{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2026:G6YT3CTROMX5TGQVJRJOSQV4KP","short_pith_number":"pith:G6YT3CTR","canonical_record":{"source":{"id":"2608.01454","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2026-08-02T19:27:49Z","cross_cats_sorted":["cs.LG"],"title_canon_sha256":"e20ae4fa0862496715589ea5fa5382cf31509af16ba150f7dd1ee171ac97c1cf","abstract_canon_sha256":"cdc1711694fe60dd9598064d0d622181f845777c877c95fd81ea5dd79a39a5fa"},"schema_version":"1.0"},"canonical_sha256":"37b13d8a71732fd99a154c52e942bc53d79eae01ed037bce9fe548f9fbec7530","source":{"kind":"arxiv","id":"2608.01454","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2608.01454","created_at":"2026-08-04T02:05:14Z"},{"alias_kind":"arxiv_version","alias_value":"2608.01454v1","created_at":"2026-08-04T02:05:14Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2608.01454","created_at":"2026-08-04T02:05:14Z"},{"alias_kind":"pith_short_12","alias_value":"G6YT3CTROMX5","created_at":"2026-08-04T02:05:14Z"},{"alias_kind":"pith_short_16","alias_value":"G6YT3CTROMX5TGQV","created_at":"2026-08-04T02:05:14Z"},{"alias_kind":"pith_short_8","alias_value":"G6YT3CTR","created_at":"2026-08-04T02:05:14Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2026:G6YT3CTROMX5TGQVJRJOSQV4KP","target":"record","payload":{"canonical_record":{"source":{"id":"2608.01454","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2026-08-02T19:27:49Z","cross_cats_sorted":["cs.LG"],"title_canon_sha256":"e20ae4fa0862496715589ea5fa5382cf31509af16ba150f7dd1ee171ac97c1cf","abstract_canon_sha256":"cdc1711694fe60dd9598064d0d622181f845777c877c95fd81ea5dd79a39a5fa"},"schema_version":"1.0"},"canonical_sha256":"37b13d8a71732fd99a154c52e942bc53d79eae01ed037bce9fe548f9fbec7530","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-08-04T02:05:14.999533Z","signature_b64":"cwx3NBSO8lJV6fENsIgGjgIncYLSXOLpQPtuqE+4IBVdJFBepq4bgHFtjLb4Nyhiymx2caYx/79dFYbLQGVzCA==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"37b13d8a71732fd99a154c52e942bc53d79eae01ed037bce9fe548f9fbec7530","last_reissued_at":"2026-08-04T02:05:14.997658Z","signature_status":"signed_v1","first_computed_at":"2026-08-04T02:05:14.997658Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2608.01454","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-08-04T02:05:14Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"rlid/5+mRENGYN/JY5tFGigvgyt9ux0jhgTbWsdOldApSrijgqOJdhgIEStJ82nkUEExFtsX0xQVTiUx6yBJCA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-07T23:28:38.307960Z"},"content_sha256":"532c1ef8a0a248183654af25872c15cf2ef1194baf0a1b1da1651170c66e2ce3","schema_version":"1.0","event_id":"sha256:532c1ef8a0a248183654af25872c15cf2ef1194baf0a1b1da1651170c66e2ce3"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2026:G6YT3CTROMX5TGQVJRJOSQV4KP","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":["cs.LG"],"primary_cat":"cs.CR","authors_text":"Guillaume Duc, Lorenzo Guerra, Pavlo Mozharovskyi, Thomas Chapuis, Van-Tam Nguyen","submitted_at":"2026-08-02T19:27:49Z","abstract_excerpt":"Provenance-based intrusion detection systems (PIDS) frequently report strong performance, but the conclusions drawn from these results can be highly sensitive to benchmarking choices and evaluation protocols. We investigate this dependency by re-evaluating representative PIDS on public datasets that meet our audit, labeling, and calibration requirements. Focusing primarily on the audited DARPA TC E3 datasets, we apply a unified protocol with temporally separated test periods and validation-only checkpoint and threshold calibration, and ask which architectural claims are empirically supported. "},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2608.01454","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2608.01454/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-08-04T02:05:14Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"fs6RqaIghdXIytC1uaq3ylFaL/cz7Joiux08BUk+FFzYqY3jy4aetw8IOs3U7uruBLmevIwWpc/h/6D1VCc3DQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-07T23:28:38.308745Z"},"content_sha256":"4212876e7a608d52800551049a8a682c6f153e1318672c13e23d7aca14c8bb19","schema_version":"1.0","event_id":"sha256:4212876e7a608d52800551049a8a682c6f153e1318672c13e23d7aca14c8bb19"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/G6YT3CTROMX5TGQVJRJOSQV4KP/bundle.json","state_url":"https://pith.science/pith/G6YT3CTROMX5TGQVJRJOSQV4KP/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/G6YT3CTROMX5TGQVJRJOSQV4KP/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-07T23:28:38Z","links":{"resolver":"https://pith.science/pith/G6YT3CTROMX5TGQVJRJOSQV4KP","bundle":"https://pith.science/pith/G6YT3CTROMX5TGQVJRJOSQV4KP/bundle.json","state":"https://pith.science/pith/G6YT3CTROMX5TGQVJRJOSQV4KP/state.json","well_known_bundle":"https://pith.science/.well-known/pith/G6YT3CTROMX5TGQVJRJOSQV4KP/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2026:G6YT3CTROMX5TGQVJRJOSQV4KP","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"cdc1711694fe60dd9598064d0d622181f845777c877c95fd81ea5dd79a39a5fa","cross_cats_sorted":["cs.LG"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2026-08-02T19:27:49Z","title_canon_sha256":"e20ae4fa0862496715589ea5fa5382cf31509af16ba150f7dd1ee171ac97c1cf"},"schema_version":"1.0","source":{"id":"2608.01454","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2608.01454","created_at":"2026-08-04T02:05:14Z"},{"alias_kind":"arxiv_version","alias_value":"2608.01454v1","created_at":"2026-08-04T02:05:14Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2608.01454","created_at":"2026-08-04T02:05:14Z"},{"alias_kind":"pith_short_12","alias_value":"G6YT3CTROMX5","created_at":"2026-08-04T02:05:14Z"},{"alias_kind":"pith_short_16","alias_value":"G6YT3CTROMX5TGQV","created_at":"2026-08-04T02:05:14Z"},{"alias_kind":"pith_short_8","alias_value":"G6YT3CTR","created_at":"2026-08-04T02:05:14Z"}],"graph_snapshots":[{"event_id":"sha256:4212876e7a608d52800551049a8a682c6f153e1318672c13e23d7aca14c8bb19","target":"graph","created_at":"2026-08-04T02:05:14Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2608.01454/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Provenance-based intrusion detection systems (PIDS) frequently report strong performance, but the conclusions drawn from these results can be highly sensitive to benchmarking choices and evaluation protocols. We investigate this dependency by re-evaluating representative PIDS on public datasets that meet our audit, labeling, and calibration requirements. Focusing primarily on the audited DARPA TC E3 datasets, we apply a unified protocol with temporally separated test periods and validation-only checkpoint and threshold calibration, and ask which architectural claims are empirically supported. ","authors_text":"Guillaume Duc, Lorenzo Guerra, Pavlo Mozharovskyi, Thomas Chapuis, Van-Tam Nguyen","cross_cats":["cs.LG"],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2608.01454","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:532c1ef8a0a248183654af25872c15cf2ef1194baf0a1b1da1651170c66e2ce3","target":"record","created_at":"2026-08-04T02:05:14Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"cdc1711694fe60dd9598064d0d622181f845777c877c95fd81ea5dd79a39a5fa","cross_cats_sorted":["cs.LG"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2026-08-02T19:27:49Z","title_canon_sha256":"e20ae4fa0862496715589ea5fa5382cf31509af16ba150f7dd1ee171ac97c1cf"},"schema_version":"1.0","source":{"id":"2608.01454","kind":"arxiv","version":1}},"canonical_sha256":"37b13d8a71732fd99a154c52e942bc53d79eae01ed037bce9fe548f9fbec7530","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"37b13d8a71732fd99a154c52e942bc53d79eae01ed037bce9fe548f9fbec7530","first_computed_at":"2026-08-04T02:05:14.997658Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-08-04T02:05:14.997658Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"cwx3NBSO8lJV6fENsIgGjgIncYLSXOLpQPtuqE+4IBVdJFBepq4bgHFtjLb4Nyhiymx2caYx/79dFYbLQGVzCA==","signature_status":"signed_v1","signed_at":"2026-08-04T02:05:14.999533Z","signed_message":"canonical_sha256_bytes"},"source_id":"2608.01454","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:532c1ef8a0a248183654af25872c15cf2ef1194baf0a1b1da1651170c66e2ce3","sha256:4212876e7a608d52800551049a8a682c6f153e1318672c13e23d7aca14c8bb19"],"state_sha256":"9837d7eb555feee8ba6b9617d161e42eb6f5833054f8103c0d6f53930a296015"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"JH9pMGbw7Pzj+LozyvXrJIcBw7B9PAVMcYQK4+6TOCM0HFDt+uUjTo34MT8mm20caI5p5sIHTycuh6pIa5j/Dg==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-07T23:28:38.314666Z","bundle_sha256":"90dda4ad7ef1357571acbde37abb2bb76275703551f7398527d88529885bf6af"}}