{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2022:LRSE45SLPD3FCRABIFO7VCOYX7","short_pith_number":"pith:LRSE45SL","canonical_record":{"source":{"id":"2208.13524","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2022-08-29T11:57:40Z","cross_cats_sorted":["cs.LG"],"title_canon_sha256":"7be874d7559287bb7110235d62ee5f200ef4ab1ce31123ba80cfc814ed8e3e98","abstract_canon_sha256":"f71714b347acfd14454202edb287677bb4ae0ea259d0f57fa7f4441742c9f307"},"schema_version":"1.0"},"canonical_sha256":"5c644e764b78f6514401415dfa89d8bfe9d6404f65519d7c19b13e70c1a69ea0","source":{"kind":"arxiv","id":"2208.13524","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2208.13524","created_at":"2026-07-05T04:52:18Z"},{"alias_kind":"arxiv_version","alias_value":"2208.13524v1","created_at":"2026-07-05T04:52:18Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2208.13524","created_at":"2026-07-05T04:52:18Z"},{"alias_kind":"pith_short_12","alias_value":"LRSE45SLPD3F","created_at":"2026-07-05T04:52:18Z"},{"alias_kind":"pith_short_16","alias_value":"LRSE45SLPD3FCRAB","created_at":"2026-07-05T04:52:18Z"},{"alias_kind":"pith_short_8","alias_value":"LRSE45SL","created_at":"2026-07-05T04:52:18Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2022:LRSE45SLPD3FCRABIFO7VCOYX7","target":"record","payload":{"canonical_record":{"source":{"id":"2208.13524","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2022-08-29T11:57:40Z","cross_cats_sorted":["cs.LG"],"title_canon_sha256":"7be874d7559287bb7110235d62ee5f200ef4ab1ce31123ba80cfc814ed8e3e98","abstract_canon_sha256":"f71714b347acfd14454202edb287677bb4ae0ea259d0f57fa7f4441742c9f307"},"schema_version":"1.0"},"canonical_sha256":"5c644e764b78f6514401415dfa89d8bfe9d6404f65519d7c19b13e70c1a69ea0","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T04:52:18.105948Z","signature_b64":"oo6HTCT9WUdsQxjd9goQXNhfsfGlMnMao/MsvFbim0TYgTr9WeXdIWZqXtdkRsT66vqqij9OVm1lSZZvMSYlCA==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"5c644e764b78f6514401415dfa89d8bfe9d6404f65519d7c19b13e70c1a69ea0","last_reissued_at":"2026-07-05T04:52:18.105435Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T04:52:18.105435Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2208.13524","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T04:52:18Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"VQ6rzW24Bb12gKVPlHx+A2bWSA2OxhbJIgEvL9aOx9nUZxk9oEva/YjaSj4rsnqmP7Hpmyj4y9XLVZ3Hk7BeDg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-07-07T04:32:29.352936Z"},"content_sha256":"5820b4d331bdbfa1f79e4291608c39f122ddf74799b36d4b9ba65da8d80fb938","schema_version":"1.0","event_id":"sha256:5820b4d331bdbfa1f79e4291608c39f122ddf74799b36d4b9ba65da8d80fb938"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2022:LRSE45SLPD3FCRABIFO7VCOYX7","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Lateral Movement Detection Using User Behavioral Analysis","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":["cs.LG"],"primary_cat":"cs.CR","authors_text":"Aaron Shaha, Abdul Rahman, Akshay Kakkar, Christopher Redino, Deepak Kushwaha, Dhruv Nandakumar, Edward Bowen, Joe Nehila, Kevin Choi, Matthew Weeks, Sabthagiri Saravanan Chandramohan, Sanvi Gupta","submitted_at":"2022-08-29T11:57:40Z","abstract_excerpt":"Lateral Movement refers to methods by which threat actors gain initial access to a network and then progressively move through said network collecting key data about assets until they reach the ultimate target of their attack. Lateral Movement intrusions have become more intricate with the increasing complexity and interconnected nature of enterprise networks, and require equally sophisticated detection mechanisms to proactively detect such threats in near real-time at enterprise scale. In this paper, the authors propose a novel, lightweight method for Lateral Movement detection using user beh"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2208.13524","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2208.13524/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T04:52:18Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"wv4cOxi9mQsSjVl/cyecQ1iDMIwJuebQqK+X2QWtZ7T6PPltY0+qTy7ne4QeMfOeck8TBAPfM5ng4OiE2ZBGDg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-07-07T04:32:29.353309Z"},"content_sha256":"417010945fd75fcb909ad96c0ff3c5130e3f1f44159431cc273bb1315ae9c673","schema_version":"1.0","event_id":"sha256:417010945fd75fcb909ad96c0ff3c5130e3f1f44159431cc273bb1315ae9c673"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/LRSE45SLPD3FCRABIFO7VCOYX7/bundle.json","state_url":"https://pith.science/pith/LRSE45SLPD3FCRABIFO7VCOYX7/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/LRSE45SLPD3FCRABIFO7VCOYX7/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-07-07T04:32:29Z","links":{"resolver":"https://pith.science/pith/LRSE45SLPD3FCRABIFO7VCOYX7","bundle":"https://pith.science/pith/LRSE45SLPD3FCRABIFO7VCOYX7/bundle.json","state":"https://pith.science/pith/LRSE45SLPD3FCRABIFO7VCOYX7/state.json","well_known_bundle":"https://pith.science/.well-known/pith/LRSE45SLPD3FCRABIFO7VCOYX7/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2022:LRSE45SLPD3FCRABIFO7VCOYX7","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"f71714b347acfd14454202edb287677bb4ae0ea259d0f57fa7f4441742c9f307","cross_cats_sorted":["cs.LG"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2022-08-29T11:57:40Z","title_canon_sha256":"7be874d7559287bb7110235d62ee5f200ef4ab1ce31123ba80cfc814ed8e3e98"},"schema_version":"1.0","source":{"id":"2208.13524","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2208.13524","created_at":"2026-07-05T04:52:18Z"},{"alias_kind":"arxiv_version","alias_value":"2208.13524v1","created_at":"2026-07-05T04:52:18Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2208.13524","created_at":"2026-07-05T04:52:18Z"},{"alias_kind":"pith_short_12","alias_value":"LRSE45SLPD3F","created_at":"2026-07-05T04:52:18Z"},{"alias_kind":"pith_short_16","alias_value":"LRSE45SLPD3FCRAB","created_at":"2026-07-05T04:52:18Z"},{"alias_kind":"pith_short_8","alias_value":"LRSE45SL","created_at":"2026-07-05T04:52:18Z"}],"graph_snapshots":[{"event_id":"sha256:417010945fd75fcb909ad96c0ff3c5130e3f1f44159431cc273bb1315ae9c673","target":"graph","created_at":"2026-07-05T04:52:18Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2208.13524/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Lateral Movement refers to methods by which threat actors gain initial access to a network and then progressively move through said network collecting key data about assets until they reach the ultimate target of their attack. Lateral Movement intrusions have become more intricate with the increasing complexity and interconnected nature of enterprise networks, and require equally sophisticated detection mechanisms to proactively detect such threats in near real-time at enterprise scale. In this paper, the authors propose a novel, lightweight method for Lateral Movement detection using user beh","authors_text":"Aaron Shaha, Abdul Rahman, Akshay Kakkar, Christopher Redino, Deepak Kushwaha, Dhruv Nandakumar, Edward Bowen, Joe Nehila, Kevin Choi, Matthew Weeks, Sabthagiri Saravanan Chandramohan, Sanvi Gupta","cross_cats":["cs.LG"],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2022-08-29T11:57:40Z","title":"Lateral Movement Detection Using User Behavioral Analysis"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2208.13524","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:5820b4d331bdbfa1f79e4291608c39f122ddf74799b36d4b9ba65da8d80fb938","target":"record","created_at":"2026-07-05T04:52:18Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"f71714b347acfd14454202edb287677bb4ae0ea259d0f57fa7f4441742c9f307","cross_cats_sorted":["cs.LG"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2022-08-29T11:57:40Z","title_canon_sha256":"7be874d7559287bb7110235d62ee5f200ef4ab1ce31123ba80cfc814ed8e3e98"},"schema_version":"1.0","source":{"id":"2208.13524","kind":"arxiv","version":1}},"canonical_sha256":"5c644e764b78f6514401415dfa89d8bfe9d6404f65519d7c19b13e70c1a69ea0","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"5c644e764b78f6514401415dfa89d8bfe9d6404f65519d7c19b13e70c1a69ea0","first_computed_at":"2026-07-05T04:52:18.105435Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T04:52:18.105435Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"oo6HTCT9WUdsQxjd9goQXNhfsfGlMnMao/MsvFbim0TYgTr9WeXdIWZqXtdkRsT66vqqij9OVm1lSZZvMSYlCA==","signature_status":"signed_v1","signed_at":"2026-07-05T04:52:18.105948Z","signed_message":"canonical_sha256_bytes"},"source_id":"2208.13524","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:5820b4d331bdbfa1f79e4291608c39f122ddf74799b36d4b9ba65da8d80fb938","sha256:417010945fd75fcb909ad96c0ff3c5130e3f1f44159431cc273bb1315ae9c673"],"state_sha256":"9164c947b465615497b66d6c7a3c19d31127c0a7aee2f4ae9b9ec98cf7d4d662"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"p7cOIXbaJV5BmkXw1jGX00nIDcfH83JXmtGnorffV48WWbjRC0BDiYZ7hFsXAh3xL4lb477CaUYrzmBvceXHCw==","signed_message":"bundle_sha256_bytes","signed_at":"2026-07-07T04:32:29.355414Z","bundle_sha256":"c46f82db060eed73c98fde25054fd9be8cddda576bc2125b0211c60ed726ee0a"}}