{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2019:MNOZBSYOQP3RXLAINCVAFLN6TF","short_pith_number":"pith:MNOZBSYO","canonical_record":{"source":{"id":"1903.08159","kind":"arxiv","version":2},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2019-03-19T15:34:38Z","cross_cats_sorted":[],"title_canon_sha256":"433b46e8c9dc4cbe5d925011e83b42a0166aa2e4825d6e578478b38bdffe7b05","abstract_canon_sha256":"cfc1b86f31f93a311e54c21a31c91c738d9287223264d4b18eb3812507956c44"},"schema_version":"1.0"},"canonical_sha256":"635d90cb0e83f71bac0868aa02adbe995fa5c6c56590e00d213aa8825df7295d","source":{"kind":"arxiv","id":"1903.08159","version":2},"source_aliases":[{"alias_kind":"arxiv","alias_value":"1903.08159","created_at":"2026-07-05T00:44:24Z"},{"alias_kind":"arxiv_version","alias_value":"1903.08159v2","created_at":"2026-07-05T00:44:24Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.1903.08159","created_at":"2026-07-05T00:44:24Z"},{"alias_kind":"pith_short_12","alias_value":"MNOZBSYOQP3R","created_at":"2026-07-05T00:44:24Z"},{"alias_kind":"pith_short_16","alias_value":"MNOZBSYOQP3RXLAI","created_at":"2026-07-05T00:44:24Z"},{"alias_kind":"pith_short_8","alias_value":"MNOZBSYO","created_at":"2026-07-05T00:44:24Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2019:MNOZBSYOQP3RXLAINCVAFLN6TF","target":"record","payload":{"canonical_record":{"source":{"id":"1903.08159","kind":"arxiv","version":2},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2019-03-19T15:34:38Z","cross_cats_sorted":[],"title_canon_sha256":"433b46e8c9dc4cbe5d925011e83b42a0166aa2e4825d6e578478b38bdffe7b05","abstract_canon_sha256":"cfc1b86f31f93a311e54c21a31c91c738d9287223264d4b18eb3812507956c44"},"schema_version":"1.0"},"canonical_sha256":"635d90cb0e83f71bac0868aa02adbe995fa5c6c56590e00d213aa8825df7295d","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T00:44:24.971668Z","signature_b64":"Nm4/yw+sqiGYZ5VU93B8cLdP8lgKiFObgfujhx0SnM4sJ27kqEyC3b/I+up1tZG6PMlVIrabCy7eNnGoH8uZBA==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"635d90cb0e83f71bac0868aa02adbe995fa5c6c56590e00d213aa8825df7295d","last_reissued_at":"2026-07-05T00:44:24.971087Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T00:44:24.971087Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"1903.08159","source_version":2,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T00:44:24Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"BHIPrl8hkYxkyxMC7+Ff8MlsKIM7/gCrU5HOt0t/k1yMixB5RAnXtzy88rgKJiZbfkFL41A3GzSTQxSO34jaDg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-05T15:36:22.190107Z"},"content_sha256":"5104afb9820d2ad0a160108c6bd934cdb753e598c78ca4e5a4d7f64ff2621d70","schema_version":"1.0","event_id":"sha256:5104afb9820d2ad0a160108c6bd934cdb753e598c78ca4e5a4d7f64ff2621d70"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2019:MNOZBSYOQP3RXLAINCVAFLN6TF","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Querying Streaming System Monitoring Data for Enterprise System Anomaly Detection","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":[],"primary_cat":"cs.CR","authors_text":"Ding Li, Haifeng Chen, Kangkook Jee, Peng Gao, Prateek Mittal, Sanjeev R. Kulkarni, Xusheng Xiao","submitted_at":"2019-03-19T15:34:38Z","abstract_excerpt":"The need for countering Advanced Persistent Threat (APT) attacks has led to the solutions that ubiquitously monitor system activities in each enterprise host, and perform timely abnormal system behavior detection over the stream of monitoring data. However, existing stream-based solutions lack explicit language constructs for expressing anomaly models that capture abnormal system behaviors, thus facing challenges in incorporating expert knowledge to perform timely anomaly detection over the large-scale monitoring data. To address these limitations, we build SAQL, a novel stream-based query sys"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"1903.08159","kind":"arxiv","version":2},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/1903.08159/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T00:44:24Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"wUrVp7cd9NgZZhG3fzYV46V/NThXYbbmEdJ0c1QN8kHd3mYJ0egOBHBhtavNdJLYuyM59KCS2O0VOe/WENE+AA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-05T15:36:22.190657Z"},"content_sha256":"8902e0accd4c5ac3a1597be6fa08dc4c3e78cb494e8c8cebe7a5f09d991f58f4","schema_version":"1.0","event_id":"sha256:8902e0accd4c5ac3a1597be6fa08dc4c3e78cb494e8c8cebe7a5f09d991f58f4"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/MNOZBSYOQP3RXLAINCVAFLN6TF/bundle.json","state_url":"https://pith.science/pith/MNOZBSYOQP3RXLAINCVAFLN6TF/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/MNOZBSYOQP3RXLAINCVAFLN6TF/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-05T15:36:22Z","links":{"resolver":"https://pith.science/pith/MNOZBSYOQP3RXLAINCVAFLN6TF","bundle":"https://pith.science/pith/MNOZBSYOQP3RXLAINCVAFLN6TF/bundle.json","state":"https://pith.science/pith/MNOZBSYOQP3RXLAINCVAFLN6TF/state.json","well_known_bundle":"https://pith.science/.well-known/pith/MNOZBSYOQP3RXLAINCVAFLN6TF/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2019:MNOZBSYOQP3RXLAINCVAFLN6TF","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"cfc1b86f31f93a311e54c21a31c91c738d9287223264d4b18eb3812507956c44","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2019-03-19T15:34:38Z","title_canon_sha256":"433b46e8c9dc4cbe5d925011e83b42a0166aa2e4825d6e578478b38bdffe7b05"},"schema_version":"1.0","source":{"id":"1903.08159","kind":"arxiv","version":2}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"1903.08159","created_at":"2026-07-05T00:44:24Z"},{"alias_kind":"arxiv_version","alias_value":"1903.08159v2","created_at":"2026-07-05T00:44:24Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.1903.08159","created_at":"2026-07-05T00:44:24Z"},{"alias_kind":"pith_short_12","alias_value":"MNOZBSYOQP3R","created_at":"2026-07-05T00:44:24Z"},{"alias_kind":"pith_short_16","alias_value":"MNOZBSYOQP3RXLAI","created_at":"2026-07-05T00:44:24Z"},{"alias_kind":"pith_short_8","alias_value":"MNOZBSYO","created_at":"2026-07-05T00:44:24Z"}],"graph_snapshots":[{"event_id":"sha256:8902e0accd4c5ac3a1597be6fa08dc4c3e78cb494e8c8cebe7a5f09d991f58f4","target":"graph","created_at":"2026-07-05T00:44:24Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/1903.08159/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"The need for countering Advanced Persistent Threat (APT) attacks has led to the solutions that ubiquitously monitor system activities in each enterprise host, and perform timely abnormal system behavior detection over the stream of monitoring data. However, existing stream-based solutions lack explicit language constructs for expressing anomaly models that capture abnormal system behaviors, thus facing challenges in incorporating expert knowledge to perform timely anomaly detection over the large-scale monitoring data. To address these limitations, we build SAQL, a novel stream-based query sys","authors_text":"Ding Li, Haifeng Chen, Kangkook Jee, Peng Gao, Prateek Mittal, Sanjeev R. Kulkarni, Xusheng Xiao","cross_cats":[],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2019-03-19T15:34:38Z","title":"Querying Streaming System Monitoring Data for Enterprise System Anomaly Detection"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"1903.08159","kind":"arxiv","version":2},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:5104afb9820d2ad0a160108c6bd934cdb753e598c78ca4e5a4d7f64ff2621d70","target":"record","created_at":"2026-07-05T00:44:24Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"cfc1b86f31f93a311e54c21a31c91c738d9287223264d4b18eb3812507956c44","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2019-03-19T15:34:38Z","title_canon_sha256":"433b46e8c9dc4cbe5d925011e83b42a0166aa2e4825d6e578478b38bdffe7b05"},"schema_version":"1.0","source":{"id":"1903.08159","kind":"arxiv","version":2}},"canonical_sha256":"635d90cb0e83f71bac0868aa02adbe995fa5c6c56590e00d213aa8825df7295d","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"635d90cb0e83f71bac0868aa02adbe995fa5c6c56590e00d213aa8825df7295d","first_computed_at":"2026-07-05T00:44:24.971087Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T00:44:24.971087Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"Nm4/yw+sqiGYZ5VU93B8cLdP8lgKiFObgfujhx0SnM4sJ27kqEyC3b/I+up1tZG6PMlVIrabCy7eNnGoH8uZBA==","signature_status":"signed_v1","signed_at":"2026-07-05T00:44:24.971668Z","signed_message":"canonical_sha256_bytes"},"source_id":"1903.08159","source_kind":"arxiv","source_version":2}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:5104afb9820d2ad0a160108c6bd934cdb753e598c78ca4e5a4d7f64ff2621d70","sha256:8902e0accd4c5ac3a1597be6fa08dc4c3e78cb494e8c8cebe7a5f09d991f58f4"],"state_sha256":"882e98f38ea5101b6ecccd22fe374d2a97f81d2bb7e3e1785cbaac01aa34eeaa"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"ekGRBucj5DGfQZbQq/Eo6zrioeIKCeb4V8OglFVJKR/soDv8tdViF8NNEDZSKuNMQfu9G+ZHxhH6d3yBe4AUCg==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-05T15:36:22.194315Z","bundle_sha256":"328961cac7e19c743aeef17935f9bea8d733ee1019fa375991b60808ed42cda1"}}