{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2016:F2XS23EBGLSIW4QPF7GPQE6KU4","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"54ef76d34ff5cd135c75133c01cfa85d6882dc37c1392eac427a4df63170e848","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2016-12-22T18:18:39Z","title_canon_sha256":"ba250061ae7ae1b3c807892f2ea4bdf1b4b440f4849a0e2d651698af06b7d2ed"},"schema_version":"1.0","source":{"id":"1612.07736","kind":"arxiv","version":2}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"1612.07736","created_at":"2026-05-18T00:23:23Z"},{"alias_kind":"arxiv_version","alias_value":"1612.07736v2","created_at":"2026-05-18T00:23:23Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.1612.07736","created_at":"2026-05-18T00:23:23Z"},{"alias_kind":"pith_short_12","alias_value":"F2XS23EBGLSI","created_at":"2026-05-18T12:30:15Z"},{"alias_kind":"pith_short_16","alias_value":"F2XS23EBGLSIW4QP","created_at":"2026-05-18T12:30:15Z"},{"alias_kind":"pith_short_8","alias_value":"F2XS23EB","created_at":"2026-05-18T12:30:15Z"}],"graph_snapshots":[{"event_id":"sha256:c6122e828611351b191b5c5a266370ceb19f50af1e379bdd6dcc0a928ca9aa3a","target":"graph","created_at":"2026-05-18T00:23:23Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"paper":{"abstract_excerpt":"Given a large number of low-level heterogeneous categorical alerts from an anomaly detection system, how to characterize complex relationships between different alerts, filter out false positives, and deliver trustworthy rankings and suggestions to end users? This problem is motivated by and generalized from applications in enterprise security and attack scenario reconstruction. While existing techniques focus on either reconstructing abnormal scenarios or filtering out false positive alerts, it can be more advantageous to consider the two perspectives simultaneously in order to improve detect","authors_text":"Cheng Cao, Guofei Jiang, Haifeng Chen, Kai Zhang, Lu-An Tang, Ying Lin, Zhengzhang Chen, Zhichun Li","cross_cats":[],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2016-12-22T18:18:39Z","title":"Collaborative Alerts Ranking for Anomaly Detection"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"1612.07736","kind":"arxiv","version":2},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:2f2f35b6cf715478b91dc97003febaf32f0028288bd5a82ef1b0d37afc3166cf","target":"record","created_at":"2026-05-18T00:23:23Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"54ef76d34ff5cd135c75133c01cfa85d6882dc37c1392eac427a4df63170e848","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2016-12-22T18:18:39Z","title_canon_sha256":"ba250061ae7ae1b3c807892f2ea4bdf1b4b440f4849a0e2d651698af06b7d2ed"},"schema_version":"1.0","source":{"id":"1612.07736","kind":"arxiv","version":2}},"canonical_sha256":"2eaf2d6c8132e48b720f2fccf813caa73f745105168f44881298329aa19780a6","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"2eaf2d6c8132e48b720f2fccf813caa73f745105168f44881298329aa19780a6","first_computed_at":"2026-05-18T00:23:23.418863Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-05-18T00:23:23.418863Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"K1omJEFhDqs9kBEZGs5L9ZfAtgiOS/wqzn6JBucYmyedf51SQQKh5yNRevpi/zvEcBhArqXVdiOLlLR3WO26Aw==","signature_status":"signed_v1","signed_at":"2026-05-18T00:23:23.419589Z","signed_message":"canonical_sha256_bytes"},"source_id":"1612.07736","source_kind":"arxiv","source_version":2}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:2f2f35b6cf715478b91dc97003febaf32f0028288bd5a82ef1b0d37afc3166cf","sha256:c6122e828611351b191b5c5a266370ceb19f50af1e379bdd6dcc0a928ca9aa3a"],"state_sha256":"76e26158aa0f83592c9f01e9b1b81b46335a9d41251857849be59f6e9a3326c0"}