{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2025:DOD6QRV6JUREFNSDT4AAELLI6Z","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"ff0cf7f9d991e02295265efc8cc84b25d3bb1e1630eb3eb7f40b85505599777e","cross_cats_sorted":["cs.AI","cs.CY"],"license":"http://creativecommons.org/licenses/by-nc-sa/4.0/","primary_cat":"cs.CR","submitted_at":"2025-05-15T04:14:29Z","title_canon_sha256":"d7739cbd43d3874fb664c36169ee44a7d6a73a10951bcb78d05db689f323338e"},"schema_version":"1.0","source":{"id":"2505.11547","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2505.11547","created_at":"2026-07-05T11:04:23Z"},{"alias_kind":"arxiv_version","alias_value":"2505.11547v1","created_at":"2026-07-05T11:04:23Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2505.11547","created_at":"2026-07-05T11:04:23Z"},{"alias_kind":"pith_short_12","alias_value":"DOD6QRV6JURE","created_at":"2026-07-05T11:04:23Z"},{"alias_kind":"pith_short_16","alias_value":"DOD6QRV6JUREFNSD","created_at":"2026-07-05T11:04:23Z"},{"alias_kind":"pith_short_8","alias_value":"DOD6QRV6","created_at":"2026-07-05T11:04:23Z"}],"graph_snapshots":[{"event_id":"sha256:63d10ae341504f123b4190aebdb821317107cce96fcb7b4030f9830397462b33","target":"graph","created_at":"2026-07-05T11:04:23Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2505.11547/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Attribution of cyber-attacks remains a complex but critical challenge for cyber defenders. Currently, manual extraction of behavioral indicators from dense forensic documentation causes significant attribution delays, especially following major incidents at the international scale. This research evaluates large language models (LLMs) for cyber-attack attribution based on behavioral indicators extracted from forensic documentation. We test OpenAI's GPT-4 and text-embedding-3-large for identifying threat actors' tactics, techniques, and procedures (TTPs) by comparing LLM-generated TTPs against h","authors_text":"Kyla Guru, Mykel J. Kochenderfer, Robert J. Moss","cross_cats":["cs.AI","cs.CY"],"headline":"","license":"http://creativecommons.org/licenses/by-nc-sa/4.0/","primary_cat":"cs.CR","submitted_at":"2025-05-15T04:14:29Z","title":"On Technique Identification and Threat-Actor Attribution using LLMs and Embedding Models"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2505.11547","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:9031256016fe748ba6b6738799081799bcea09efcb4e6dfc8db48a92978e8fc1","target":"record","created_at":"2026-07-05T11:04:23Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"ff0cf7f9d991e02295265efc8cc84b25d3bb1e1630eb3eb7f40b85505599777e","cross_cats_sorted":["cs.AI","cs.CY"],"license":"http://creativecommons.org/licenses/by-nc-sa/4.0/","primary_cat":"cs.CR","submitted_at":"2025-05-15T04:14:29Z","title_canon_sha256":"d7739cbd43d3874fb664c36169ee44a7d6a73a10951bcb78d05db689f323338e"},"schema_version":"1.0","source":{"id":"2505.11547","kind":"arxiv","version":1}},"canonical_sha256":"1b87e846be4d2242b6439f00022d68f64ce0b74ad9a702d3624e39b6a7e88bbb","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"1b87e846be4d2242b6439f00022d68f64ce0b74ad9a702d3624e39b6a7e88bbb","first_computed_at":"2026-07-05T11:04:23.481815Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T11:04:23.481815Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"01rR5GGqIbMoj3PfPpsev7G4LlA6vsQJ9G1ytWMkFWaN0EamFRzfsYncAPEosMC36aIJYVf2pQ+oQ9oQhSW2BA==","signature_status":"signed_v1","signed_at":"2026-07-05T11:04:23.482281Z","signed_message":"canonical_sha256_bytes"},"source_id":"2505.11547","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:9031256016fe748ba6b6738799081799bcea09efcb4e6dfc8db48a92978e8fc1","sha256:63d10ae341504f123b4190aebdb821317107cce96fcb7b4030f9830397462b33"],"state_sha256":"88c98633714c8c91fb7236cf3428a96174e4b1961abf043bec4fbc1c6954cf6a"}