{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2024:J2PITUJFGTFBCOI7NMPLG7EL33","short_pith_number":"pith:J2PITUJF","canonical_record":{"source":{"id":"2412.10978","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by-nc-sa/4.0/","primary_cat":"cs.CR","submitted_at":"2024-12-14T21:52:35Z","cross_cats_sorted":[],"title_canon_sha256":"14b2a82ed04cca3e56b83d5194f2625c66a0923fc4ff387776b1ce67a07597a1","abstract_canon_sha256":"55042e84c032236306cfd234ef55a1b3d788d06afa9ab3d4207eb8f7bc96b0ea"},"schema_version":"1.0"},"canonical_sha256":"4e9e89d12534ca11391f6b1eb37c8bdef356085d282fe0b635d8b3b4111331cb","source":{"kind":"arxiv","id":"2412.10978","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2412.10978","created_at":"2026-07-05T09:49:25Z"},{"alias_kind":"arxiv_version","alias_value":"2412.10978v1","created_at":"2026-07-05T09:49:25Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2412.10978","created_at":"2026-07-05T09:49:25Z"},{"alias_kind":"pith_short_12","alias_value":"J2PITUJFGTFB","created_at":"2026-07-05T09:49:25Z"},{"alias_kind":"pith_short_16","alias_value":"J2PITUJFGTFBCOI7","created_at":"2026-07-05T09:49:25Z"},{"alias_kind":"pith_short_8","alias_value":"J2PITUJF","created_at":"2026-07-05T09:49:25Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2024:J2PITUJFGTFBCOI7NMPLG7EL33","target":"record","payload":{"canonical_record":{"source":{"id":"2412.10978","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by-nc-sa/4.0/","primary_cat":"cs.CR","submitted_at":"2024-12-14T21:52:35Z","cross_cats_sorted":[],"title_canon_sha256":"14b2a82ed04cca3e56b83d5194f2625c66a0923fc4ff387776b1ce67a07597a1","abstract_canon_sha256":"55042e84c032236306cfd234ef55a1b3d788d06afa9ab3d4207eb8f7bc96b0ea"},"schema_version":"1.0"},"canonical_sha256":"4e9e89d12534ca11391f6b1eb37c8bdef356085d282fe0b635d8b3b4111331cb","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T09:49:25.298790Z","signature_b64":"EROVEPdnQzjV5SDMYH3l7g50iayNzWqop3cXhyDdl1DZ+zXiAsSWodaSHMX2C1dwFs76XnPL1hCzaLfIzlM0CA==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"4e9e89d12534ca11391f6b1eb37c8bdef356085d282fe0b635d8b3b4111331cb","last_reissued_at":"2026-07-05T09:49:25.298270Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T09:49:25.298270Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2412.10978","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T09:49:25Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"Zae9zgz1Iep3d7lRCraTeZZE6/Yq1HFDK6ggtfknyAj7eYPye2erleIfd/ALGc+KNOZviHCu0kQfrMNMKOCFBw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-03T12:13:08.290789Z"},"content_sha256":"59ba74ca9f498b5b0019607d37d78f64afddbb64604aca63670b9b56708af59f","schema_version":"1.0","event_id":"sha256:59ba74ca9f498b5b0019607d37d78f64afddbb64604aca63670b9b56708af59f"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2024:J2PITUJFGTFBCOI7NMPLG7EL33","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Labeling NIDS Rules with MITRE ATT&CK Techniques: Machine Learning vs. Large Language Models","license":"http://creativecommons.org/licenses/by-nc-sa/4.0/","headline":"","cross_cats":[],"primary_cat":"cs.CR","authors_text":"Andres Murillo, Aviad Elyashar, Florian Klaus Kaiser, Nir Daniel, Rami Puzis, Raz Moyal, Sapir Sharabi, Shalev Shpolyansky, Shay Giladi","submitted_at":"2024-12-14T21:52:35Z","abstract_excerpt":"Analysts in Security Operations Centers (SOCs) are often occupied with time-consuming investigations of alerts from Network Intrusion Detection Systems (NIDS). Many NIDS rules lack clear explanations and associations with attack techniques, complicating the alert triage and the generation of attack hypotheses. Large Language Models (LLMs) may be a promising technology to reduce the alert explainability gap by associating rules with attack techniques. In this paper, we investigate the ability of three prominent LLMs (ChatGPT, Claude, and Gemini) to reason about NIDS rules while labeling them wi"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2412.10978","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2412.10978/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T09:49:25Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"8q40PabPXBbe81nNuvicuP3PinH/yVJgM+bCZWpEQRHu2VOFYzzCIBtHyIK8dlEQoFrGzQlf9uSTNPiS1W37Cw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-03T12:13:08.291593Z"},"content_sha256":"4bff23ac5dc9da59bfe45daadf20c70ff9589a1e2230fbc1009088120c1a3293","schema_version":"1.0","event_id":"sha256:4bff23ac5dc9da59bfe45daadf20c70ff9589a1e2230fbc1009088120c1a3293"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/J2PITUJFGTFBCOI7NMPLG7EL33/bundle.json","state_url":"https://pith.science/pith/J2PITUJFGTFBCOI7NMPLG7EL33/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/J2PITUJFGTFBCOI7NMPLG7EL33/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-03T12:13:08Z","links":{"resolver":"https://pith.science/pith/J2PITUJFGTFBCOI7NMPLG7EL33","bundle":"https://pith.science/pith/J2PITUJFGTFBCOI7NMPLG7EL33/bundle.json","state":"https://pith.science/pith/J2PITUJFGTFBCOI7NMPLG7EL33/state.json","well_known_bundle":"https://pith.science/.well-known/pith/J2PITUJFGTFBCOI7NMPLG7EL33/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2024:J2PITUJFGTFBCOI7NMPLG7EL33","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"55042e84c032236306cfd234ef55a1b3d788d06afa9ab3d4207eb8f7bc96b0ea","cross_cats_sorted":[],"license":"http://creativecommons.org/licenses/by-nc-sa/4.0/","primary_cat":"cs.CR","submitted_at":"2024-12-14T21:52:35Z","title_canon_sha256":"14b2a82ed04cca3e56b83d5194f2625c66a0923fc4ff387776b1ce67a07597a1"},"schema_version":"1.0","source":{"id":"2412.10978","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2412.10978","created_at":"2026-07-05T09:49:25Z"},{"alias_kind":"arxiv_version","alias_value":"2412.10978v1","created_at":"2026-07-05T09:49:25Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2412.10978","created_at":"2026-07-05T09:49:25Z"},{"alias_kind":"pith_short_12","alias_value":"J2PITUJFGTFB","created_at":"2026-07-05T09:49:25Z"},{"alias_kind":"pith_short_16","alias_value":"J2PITUJFGTFBCOI7","created_at":"2026-07-05T09:49:25Z"},{"alias_kind":"pith_short_8","alias_value":"J2PITUJF","created_at":"2026-07-05T09:49:25Z"}],"graph_snapshots":[{"event_id":"sha256:4bff23ac5dc9da59bfe45daadf20c70ff9589a1e2230fbc1009088120c1a3293","target":"graph","created_at":"2026-07-05T09:49:25Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2412.10978/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Analysts in Security Operations Centers (SOCs) are often occupied with time-consuming investigations of alerts from Network Intrusion Detection Systems (NIDS). Many NIDS rules lack clear explanations and associations with attack techniques, complicating the alert triage and the generation of attack hypotheses. Large Language Models (LLMs) may be a promising technology to reduce the alert explainability gap by associating rules with attack techniques. In this paper, we investigate the ability of three prominent LLMs (ChatGPT, Claude, and Gemini) to reason about NIDS rules while labeling them wi","authors_text":"Andres Murillo, Aviad Elyashar, Florian Klaus Kaiser, Nir Daniel, Rami Puzis, Raz Moyal, Sapir Sharabi, Shalev Shpolyansky, Shay Giladi","cross_cats":[],"headline":"","license":"http://creativecommons.org/licenses/by-nc-sa/4.0/","primary_cat":"cs.CR","submitted_at":"2024-12-14T21:52:35Z","title":"Labeling NIDS Rules with MITRE ATT&CK Techniques: Machine Learning vs. Large Language Models"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2412.10978","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:59ba74ca9f498b5b0019607d37d78f64afddbb64604aca63670b9b56708af59f","target":"record","created_at":"2026-07-05T09:49:25Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"55042e84c032236306cfd234ef55a1b3d788d06afa9ab3d4207eb8f7bc96b0ea","cross_cats_sorted":[],"license":"http://creativecommons.org/licenses/by-nc-sa/4.0/","primary_cat":"cs.CR","submitted_at":"2024-12-14T21:52:35Z","title_canon_sha256":"14b2a82ed04cca3e56b83d5194f2625c66a0923fc4ff387776b1ce67a07597a1"},"schema_version":"1.0","source":{"id":"2412.10978","kind":"arxiv","version":1}},"canonical_sha256":"4e9e89d12534ca11391f6b1eb37c8bdef356085d282fe0b635d8b3b4111331cb","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"4e9e89d12534ca11391f6b1eb37c8bdef356085d282fe0b635d8b3b4111331cb","first_computed_at":"2026-07-05T09:49:25.298270Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T09:49:25.298270Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"EROVEPdnQzjV5SDMYH3l7g50iayNzWqop3cXhyDdl1DZ+zXiAsSWodaSHMX2C1dwFs76XnPL1hCzaLfIzlM0CA==","signature_status":"signed_v1","signed_at":"2026-07-05T09:49:25.298790Z","signed_message":"canonical_sha256_bytes"},"source_id":"2412.10978","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:59ba74ca9f498b5b0019607d37d78f64afddbb64604aca63670b9b56708af59f","sha256:4bff23ac5dc9da59bfe45daadf20c70ff9589a1e2230fbc1009088120c1a3293"],"state_sha256":"5625dd4cac30d6fa100b26d44f5cd8f05bbbc1dc51f8ff370094e83765f65b2e"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"FQfxv0i1/3l8ry2yBerD74pI8/68S8PWHmY6y6ATFu7d4OEsFc7i6O5bX9QDdeYHNGXzWzItlFo5JMmidcRmDg==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-03T12:13:08.297911Z","bundle_sha256":"407d01bb2ea061e2657301d514130826faa50df6ef6a084744c7e455ebbb19b0"}}