{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2022:M2CWWYHV6SI7OH6HQB23PIVKJ3","short_pith_number":"pith:M2CWWYHV","canonical_record":{"source":{"id":"2207.11530","kind":"arxiv","version":2},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.SE","submitted_at":"2022-07-23T14:38:43Z","cross_cats_sorted":[],"title_canon_sha256":"eb9508a9d17235fff97aa94d5746414fb0c4eeab909b3bc445973c6fc9cadf48","abstract_canon_sha256":"21c97900509d26ce0cc70df72d2931244aa2c8a9fb6b358b92fe63bdd108b9d4"},"schema_version":"1.0"},"canonical_sha256":"66856b60f5f491f71fc78075b7a2aa4ecbdd7107bceebef1632c1f8e04faaed9","source":{"kind":"arxiv","id":"2207.11530","version":2},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2207.11530","created_at":"2026-07-05T06:55:48Z"},{"alias_kind":"arxiv_version","alias_value":"2207.11530v2","created_at":"2026-07-05T06:55:48Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2207.11530","created_at":"2026-07-05T06:55:48Z"},{"alias_kind":"pith_short_12","alias_value":"M2CWWYHV6SI7","created_at":"2026-07-05T06:55:48Z"},{"alias_kind":"pith_short_16","alias_value":"M2CWWYHV6SI7OH6H","created_at":"2026-07-05T06:55:48Z"},{"alias_kind":"pith_short_8","alias_value":"M2CWWYHV","created_at":"2026-07-05T06:55:48Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2022:M2CWWYHV6SI7OH6HQB23PIVKJ3","target":"record","payload":{"canonical_record":{"source":{"id":"2207.11530","kind":"arxiv","version":2},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.SE","submitted_at":"2022-07-23T14:38:43Z","cross_cats_sorted":[],"title_canon_sha256":"eb9508a9d17235fff97aa94d5746414fb0c4eeab909b3bc445973c6fc9cadf48","abstract_canon_sha256":"21c97900509d26ce0cc70df72d2931244aa2c8a9fb6b358b92fe63bdd108b9d4"},"schema_version":"1.0"},"canonical_sha256":"66856b60f5f491f71fc78075b7a2aa4ecbdd7107bceebef1632c1f8e04faaed9","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T06:55:48.902613Z","signature_b64":"KnhnencryGJq4DILjZjB4lMCjRfecgS2VcI7VzoTaeHrH7b7BzXsd5y6roi13whEkJtODtVYfwcur+2R2edCCA==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"66856b60f5f491f71fc78075b7a2aa4ecbdd7107bceebef1632c1f8e04faaed9","last_reissued_at":"2026-07-05T06:55:48.902202Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T06:55:48.902202Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2207.11530","source_version":2,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T06:55:48Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"GeEunPqJL7vguCvntKqqfmFwLDihXyxFmvS+mGrLcUem1KHoJXg6dNDwY2nQrqxu8rrMK/oV+3Mad3+BNCMYAw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-06T06:43:42.240915Z"},"content_sha256":"ce0610dd203be426475b312b7681ba5caf6645965bf6f08c4ed99393391ce3de","schema_version":"1.0","event_id":"sha256:ce0610dd203be426475b312b7681ba5caf6645965bf6f08c4ed99393391ce3de"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2022:M2CWWYHV6SI7OH6HQB23PIVKJ3","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Kellect: a Kernel-Based Efficient and Lossless Event Log Collector for Windows Security","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":[],"primary_cat":"cs.SE","authors_text":"Mingqi Lv, Qijie Song, Tiantian Zhu, Tieming Chen, Xuebo Qiu, Zhiling Zhu","submitted_at":"2022-07-23T14:38:43Z","abstract_excerpt":"Recently, APT attacks have frequently happened, which are increasingly complicated and more challenging for traditional security detection models. The system logs are vital for cyber security analysis mainly due to their effective reconstruction ability of system behavior. existing log collection tools built on ETW for Windows suffer from working shortages, including data loss, high overhead, and weak real-time performance. Therefore, It is still very difficult to apply ETW-based Windows tools to analyze APT attack scenarios.\n  To address these challenges, this paper proposes an efficient and "},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2207.11530","kind":"arxiv","version":2},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2207.11530/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T06:55:48Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"JyM5wjYw/usV8QhFflAbcmrRMjaMC7E9tXmnEnNHTgVIeF/hyXFYq+t4SVXI7i6HI/CbqeKysl2IS8ckYCDfAA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-06T06:43:42.241465Z"},"content_sha256":"7845501a9978192f6680576565c809fafad222e6d6b6ce38e7c0d56307f2239c","schema_version":"1.0","event_id":"sha256:7845501a9978192f6680576565c809fafad222e6d6b6ce38e7c0d56307f2239c"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/M2CWWYHV6SI7OH6HQB23PIVKJ3/bundle.json","state_url":"https://pith.science/pith/M2CWWYHV6SI7OH6HQB23PIVKJ3/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/M2CWWYHV6SI7OH6HQB23PIVKJ3/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-06T06:43:42Z","links":{"resolver":"https://pith.science/pith/M2CWWYHV6SI7OH6HQB23PIVKJ3","bundle":"https://pith.science/pith/M2CWWYHV6SI7OH6HQB23PIVKJ3/bundle.json","state":"https://pith.science/pith/M2CWWYHV6SI7OH6HQB23PIVKJ3/state.json","well_known_bundle":"https://pith.science/.well-known/pith/M2CWWYHV6SI7OH6HQB23PIVKJ3/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2022:M2CWWYHV6SI7OH6HQB23PIVKJ3","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"21c97900509d26ce0cc70df72d2931244aa2c8a9fb6b358b92fe63bdd108b9d4","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.SE","submitted_at":"2022-07-23T14:38:43Z","title_canon_sha256":"eb9508a9d17235fff97aa94d5746414fb0c4eeab909b3bc445973c6fc9cadf48"},"schema_version":"1.0","source":{"id":"2207.11530","kind":"arxiv","version":2}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2207.11530","created_at":"2026-07-05T06:55:48Z"},{"alias_kind":"arxiv_version","alias_value":"2207.11530v2","created_at":"2026-07-05T06:55:48Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2207.11530","created_at":"2026-07-05T06:55:48Z"},{"alias_kind":"pith_short_12","alias_value":"M2CWWYHV6SI7","created_at":"2026-07-05T06:55:48Z"},{"alias_kind":"pith_short_16","alias_value":"M2CWWYHV6SI7OH6H","created_at":"2026-07-05T06:55:48Z"},{"alias_kind":"pith_short_8","alias_value":"M2CWWYHV","created_at":"2026-07-05T06:55:48Z"}],"graph_snapshots":[{"event_id":"sha256:7845501a9978192f6680576565c809fafad222e6d6b6ce38e7c0d56307f2239c","target":"graph","created_at":"2026-07-05T06:55:48Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2207.11530/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Recently, APT attacks have frequently happened, which are increasingly complicated and more challenging for traditional security detection models. The system logs are vital for cyber security analysis mainly due to their effective reconstruction ability of system behavior. existing log collection tools built on ETW for Windows suffer from working shortages, including data loss, high overhead, and weak real-time performance. Therefore, It is still very difficult to apply ETW-based Windows tools to analyze APT attack scenarios.\n  To address these challenges, this paper proposes an efficient and ","authors_text":"Mingqi Lv, Qijie Song, Tiantian Zhu, Tieming Chen, Xuebo Qiu, Zhiling Zhu","cross_cats":[],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.SE","submitted_at":"2022-07-23T14:38:43Z","title":"Kellect: a Kernel-Based Efficient and Lossless Event Log Collector for Windows Security"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2207.11530","kind":"arxiv","version":2},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:ce0610dd203be426475b312b7681ba5caf6645965bf6f08c4ed99393391ce3de","target":"record","created_at":"2026-07-05T06:55:48Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"21c97900509d26ce0cc70df72d2931244aa2c8a9fb6b358b92fe63bdd108b9d4","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.SE","submitted_at":"2022-07-23T14:38:43Z","title_canon_sha256":"eb9508a9d17235fff97aa94d5746414fb0c4eeab909b3bc445973c6fc9cadf48"},"schema_version":"1.0","source":{"id":"2207.11530","kind":"arxiv","version":2}},"canonical_sha256":"66856b60f5f491f71fc78075b7a2aa4ecbdd7107bceebef1632c1f8e04faaed9","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"66856b60f5f491f71fc78075b7a2aa4ecbdd7107bceebef1632c1f8e04faaed9","first_computed_at":"2026-07-05T06:55:48.902202Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T06:55:48.902202Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"KnhnencryGJq4DILjZjB4lMCjRfecgS2VcI7VzoTaeHrH7b7BzXsd5y6roi13whEkJtODtVYfwcur+2R2edCCA==","signature_status":"signed_v1","signed_at":"2026-07-05T06:55:48.902613Z","signed_message":"canonical_sha256_bytes"},"source_id":"2207.11530","source_kind":"arxiv","source_version":2}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:ce0610dd203be426475b312b7681ba5caf6645965bf6f08c4ed99393391ce3de","sha256:7845501a9978192f6680576565c809fafad222e6d6b6ce38e7c0d56307f2239c"],"state_sha256":"585c4b83d226629794fff23ba974080193ec61bb8061faa10ea6f79ed8eb0c66"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"JFBmqC/o27jV23v8vsQx7xPa84fuZSZILhvDH8cfRNegKzeAmeFnZYNHZ4wJPCf0HA8nKTAlydYvLaM+VGKFBw==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-06T06:43:42.244852Z","bundle_sha256":"a479778c9e0f7f0dacf06373226c36ea7665fb2693645409f28609e562701f11"}}