{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2023:NPN35RVG3LUA5FU6GHU7L57X7H","short_pith_number":"pith:NPN35RVG","canonical_record":{"source":{"id":"2307.15895","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2023-07-29T05:48:48Z","cross_cats_sorted":[],"title_canon_sha256":"53e3142dc1c0c71094333a6c36e7e289cdc15a0574c0510fdad87ec36fa975bf","abstract_canon_sha256":"e6beb0d5b9a1b4d231a3388d16f66eeb7fb8ee3d7ba50d00976078926c1ef566"},"schema_version":"1.0"},"canonical_sha256":"6bdbbec6a6dae80e969e31e9f5f7f7f9ee6812f8dc452b6f63194f326dc0de61","source":{"kind":"arxiv","id":"2307.15895","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2307.15895","created_at":"2026-07-05T06:35:55Z"},{"alias_kind":"arxiv_version","alias_value":"2307.15895v1","created_at":"2026-07-05T06:35:55Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2307.15895","created_at":"2026-07-05T06:35:55Z"},{"alias_kind":"pith_short_12","alias_value":"NPN35RVG3LUA","created_at":"2026-07-05T06:35:55Z"},{"alias_kind":"pith_short_16","alias_value":"NPN35RVG3LUA5FU6","created_at":"2026-07-05T06:35:55Z"},{"alias_kind":"pith_short_8","alias_value":"NPN35RVG","created_at":"2026-07-05T06:35:55Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2023:NPN35RVG3LUA5FU6GHU7L57X7H","target":"record","payload":{"canonical_record":{"source":{"id":"2307.15895","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2023-07-29T05:48:48Z","cross_cats_sorted":[],"title_canon_sha256":"53e3142dc1c0c71094333a6c36e7e289cdc15a0574c0510fdad87ec36fa975bf","abstract_canon_sha256":"e6beb0d5b9a1b4d231a3388d16f66eeb7fb8ee3d7ba50d00976078926c1ef566"},"schema_version":"1.0"},"canonical_sha256":"6bdbbec6a6dae80e969e31e9f5f7f7f9ee6812f8dc452b6f63194f326dc0de61","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T06:35:55.947170Z","signature_b64":"njP5Gq7U3oK1qqXJG5+CslJ095JO4nV5INW5XpSeMWYEcycKxp6k4gdKjN0vwlPN3szWsJzrOzfyECdGK5Z4Cw==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"6bdbbec6a6dae80e969e31e9f5f7f7f9ee6812f8dc452b6f63194f326dc0de61","last_reissued_at":"2026-07-05T06:35:55.946797Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T06:35:55.946797Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2307.15895","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T06:35:55Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"S/036AG/6KFWrfHBJATNTcKGz9m9sR9P41k9lghJCqll4PjdUsXUo4GjZLBaxKFwo+9TUda1ebxgdiEV0N9ZAQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-15T16:34:08.521761Z"},"content_sha256":"2c51a3d7e5e41dd16ecf2f997723619fefd408e87fcc9d35fbe84e2b9c352ce8","schema_version":"1.0","event_id":"sha256:2c51a3d7e5e41dd16ecf2f997723619fefd408e87fcc9d35fbe84e2b9c352ce8"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2023:NPN35RVG3LUA5FU6GHU7L57X7H","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Auditing Frameworks Need Resource Isolation: A Systematic Study on the Super Producer Threat to System Auditing and Its Mitigation","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":[],"primary_cat":"cs.CR","authors_text":"Ding Li, Jianhai Luan, Peng Jiang, Ruizhe Huang, Xiangqun Chen, Xinwei Hu, Yao Guo, Yuxin Ren","submitted_at":"2023-07-29T05:48:48Z","abstract_excerpt":"System auditing is a crucial technique for detecting APT attacks. However, attackers may try to compromise the system auditing frameworks to conceal their malicious activities. In this paper, we present a comprehensive and systematic study of the super producer threat in auditing frameworks, which enables attackers to either corrupt the auditing framework or paralyze the entire system. We analyze that the main cause of the super producer threat is the lack of data isolation in the centralized architecture of existing solutions. To address this threat, we propose a novel auditing framework, NOD"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2307.15895","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2307.15895/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T06:35:55Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"T4/WlWatKY6awilK85LSYysPwD29nQQUU4QNxjqs7qYSRSQiC3CaNie/1BOJYCpT9Ny3Dhh+86tCEkn9aHpNAA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-15T16:34:08.522264Z"},"content_sha256":"6188a536cabee8c7aadcee90a4aa0d6e85193274d4cc47e3da05f5c29b3275ea","schema_version":"1.0","event_id":"sha256:6188a536cabee8c7aadcee90a4aa0d6e85193274d4cc47e3da05f5c29b3275ea"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/NPN35RVG3LUA5FU6GHU7L57X7H/bundle.json","state_url":"https://pith.science/pith/NPN35RVG3LUA5FU6GHU7L57X7H/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/NPN35RVG3LUA5FU6GHU7L57X7H/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-15T16:34:08Z","links":{"resolver":"https://pith.science/pith/NPN35RVG3LUA5FU6GHU7L57X7H","bundle":"https://pith.science/pith/NPN35RVG3LUA5FU6GHU7L57X7H/bundle.json","state":"https://pith.science/pith/NPN35RVG3LUA5FU6GHU7L57X7H/state.json","well_known_bundle":"https://pith.science/.well-known/pith/NPN35RVG3LUA5FU6GHU7L57X7H/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2023:NPN35RVG3LUA5FU6GHU7L57X7H","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"e6beb0d5b9a1b4d231a3388d16f66eeb7fb8ee3d7ba50d00976078926c1ef566","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2023-07-29T05:48:48Z","title_canon_sha256":"53e3142dc1c0c71094333a6c36e7e289cdc15a0574c0510fdad87ec36fa975bf"},"schema_version":"1.0","source":{"id":"2307.15895","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2307.15895","created_at":"2026-07-05T06:35:55Z"},{"alias_kind":"arxiv_version","alias_value":"2307.15895v1","created_at":"2026-07-05T06:35:55Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2307.15895","created_at":"2026-07-05T06:35:55Z"},{"alias_kind":"pith_short_12","alias_value":"NPN35RVG3LUA","created_at":"2026-07-05T06:35:55Z"},{"alias_kind":"pith_short_16","alias_value":"NPN35RVG3LUA5FU6","created_at":"2026-07-05T06:35:55Z"},{"alias_kind":"pith_short_8","alias_value":"NPN35RVG","created_at":"2026-07-05T06:35:55Z"}],"graph_snapshots":[{"event_id":"sha256:6188a536cabee8c7aadcee90a4aa0d6e85193274d4cc47e3da05f5c29b3275ea","target":"graph","created_at":"2026-07-05T06:35:55Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2307.15895/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"System auditing is a crucial technique for detecting APT attacks. However, attackers may try to compromise the system auditing frameworks to conceal their malicious activities. In this paper, we present a comprehensive and systematic study of the super producer threat in auditing frameworks, which enables attackers to either corrupt the auditing framework or paralyze the entire system. We analyze that the main cause of the super producer threat is the lack of data isolation in the centralized architecture of existing solutions. To address this threat, we propose a novel auditing framework, NOD","authors_text":"Ding Li, Jianhai Luan, Peng Jiang, Ruizhe Huang, Xiangqun Chen, Xinwei Hu, Yao Guo, Yuxin Ren","cross_cats":[],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2023-07-29T05:48:48Z","title":"Auditing Frameworks Need Resource Isolation: A Systematic Study on the Super Producer Threat to System Auditing and Its Mitigation"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2307.15895","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:2c51a3d7e5e41dd16ecf2f997723619fefd408e87fcc9d35fbe84e2b9c352ce8","target":"record","created_at":"2026-07-05T06:35:55Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"e6beb0d5b9a1b4d231a3388d16f66eeb7fb8ee3d7ba50d00976078926c1ef566","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2023-07-29T05:48:48Z","title_canon_sha256":"53e3142dc1c0c71094333a6c36e7e289cdc15a0574c0510fdad87ec36fa975bf"},"schema_version":"1.0","source":{"id":"2307.15895","kind":"arxiv","version":1}},"canonical_sha256":"6bdbbec6a6dae80e969e31e9f5f7f7f9ee6812f8dc452b6f63194f326dc0de61","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"6bdbbec6a6dae80e969e31e9f5f7f7f9ee6812f8dc452b6f63194f326dc0de61","first_computed_at":"2026-07-05T06:35:55.946797Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T06:35:55.946797Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"njP5Gq7U3oK1qqXJG5+CslJ095JO4nV5INW5XpSeMWYEcycKxp6k4gdKjN0vwlPN3szWsJzrOzfyECdGK5Z4Cw==","signature_status":"signed_v1","signed_at":"2026-07-05T06:35:55.947170Z","signed_message":"canonical_sha256_bytes"},"source_id":"2307.15895","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:2c51a3d7e5e41dd16ecf2f997723619fefd408e87fcc9d35fbe84e2b9c352ce8","sha256:6188a536cabee8c7aadcee90a4aa0d6e85193274d4cc47e3da05f5c29b3275ea"],"state_sha256":"e94a608564235063c54c3dec0df64dc1a213ca82717ddec144021993124915e2"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"pKB/Ip7+hbJ0yAMdLSPtQWlbc9viSXs1MnQoEIAQBxvt2nc34VIMzKEUm+z64xPavAa4A8MOwSR4PWh/n0XXAw==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-15T16:34:08.526129Z","bundle_sha256":"a2bc928dd19a55e737a92c4cd07cb1adfc8b2d9dcb9cc714ce91e1c4de701c11"}}