{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2026:EFFDZUZRCJNTZSHV4A4YFHGAMH","short_pith_number":"pith:EFFDZUZR","canonical_record":{"source":{"id":"2608.11418","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2026-08-11T20:33:44Z","cross_cats_sorted":[],"title_canon_sha256":"d50e08d2e3b58e7fdf989ec7fae56dcc81edbe4d8d7cf5e79fafe7ca605e7167","abstract_canon_sha256":"ab5f40ea460a537b21246f1968a1d994a6527a5f6d0b4fef7cb63ec6e3494dc9"},"schema_version":"1.0"},"canonical_sha256":"214a3cd331125b3cc8f5e039829cc061d7c05a98a44958904064fad5b97c2ba0","source":{"kind":"arxiv","id":"2608.11418","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2608.11418","created_at":"2026-08-13T00:21:48Z"},{"alias_kind":"arxiv_version","alias_value":"2608.11418v1","created_at":"2026-08-13T00:21:48Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2608.11418","created_at":"2026-08-13T00:21:48Z"},{"alias_kind":"pith_short_12","alias_value":"EFFDZUZRCJNT","created_at":"2026-08-13T00:21:48Z"},{"alias_kind":"pith_short_16","alias_value":"EFFDZUZRCJNTZSHV","created_at":"2026-08-13T00:21:48Z"},{"alias_kind":"pith_short_8","alias_value":"EFFDZUZR","created_at":"2026-08-13T00:21:48Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2026:EFFDZUZRCJNTZSHV4A4YFHGAMH","target":"record","payload":{"canonical_record":{"source":{"id":"2608.11418","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2026-08-11T20:33:44Z","cross_cats_sorted":[],"title_canon_sha256":"d50e08d2e3b58e7fdf989ec7fae56dcc81edbe4d8d7cf5e79fafe7ca605e7167","abstract_canon_sha256":"ab5f40ea460a537b21246f1968a1d994a6527a5f6d0b4fef7cb63ec6e3494dc9"},"schema_version":"1.0"},"canonical_sha256":"214a3cd331125b3cc8f5e039829cc061d7c05a98a44958904064fad5b97c2ba0","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-08-13T00:21:48.705031Z","signature_b64":"tEVBbsGhNMDQmm/pVl0QN/uXw+HwcnVh86PXGlMQLnfQ6vLUmQoxOeUtRujyqK6M1ELbzUXwPTa8P8BAixqjAw==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"214a3cd331125b3cc8f5e039829cc061d7c05a98a44958904064fad5b97c2ba0","last_reissued_at":"2026-08-13T00:21:48.703566Z","signature_status":"signed_v1","first_computed_at":"2026-08-13T00:21:48.703566Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2608.11418","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-08-13T00:21:48Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"3w8NdXK+Dtj8rKUUQ7sn8qvtVowtIRR+D+EA/ci7aPAfNcsdmD6RF3KvwlZD4rS10AVRpXFJNdaBNN/5kdosBg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-16T08:04:03.959401Z"},"content_sha256":"7e13ceba657b46c22ef48f0f55c2909118fabfbef2411ff18409e4539992d669","schema_version":"1.0","event_id":"sha256:7e13ceba657b46c22ef48f0f55c2909118fabfbef2411ff18409e4539992d669"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2026:EFFDZUZRCJNTZSHV4A4YFHGAMH","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"A Study of Kernel Telemetry Options for Security-Oriented Provenance","license":"http://creativecommons.org/licenses/by/4.0/","headline":"","cross_cats":[],"primary_cat":"cs.CR","authors_text":"Herv\\'e Debar, Nicolas Dejon, Olivier Levillain, Paul R. B. Houssel, Sylvie Laniepce","submitted_at":"2026-08-11T20:33:44Z","abstract_excerpt":"Provenance aims to capture the origins, transformations, and interactions of system objects for security and forensic applications. Existing provenance capture approaches still face major challenges and are not yet ready for production environments. In this paper, we first analyze the main kernel telemetry capture approaches, identifying eBPF as the most promising, and complement this analysis with micro benchmarks to assess its performance overhead and the filtering mechanisms used to achieve capture granularity, such as restricting capture to individual containers. Building on this foundatio"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2608.11418","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2608.11418/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-08-13T00:21:48Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"c/VKi3xueSkNfg44JhowuC8zDWKJuDPynB+wf3DnmpmSEJi8b8uK1SPDfKWquDsrJdDrOPWx8z9jzWkkVge+Cg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-16T08:04:03.959883Z"},"content_sha256":"7786febb6a0afdfd5c86f8827b009e2bd87ee7038c44fa567439e41a9da7e492","schema_version":"1.0","event_id":"sha256:7786febb6a0afdfd5c86f8827b009e2bd87ee7038c44fa567439e41a9da7e492"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/EFFDZUZRCJNTZSHV4A4YFHGAMH/bundle.json","state_url":"https://pith.science/pith/EFFDZUZRCJNTZSHV4A4YFHGAMH/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/EFFDZUZRCJNTZSHV4A4YFHGAMH/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-16T08:04:03Z","links":{"resolver":"https://pith.science/pith/EFFDZUZRCJNTZSHV4A4YFHGAMH","bundle":"https://pith.science/pith/EFFDZUZRCJNTZSHV4A4YFHGAMH/bundle.json","state":"https://pith.science/pith/EFFDZUZRCJNTZSHV4A4YFHGAMH/state.json","well_known_bundle":"https://pith.science/.well-known/pith/EFFDZUZRCJNTZSHV4A4YFHGAMH/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2026:EFFDZUZRCJNTZSHV4A4YFHGAMH","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"ab5f40ea460a537b21246f1968a1d994a6527a5f6d0b4fef7cb63ec6e3494dc9","cross_cats_sorted":[],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2026-08-11T20:33:44Z","title_canon_sha256":"d50e08d2e3b58e7fdf989ec7fae56dcc81edbe4d8d7cf5e79fafe7ca605e7167"},"schema_version":"1.0","source":{"id":"2608.11418","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2608.11418","created_at":"2026-08-13T00:21:48Z"},{"alias_kind":"arxiv_version","alias_value":"2608.11418v1","created_at":"2026-08-13T00:21:48Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2608.11418","created_at":"2026-08-13T00:21:48Z"},{"alias_kind":"pith_short_12","alias_value":"EFFDZUZRCJNT","created_at":"2026-08-13T00:21:48Z"},{"alias_kind":"pith_short_16","alias_value":"EFFDZUZRCJNTZSHV","created_at":"2026-08-13T00:21:48Z"},{"alias_kind":"pith_short_8","alias_value":"EFFDZUZR","created_at":"2026-08-13T00:21:48Z"}],"graph_snapshots":[{"event_id":"sha256:7786febb6a0afdfd5c86f8827b009e2bd87ee7038c44fa567439e41a9da7e492","target":"graph","created_at":"2026-08-13T00:21:48Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2608.11418/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Provenance aims to capture the origins, transformations, and interactions of system objects for security and forensic applications. Existing provenance capture approaches still face major challenges and are not yet ready for production environments. In this paper, we first analyze the main kernel telemetry capture approaches, identifying eBPF as the most promising, and complement this analysis with micro benchmarks to assess its performance overhead and the filtering mechanisms used to achieve capture granularity, such as restricting capture to individual containers. Building on this foundatio","authors_text":"Herv\\'e Debar, Nicolas Dejon, Olivier Levillain, Paul R. B. Houssel, Sylvie Laniepce","cross_cats":[],"headline":"","license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2026-08-11T20:33:44Z","title":"A Study of Kernel Telemetry Options for Security-Oriented Provenance"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2608.11418","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:7e13ceba657b46c22ef48f0f55c2909118fabfbef2411ff18409e4539992d669","target":"record","created_at":"2026-08-13T00:21:48Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"ab5f40ea460a537b21246f1968a1d994a6527a5f6d0b4fef7cb63ec6e3494dc9","cross_cats_sorted":[],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2026-08-11T20:33:44Z","title_canon_sha256":"d50e08d2e3b58e7fdf989ec7fae56dcc81edbe4d8d7cf5e79fafe7ca605e7167"},"schema_version":"1.0","source":{"id":"2608.11418","kind":"arxiv","version":1}},"canonical_sha256":"214a3cd331125b3cc8f5e039829cc061d7c05a98a44958904064fad5b97c2ba0","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"214a3cd331125b3cc8f5e039829cc061d7c05a98a44958904064fad5b97c2ba0","first_computed_at":"2026-08-13T00:21:48.703566Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-08-13T00:21:48.703566Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"tEVBbsGhNMDQmm/pVl0QN/uXw+HwcnVh86PXGlMQLnfQ6vLUmQoxOeUtRujyqK6M1ELbzUXwPTa8P8BAixqjAw==","signature_status":"signed_v1","signed_at":"2026-08-13T00:21:48.705031Z","signed_message":"canonical_sha256_bytes"},"source_id":"2608.11418","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:7e13ceba657b46c22ef48f0f55c2909118fabfbef2411ff18409e4539992d669","sha256:7786febb6a0afdfd5c86f8827b009e2bd87ee7038c44fa567439e41a9da7e492"],"state_sha256":"eceec85feaf7ae4dc9a23937060dd591f09fa7b77ddae774762f014091986840"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"UWCmTphbkTy2QYRHFhOkgzRn+kh1mnrXCXVz3j9xthExLDYMnu0FihDXCIx8V/vCg1oFPx0ITbgt4xdzTm8ECw==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-16T08:04:03.963013Z","bundle_sha256":"8bd923731121a3b5b502a51de2f80f3e48797f13d72a53e588ebddc5fdc46683"}}