{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2025:F6DZLDOJTIQAONTTIDDC6DSTVH","short_pith_number":"pith:F6DZLDOJ","canonical_record":{"source":{"id":"2509.04191","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2025-09-04T13:13:57Z","cross_cats_sorted":["cs.LG"],"title_canon_sha256":"dec611c7548a44b1a501304a0c54e7799093a9035520f9fae945d427b62c2c7f","abstract_canon_sha256":"7ec65afe8e4fa415ed406ec64c150ceafccb430d03a6eff9f2da6a51637017f6"},"schema_version":"1.0"},"canonical_sha256":"2f87958dc99a2007367340c62f0e53a9d67b747cd6e1bf7d0a9f76ad2bfe56c8","source":{"kind":"arxiv","id":"2509.04191","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2509.04191","created_at":"2026-07-05T12:04:55Z"},{"alias_kind":"arxiv_version","alias_value":"2509.04191v1","created_at":"2026-07-05T12:04:55Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2509.04191","created_at":"2026-07-05T12:04:55Z"},{"alias_kind":"pith_short_12","alias_value":"F6DZLDOJTIQA","created_at":"2026-07-05T12:04:55Z"},{"alias_kind":"pith_short_16","alias_value":"F6DZLDOJTIQAONTT","created_at":"2026-07-05T12:04:55Z"},{"alias_kind":"pith_short_8","alias_value":"F6DZLDOJ","created_at":"2026-07-05T12:04:55Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2025:F6DZLDOJTIQAONTTIDDC6DSTVH","target":"record","payload":{"canonical_record":{"source":{"id":"2509.04191","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2025-09-04T13:13:57Z","cross_cats_sorted":["cs.LG"],"title_canon_sha256":"dec611c7548a44b1a501304a0c54e7799093a9035520f9fae945d427b62c2c7f","abstract_canon_sha256":"7ec65afe8e4fa415ed406ec64c150ceafccb430d03a6eff9f2da6a51637017f6"},"schema_version":"1.0"},"canonical_sha256":"2f87958dc99a2007367340c62f0e53a9d67b747cd6e1bf7d0a9f76ad2bfe56c8","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T12:04:55.095015Z","signature_b64":"5V6YN132hq5g/xSjDLcMlXDjDteGW6q1tmiKua/D+TvIUAZ1xcdVrNNULSrHcWFjGKXuQD2gtYNRkfdQCjmhCA==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"2f87958dc99a2007367340c62f0e53a9d67b747cd6e1bf7d0a9f76ad2bfe56c8","last_reissued_at":"2026-07-05T12:04:55.094588Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T12:04:55.094588Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2509.04191","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T12:04:55Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"L4YZR3wTnSJoYvjxYEyOtay4bUCCsYsGZXC3Vla9nOfhH/xGN8vPSii1l1VK+iYM5SRfq4NJi5u98M8qH4TEDg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-06T01:46:33.732366Z"},"content_sha256":"b62e9230b3b706ac353d0a4e40805d603e98414c935f57942252be294ce30a1b","schema_version":"1.0","event_id":"sha256:b62e9230b3b706ac353d0a4e40805d603e98414c935f57942252be294ce30a1b"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2025:F6DZLDOJTIQAONTTIDDC6DSTVH","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"KubeGuard: LLM-Assisted Kubernetes Hardening via Configuration Files and Runtime Logs Analysis","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":["cs.LG"],"primary_cat":"cs.CR","authors_text":"Asaf Shabtai, Dudu Mimran, Ehud Malul, Omri Sgan Cohen, Yair Meidan, Yuval Elovici","submitted_at":"2025-09-04T13:13:57Z","abstract_excerpt":"The widespread adoption of Kubernetes (K8s) for orchestrating cloud-native applications has introduced significant security challenges, such as misconfigured resources and overly permissive configurations. Failing to address these issues can result in unauthorized access, privilege escalation, and lateral movement within clusters. Most existing K8s security solutions focus on detecting misconfigurations, typically through static analysis or anomaly detection. In contrast, this paper presents KubeGuard, a novel runtime log-driven recommender framework aimed at mitigating risks by addressing ove"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2509.04191","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2509.04191/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T12:04:55Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"Gio8QGHkJSVpaeLgNa2Jjo/PZ2PZ/aRe3+35Nfa6FKxJBlRBVyCIPZVpxAYvug+l+neo3tp2RjckaJ8MgHupAA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-06T01:46:33.732867Z"},"content_sha256":"c7e6f3a6f8dfd435f5a95f2de3da0b33dfa685bcc98322d1d41aef048e06b6af","schema_version":"1.0","event_id":"sha256:c7e6f3a6f8dfd435f5a95f2de3da0b33dfa685bcc98322d1d41aef048e06b6af"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/F6DZLDOJTIQAONTTIDDC6DSTVH/bundle.json","state_url":"https://pith.science/pith/F6DZLDOJTIQAONTTIDDC6DSTVH/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/F6DZLDOJTIQAONTTIDDC6DSTVH/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-06T01:46:33Z","links":{"resolver":"https://pith.science/pith/F6DZLDOJTIQAONTTIDDC6DSTVH","bundle":"https://pith.science/pith/F6DZLDOJTIQAONTTIDDC6DSTVH/bundle.json","state":"https://pith.science/pith/F6DZLDOJTIQAONTTIDDC6DSTVH/state.json","well_known_bundle":"https://pith.science/.well-known/pith/F6DZLDOJTIQAONTTIDDC6DSTVH/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2025:F6DZLDOJTIQAONTTIDDC6DSTVH","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"7ec65afe8e4fa415ed406ec64c150ceafccb430d03a6eff9f2da6a51637017f6","cross_cats_sorted":["cs.LG"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2025-09-04T13:13:57Z","title_canon_sha256":"dec611c7548a44b1a501304a0c54e7799093a9035520f9fae945d427b62c2c7f"},"schema_version":"1.0","source":{"id":"2509.04191","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2509.04191","created_at":"2026-07-05T12:04:55Z"},{"alias_kind":"arxiv_version","alias_value":"2509.04191v1","created_at":"2026-07-05T12:04:55Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2509.04191","created_at":"2026-07-05T12:04:55Z"},{"alias_kind":"pith_short_12","alias_value":"F6DZLDOJTIQA","created_at":"2026-07-05T12:04:55Z"},{"alias_kind":"pith_short_16","alias_value":"F6DZLDOJTIQAONTT","created_at":"2026-07-05T12:04:55Z"},{"alias_kind":"pith_short_8","alias_value":"F6DZLDOJ","created_at":"2026-07-05T12:04:55Z"}],"graph_snapshots":[{"event_id":"sha256:c7e6f3a6f8dfd435f5a95f2de3da0b33dfa685bcc98322d1d41aef048e06b6af","target":"graph","created_at":"2026-07-05T12:04:55Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2509.04191/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"The widespread adoption of Kubernetes (K8s) for orchestrating cloud-native applications has introduced significant security challenges, such as misconfigured resources and overly permissive configurations. Failing to address these issues can result in unauthorized access, privilege escalation, and lateral movement within clusters. Most existing K8s security solutions focus on detecting misconfigurations, typically through static analysis or anomaly detection. In contrast, this paper presents KubeGuard, a novel runtime log-driven recommender framework aimed at mitigating risks by addressing ove","authors_text":"Asaf Shabtai, Dudu Mimran, Ehud Malul, Omri Sgan Cohen, Yair Meidan, Yuval Elovici","cross_cats":["cs.LG"],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2025-09-04T13:13:57Z","title":"KubeGuard: LLM-Assisted Kubernetes Hardening via Configuration Files and Runtime Logs Analysis"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2509.04191","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:b62e9230b3b706ac353d0a4e40805d603e98414c935f57942252be294ce30a1b","target":"record","created_at":"2026-07-05T12:04:55Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"7ec65afe8e4fa415ed406ec64c150ceafccb430d03a6eff9f2da6a51637017f6","cross_cats_sorted":["cs.LG"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2025-09-04T13:13:57Z","title_canon_sha256":"dec611c7548a44b1a501304a0c54e7799093a9035520f9fae945d427b62c2c7f"},"schema_version":"1.0","source":{"id":"2509.04191","kind":"arxiv","version":1}},"canonical_sha256":"2f87958dc99a2007367340c62f0e53a9d67b747cd6e1bf7d0a9f76ad2bfe56c8","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"2f87958dc99a2007367340c62f0e53a9d67b747cd6e1bf7d0a9f76ad2bfe56c8","first_computed_at":"2026-07-05T12:04:55.094588Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T12:04:55.094588Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"5V6YN132hq5g/xSjDLcMlXDjDteGW6q1tmiKua/D+TvIUAZ1xcdVrNNULSrHcWFjGKXuQD2gtYNRkfdQCjmhCA==","signature_status":"signed_v1","signed_at":"2026-07-05T12:04:55.095015Z","signed_message":"canonical_sha256_bytes"},"source_id":"2509.04191","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:b62e9230b3b706ac353d0a4e40805d603e98414c935f57942252be294ce30a1b","sha256:c7e6f3a6f8dfd435f5a95f2de3da0b33dfa685bcc98322d1d41aef048e06b6af"],"state_sha256":"fc50119cda57d515439f5b9d1890d2b9eb24df733ad5abcd3b8f339502cd14c4"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"/GKcGpyQn05WMLX7DepbSGjoZVX1e55RveF713mYIRLWcBLzpjQhKs1jhw8nEyx/EpOZJak18utnFa/mbqpCAw==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-06T01:46:33.738101Z","bundle_sha256":"c3c26ac8a3080f8b156a75f4361cc985e44b465f81ada56bfe2f0cb62f755426"}}