{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2026:EB6I22WJTAWIDAP7DUUAWZ343J","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"da6b2c9d4b4ab01fbf66caa28b8154da6c4572617507713d6a9528f9699db008","cross_cats_sorted":["cs.NI"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2026-05-14T00:07:20Z","title_canon_sha256":"e704716f3744eee90aecc70d1a8b79f69361a06607fc3e3753e274f1db4bd660"},"schema_version":"1.0","source":{"id":"2605.14209","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2605.14209","created_at":"2026-05-17T23:39:10Z"},{"alias_kind":"arxiv_version","alias_value":"2605.14209v1","created_at":"2026-05-17T23:39:10Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2605.14209","created_at":"2026-05-17T23:39:10Z"},{"alias_kind":"pith_short_12","alias_value":"EB6I22WJTAWI","created_at":"2026-05-18T12:33:37Z"},{"alias_kind":"pith_short_16","alias_value":"EB6I22WJTAWIDAP7","created_at":"2026-05-18T12:33:37Z"},{"alias_kind":"pith_short_8","alias_value":"EB6I22WJ","created_at":"2026-05-18T12:33:37Z"}],"graph_snapshots":[{"event_id":"sha256:76176e4915a7c58dbae44723894bc4c5bf76760c7e09831f2f979af9e6ffd517","target":"graph","created_at":"2026-05-17T23:39:10Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":4,"items":[{"attestation":"unclaimed","claim_id":"C1","kind":"strongest_claim","source":"verdict.strongest_claim","status":"machine_extracted","text":"Our simulated anomaly-based IDS demonstrates that these evasion techniques enable 97.47% of modern bot traffic to bypass standard volumetric thresholds undetected. Compensatory sensitivity tuning triggers a 68.10% false-positive rate."},{"attestation":"unclaimed","claim_id":"C2","kind":"weakest_assumption","source":"verdict.weakest_assumption","status":"machine_extracted","text":"The assumption that the Merit ORION darknet dataset is representative of reconnaissance traffic that would actually reach and target operational ICS/IIoT devices, and that the simulated IDS accurately models real-world deployment conditions and thresholds."},{"attestation":"unclaimed","claim_id":"C3","kind":"one_line_summary","source":"verdict.one_line_summary","status":"machine_extracted","text":"Darknet analysis shows ICS bot traffic doubling from 0.82% to 1.51% over four years, with micro-pacing enabling 97.47% evasion of standard volumetric IDS thresholds."},{"attestation":"unclaimed","claim_id":"C4","kind":"headline","source":"verdict.pith_extraction.headline","status":"machine_extracted","text":"AI-assisted bots use micro-pacing delays to evade 97.47% of standard volumetric IDS thresholds while ICS port targeting nearly doubles."}],"snapshot_sha256":"402f11df5f72f87a809d8b1c4ada5be8077df0b3070d019c48971658ebbb5ba8"},"formal_canon":{"evidence_count":2,"snapshot_sha256":"0a861fac07b2997a06f78d21e73d294d5f5e17cda6c022e7434090b273fa3a1c"},"paper":{"abstract_excerpt":"The rise of automated scanning tools and AI assisted reconnaissance agents has significantly altered internet background traffic patterns, threatening the baseline assumptions underlying intrusion detection systems (IDS) deployed in critical infrastructure networks. This paper characterizes the evolution of automated bot traffic by analyzing a longitudinal dataset of 192 million passive darknet packets captured across 2021 and 2025 from the Merit ORION Network Telescope. A modular analysis pipeline was developed to compute metrics including average packet rate, global Shannon entropy, inter-ar","authors_text":"Alex Carbajal, Asma Jodeiri Akbarfam, Caleb Faultersack, Jonahtan Vasquez, Shereen Ismail","cross_cats":["cs.NI"],"headline":"AI-assisted bots use micro-pacing delays to evade 97.47% of standard volumetric IDS thresholds while ICS port targeting nearly doubles.","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2026-05-14T00:07:20Z","title":"Characterizing AI-Assisted Bot Traffic in Darknet Data: Implications for ICS and IIoT Security"},"references":{"count":21,"internal_anchors":1,"resolved_work":21,"sample":[{"cited_arxiv_id":"","doi":"","is_internal_anchor":false,"ref_index":1,"title":"Analysis of a","work_id":"04417461-1360-434a-9db6-9701bb720027","year":2012},{"cited_arxiv_id":"","doi":"","is_internal_anchor":false,"ref_index":2,"title":"Spatial temporal anal- ysis of 40,000,000,000,000 internet darkspace packets,","work_id":"47f8f263-dd2c-45ae-bc9b-644b77fbea16","year":2021},{"cited_arxiv_id":"2605.02795","doi":"","is_internal_anchor":true,"ref_index":3,"title":"Analyzing Unsolicited Internet Traffic: Measuring IoT Security Threats via Network Telescopes","work_id":"ae87f2ff-d437-4fb0-9f11-1272b8af14cf","year":2026},{"cited_arxiv_id":"","doi":"","is_internal_anchor":false,"ref_index":4,"title":"2025 bad bot report,","work_id":"a307f139-5260-48a8-81c2-eba15223ad62","year":2025},{"cited_arxiv_id":"","doi":"","is_internal_anchor":false,"ref_index":5,"title":"Guide to operational technology (ot) security,","work_id":"8fb8fd6a-e308-4419-b1e9-ddd8a99d4add","year":2023}],"snapshot_sha256":"c40b4dddfc9d16265690ce8556d4b8abe873609aa3f81148b2643dbb137add3d"},"source":{"id":"2605.14209","kind":"arxiv","version":1},"verdict":{"created_at":"2026-05-15T02:52:51.483749Z","id":"0a692dca-d068-407a-9922-d04e3c51b1a7","model_set":{"reader":"grok-4.3"},"one_line_summary":"Darknet analysis shows ICS bot traffic doubling from 0.82% to 1.51% over four years, with micro-pacing enabling 97.47% evasion of standard volumetric IDS thresholds.","pipeline_version":"pith-pipeline@v0.9.0","pith_extraction_headline":"AI-assisted bots use micro-pacing delays to evade 97.47% of standard volumetric IDS thresholds while ICS port targeting nearly doubles.","strongest_claim":"Our simulated anomaly-based IDS demonstrates that these evasion techniques enable 97.47% of modern bot traffic to bypass standard volumetric thresholds undetected. Compensatory sensitivity tuning triggers a 68.10% false-positive rate.","weakest_assumption":"The assumption that the Merit ORION darknet dataset is representative of reconnaissance traffic that would actually reach and target operational ICS/IIoT devices, and that the simulated IDS accurately models real-world deployment conditions and thresholds."}},"verdict_id":"0a692dca-d068-407a-9922-d04e3c51b1a7"}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:b69c1c36ae1acb0a67b1bbd477d91d2608e37e10b9dce81cc4bcdce81cb3cb41","target":"record","created_at":"2026-05-17T23:39:10Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"da6b2c9d4b4ab01fbf66caa28b8154da6c4572617507713d6a9528f9699db008","cross_cats_sorted":["cs.NI"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2026-05-14T00:07:20Z","title_canon_sha256":"e704716f3744eee90aecc70d1a8b79f69361a06607fc3e3753e274f1db4bd660"},"schema_version":"1.0","source":{"id":"2605.14209","kind":"arxiv","version":1}},"canonical_sha256":"207c8d6ac9982c8181ff1d280b677cda507eba214a8f02003845a49b62aef0e8","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"207c8d6ac9982c8181ff1d280b677cda507eba214a8f02003845a49b62aef0e8","first_computed_at":"2026-05-17T23:39:10.947736Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-05-17T23:39:10.947736Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"9x+bGHQVsrH20ILUCFPOTgtoQAkpLRNcxpb4iHEEMMgGf6/Mcyezb92o+kF6XwKdBCGzu1AeD+lk7G3SfvUuBA==","signature_status":"signed_v1","signed_at":"2026-05-17T23:39:10.948204Z","signed_message":"canonical_sha256_bytes"},"source_id":"2605.14209","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:b69c1c36ae1acb0a67b1bbd477d91d2608e37e10b9dce81cc4bcdce81cb3cb41","sha256:76176e4915a7c58dbae44723894bc4c5bf76760c7e09831f2f979af9e6ffd517"],"state_sha256":"b8f45eae950d65031e1442d706158b842fb75bbaeb74ed0f8cc6fdae0077fc09"}