","primary_cat":"cs.CR","submitted_at":"2023-09-01T18:46:00Z","title_canon_sha256":"61e6655a50ef6f45cb897551b75fb8d5f3a2c1e41731239b8f90ef6fabf43beb"},"schema_version":"1.0","source":{"id":"2309.00700","kind":"arxiv","version":1}},"canonical_sha256":"1942c057088679371be239139af56c80061c1f215bbe4de6fd0ef8dc56a1c087","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"1942c057088679371be239139af56c80061c1f215bbe4de6fd0ef8dc56a1c087","first_computed_at":"2026-07-05T06:47:05.723010Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T06:47:05.723010Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"KIDnTCthgyMA6B+8wDnjmCwa6wxLA+VIoC4fzVL0wPNzGXM+IcUObVeg1r0r3O30NFGkh0p8JaDXausqAzzsBQ==","signature_status":"signed_v1","signed_at":"2026-07-05T06:47:05.723514Z","signed_message":"canonical_sha256_bytes"},"source_id":"2309.00700","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:d5d5537681652d3c7b6323aa6485bd7fb843d11582e8f8a75ff5e9e6aa577e23","sha256:17a1dc72664bb3de996e3039de2e21a0d8a2997f5981fd8f643180a5ccf868fa"],"state_sha256":"893e03c7628d027723902bc47de1da4e7257447a3ff843c4c04aa5f35ce73cfa"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"OXj6sVgwvBTde/bv9VTppZBvwWVnjJxhrmMKmznh9olsXOBtKOV2TI5MB+nZiZGZpxaEdyjt9PzitYsuGJ6fCg==","signed_message":"bundle_sha256_bytes","signed_at":"2026-07-31T23:22:56.072572Z","bundle_sha256":"522183802819101729c2083c31fc9d513c6352ace5926cee9017ca1e916845de"}}