{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2021:G5MJ2OP3322TJY6JZXKZX2XJ2E","short_pith_number":"pith:G5MJ2OP3","canonical_record":{"source":{"id":"2109.14303","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2021-09-29T09:36:54Z","cross_cats_sorted":[],"title_canon_sha256":"97f9d8eb89ba2c4a35b3dd07e4d6e1d17ae1fd99817c9e7e8b87c6e362c4f985","abstract_canon_sha256":"9b9db66b8dc12813e44f64cefe4272b2e7dca31848ad340a305b48628eaf27cf"},"schema_version":"1.0"},"canonical_sha256":"37589d39fbdeb534e3c9cdd59beae9d1114a47ad8cb1158ccb1232d744a229a4","source":{"kind":"arxiv","id":"2109.14303","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2109.14303","created_at":"2026-07-05T03:18:33Z"},{"alias_kind":"arxiv_version","alias_value":"2109.14303v1","created_at":"2026-07-05T03:18:33Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2109.14303","created_at":"2026-07-05T03:18:33Z"},{"alias_kind":"pith_short_12","alias_value":"G5MJ2OP3322T","created_at":"2026-07-05T03:18:33Z"},{"alias_kind":"pith_short_16","alias_value":"G5MJ2OP3322TJY6J","created_at":"2026-07-05T03:18:33Z"},{"alias_kind":"pith_short_8","alias_value":"G5MJ2OP3","created_at":"2026-07-05T03:18:33Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2021:G5MJ2OP3322TJY6JZXKZX2XJ2E","target":"record","payload":{"canonical_record":{"source":{"id":"2109.14303","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2021-09-29T09:36:54Z","cross_cats_sorted":[],"title_canon_sha256":"97f9d8eb89ba2c4a35b3dd07e4d6e1d17ae1fd99817c9e7e8b87c6e362c4f985","abstract_canon_sha256":"9b9db66b8dc12813e44f64cefe4272b2e7dca31848ad340a305b48628eaf27cf"},"schema_version":"1.0"},"canonical_sha256":"37589d39fbdeb534e3c9cdd59beae9d1114a47ad8cb1158ccb1232d744a229a4","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T03:18:33.917434Z","signature_b64":"91qSPPFcP1oA2jD8U7HIQaCDctsnYv5NG17os5f9UrzE9duUYBNzNmJSWY9ahlWxukInZgwPxcPhhEqahAGlAQ==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"37589d39fbdeb534e3c9cdd59beae9d1114a47ad8cb1158ccb1232d744a229a4","last_reissued_at":"2026-07-05T03:18:33.916922Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T03:18:33.916922Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2109.14303","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T03:18:33Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"7y/OE4VuQR1RyFAupoyCm80v4Fa3KHdYTPftNLtIbj3Qd+/ToAP0lolOo9AJPw3Q+TUrBmZUHujLGQOICbXHCA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-07-06T12:30:07.799896Z"},"content_sha256":"2447ffc2c19dca969a8e534a1444872542f08be514e106b8c97d90fd175983da","schema_version":"1.0","event_id":"sha256:2447ffc2c19dca969a8e534a1444872542f08be514e106b8c97d90fd175983da"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2021:G5MJ2OP3322TJY6JZXKZX2XJ2E","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Towards event aggregation for reducing the volume of logged events during IKC stages of APT attacks","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":[],"primary_cat":"cs.CR","authors_text":"Abbas Ghaemi-Bafghi, Abbas Rasoolzadegan, Ali Ahmadian Ramaki","submitted_at":"2021-09-29T09:36:54Z","abstract_excerpt":"Nowadays, targeted attacks like Advanced Persistent Threats (APTs) has become one of the major concern of many enterprise networks. As a common approach to counter these attacks, security staff deploy a variety of security and non-security sensors at different lines of defense (Network, Host, and Application) to track the attacker's behaviors during their kill chain. However, one of the drawbacks of this approach is the huge amount of events raised by heterogeneous security and non-security sensors which makes it difficult to analyze logged events for later processing i.e. event correlation fo"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2109.14303","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2109.14303/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T03:18:33Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"utOWdaXgAjW1IpmCLayk9unJKiKIpjfhBeSJEzsdDfCW0s+CRoKzqb3fwSdOjaaf7TVwa8WxkKcaoGos/ExjCQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-07-06T12:30:07.800269Z"},"content_sha256":"315dd0e19c8ad886feeae8b01815959be07af65b7f0de78750608af3b36116bb","schema_version":"1.0","event_id":"sha256:315dd0e19c8ad886feeae8b01815959be07af65b7f0de78750608af3b36116bb"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/G5MJ2OP3322TJY6JZXKZX2XJ2E/bundle.json","state_url":"https://pith.science/pith/G5MJ2OP3322TJY6JZXKZX2XJ2E/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/G5MJ2OP3322TJY6JZXKZX2XJ2E/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-07-06T12:30:07Z","links":{"resolver":"https://pith.science/pith/G5MJ2OP3322TJY6JZXKZX2XJ2E","bundle":"https://pith.science/pith/G5MJ2OP3322TJY6JZXKZX2XJ2E/bundle.json","state":"https://pith.science/pith/G5MJ2OP3322TJY6JZXKZX2XJ2E/state.json","well_known_bundle":"https://pith.science/.well-known/pith/G5MJ2OP3322TJY6JZXKZX2XJ2E/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2021:G5MJ2OP3322TJY6JZXKZX2XJ2E","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"9b9db66b8dc12813e44f64cefe4272b2e7dca31848ad340a305b48628eaf27cf","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2021-09-29T09:36:54Z","title_canon_sha256":"97f9d8eb89ba2c4a35b3dd07e4d6e1d17ae1fd99817c9e7e8b87c6e362c4f985"},"schema_version":"1.0","source":{"id":"2109.14303","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2109.14303","created_at":"2026-07-05T03:18:33Z"},{"alias_kind":"arxiv_version","alias_value":"2109.14303v1","created_at":"2026-07-05T03:18:33Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2109.14303","created_at":"2026-07-05T03:18:33Z"},{"alias_kind":"pith_short_12","alias_value":"G5MJ2OP3322T","created_at":"2026-07-05T03:18:33Z"},{"alias_kind":"pith_short_16","alias_value":"G5MJ2OP3322TJY6J","created_at":"2026-07-05T03:18:33Z"},{"alias_kind":"pith_short_8","alias_value":"G5MJ2OP3","created_at":"2026-07-05T03:18:33Z"}],"graph_snapshots":[{"event_id":"sha256:315dd0e19c8ad886feeae8b01815959be07af65b7f0de78750608af3b36116bb","target":"graph","created_at":"2026-07-05T03:18:33Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2109.14303/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Nowadays, targeted attacks like Advanced Persistent Threats (APTs) has become one of the major concern of many enterprise networks. As a common approach to counter these attacks, security staff deploy a variety of security and non-security sensors at different lines of defense (Network, Host, and Application) to track the attacker's behaviors during their kill chain. However, one of the drawbacks of this approach is the huge amount of events raised by heterogeneous security and non-security sensors which makes it difficult to analyze logged events for later processing i.e. event correlation fo","authors_text":"Abbas Ghaemi-Bafghi, Abbas Rasoolzadegan, Ali Ahmadian Ramaki","cross_cats":[],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2021-09-29T09:36:54Z","title":"Towards event aggregation for reducing the volume of logged events during IKC stages of APT attacks"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2109.14303","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:2447ffc2c19dca969a8e534a1444872542f08be514e106b8c97d90fd175983da","target":"record","created_at":"2026-07-05T03:18:33Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"9b9db66b8dc12813e44f64cefe4272b2e7dca31848ad340a305b48628eaf27cf","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2021-09-29T09:36:54Z","title_canon_sha256":"97f9d8eb89ba2c4a35b3dd07e4d6e1d17ae1fd99817c9e7e8b87c6e362c4f985"},"schema_version":"1.0","source":{"id":"2109.14303","kind":"arxiv","version":1}},"canonical_sha256":"37589d39fbdeb534e3c9cdd59beae9d1114a47ad8cb1158ccb1232d744a229a4","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"37589d39fbdeb534e3c9cdd59beae9d1114a47ad8cb1158ccb1232d744a229a4","first_computed_at":"2026-07-05T03:18:33.916922Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T03:18:33.916922Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"91qSPPFcP1oA2jD8U7HIQaCDctsnYv5NG17os5f9UrzE9duUYBNzNmJSWY9ahlWxukInZgwPxcPhhEqahAGlAQ==","signature_status":"signed_v1","signed_at":"2026-07-05T03:18:33.917434Z","signed_message":"canonical_sha256_bytes"},"source_id":"2109.14303","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:2447ffc2c19dca969a8e534a1444872542f08be514e106b8c97d90fd175983da","sha256:315dd0e19c8ad886feeae8b01815959be07af65b7f0de78750608af3b36116bb"],"state_sha256":"b439b59e259c63e74826f19ef91c4b8dd3e4b94677415893c0b8ff4e2712b845"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"XE2sdEqJmVMaS4Uzl5TTIpJDlmqNLtnXu+qZyZ504vUsBbRH0IOq1h2UvuWagRV5WlV1q3qPz9mDupdq21lrCA==","signed_message":"bundle_sha256_bytes","signed_at":"2026-07-06T12:30:07.802443Z","bundle_sha256":"55e4722c033711745c4d98f4eac60b1a3f6ded48593453c2077b6d3f2f95a57f"}}