{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2016:NXA63FE6EVYUAKZUCHWFY6MNWS","short_pith_number":"pith:NXA63FE6","canonical_record":{"source":{"id":"1609.04214","kind":"arxiv","version":2},"metadata":{"license":"http://creativecommons.org/licenses/by-nc-sa/4.0/","primary_cat":"cs.CR","submitted_at":"2016-09-14T10:51:00Z","cross_cats_sorted":["cs.AI","cs.NI"],"title_canon_sha256":"5c26565a3d52e9e233f4552b877ef1f8a422ff8abee826092d917d95f543a6e5","abstract_canon_sha256":"548bd8d798ca149400ce018d43f10368b55f05c517337cbc5299d2a620bba583"},"schema_version":"1.0"},"canonical_sha256":"6dc1ed949e2571402b3411ec5c798db4bd930dcc21a052345161d874a90d1fea","source":{"kind":"arxiv","id":"1609.04214","version":2},"source_aliases":[{"alias_kind":"arxiv","alias_value":"1609.04214","created_at":"2026-05-18T00:52:25Z"},{"alias_kind":"arxiv_version","alias_value":"1609.04214v2","created_at":"2026-05-18T00:52:25Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.1609.04214","created_at":"2026-05-18T00:52:25Z"},{"alias_kind":"pith_short_12","alias_value":"NXA63FE6EVYU","created_at":"2026-05-18T12:30:36Z"},{"alias_kind":"pith_short_16","alias_value":"NXA63FE6EVYUAKZU","created_at":"2026-05-18T12:30:36Z"},{"alias_kind":"pith_short_8","alias_value":"NXA63FE6","created_at":"2026-05-18T12:30:36Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2016:NXA63FE6EVYUAKZUCHWFY6MNWS","target":"record","payload":{"canonical_record":{"source":{"id":"1609.04214","kind":"arxiv","version":2},"metadata":{"license":"http://creativecommons.org/licenses/by-nc-sa/4.0/","primary_cat":"cs.CR","submitted_at":"2016-09-14T10:51:00Z","cross_cats_sorted":["cs.AI","cs.NI"],"title_canon_sha256":"5c26565a3d52e9e233f4552b877ef1f8a422ff8abee826092d917d95f543a6e5","abstract_canon_sha256":"548bd8d798ca149400ce018d43f10368b55f05c517337cbc5299d2a620bba583"},"schema_version":"1.0"},"canonical_sha256":"6dc1ed949e2571402b3411ec5c798db4bd930dcc21a052345161d874a90d1fea","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-05-18T00:52:25.342564Z","signature_b64":"SaAkmSSzv/ExAb71zyc4Jjd0LIqGnD/kYgzw0UhF8WyYv5IF2c1YVhLGkM0BgFHbiI8DAYYu51e2PYC+FSLqCQ==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"6dc1ed949e2571402b3411ec5c798db4bd930dcc21a052345161d874a90d1fea","last_reissued_at":"2026-05-18T00:52:25.341883Z","signature_status":"signed_v1","first_computed_at":"2026-05-18T00:52:25.341883Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"1609.04214","source_version":2,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-05-18T00:52:25Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"q4/8EhAeXcjByT83kF+G7b+QMaMVu2Xjx0FOBtEqNLLUInSh5Z8XEfdbb4i3ze53sVW0EHSoHD1w/7OVWzRLCw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-05-27T03:58:54.927233Z"},"content_sha256":"9be2bac1990dc1e0919a3de8ff96bac66dae776b4cf7dc48a729b244412c7f43","schema_version":"1.0","event_id":"sha256:9be2bac1990dc1e0919a3de8ff96bac66dae776b4cf7dc48a729b244412c7f43"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2016:NXA63FE6EVYUAKZUCHWFY6MNWS","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"\"Flow Size Difference\" Can Make a Difference: Detecting Malicious TCP Network Flows Based on Benford's Law","license":"http://creativecommons.org/licenses/by-nc-sa/4.0/","headline":"","cross_cats":["cs.AI","cs.NI"],"primary_cat":"cs.CR","authors_text":"Aamo Iorliam, Adrian Waller, Anthony T.S. Ho, Norman Poh, Santosh Tirunagari, Shujun Li","submitted_at":"2016-09-14T10:51:00Z","abstract_excerpt":"Statistical characteristics of network traffic have attracted a significant amount of research for automated network intrusion detection, some of which looked at applications of natural statistical laws such as Zipf's law, Benford's law and the Pareto distribution. In this paper, we present the application of Benford's law to a new network flow metric \"flow size difference\", which have not been studied before by other researchers, to build an unsupervised flow-based intrusion detection system (IDS). The method was inspired by our observation on a large number of TCP flow datasets where normal "},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"1609.04214","kind":"arxiv","version":2},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-05-18T00:52:25Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"Be/sHFAC0eUuhxzSt/PrFmaHOT6Fv5Zdz64c1qZP6ZLjO+MFzRXzi3r15ceCxXxEKZW6FvGz6fIPaAAQE0l9CQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-05-27T03:58:54.927845Z"},"content_sha256":"32cb7dc56a563ba61f93da7a41e5422eb1b2563515f4d642c25387fe402f588d","schema_version":"1.0","event_id":"sha256:32cb7dc56a563ba61f93da7a41e5422eb1b2563515f4d642c25387fe402f588d"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/NXA63FE6EVYUAKZUCHWFY6MNWS/bundle.json","state_url":"https://pith.science/pith/NXA63FE6EVYUAKZUCHWFY6MNWS/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/NXA63FE6EVYUAKZUCHWFY6MNWS/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-05-27T03:58:54Z","links":{"resolver":"https://pith.science/pith/NXA63FE6EVYUAKZUCHWFY6MNWS","bundle":"https://pith.science/pith/NXA63FE6EVYUAKZUCHWFY6MNWS/bundle.json","state":"https://pith.science/pith/NXA63FE6EVYUAKZUCHWFY6MNWS/state.json","well_known_bundle":"https://pith.science/.well-known/pith/NXA63FE6EVYUAKZUCHWFY6MNWS/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2016:NXA63FE6EVYUAKZUCHWFY6MNWS","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"548bd8d798ca149400ce018d43f10368b55f05c517337cbc5299d2a620bba583","cross_cats_sorted":["cs.AI","cs.NI"],"license":"http://creativecommons.org/licenses/by-nc-sa/4.0/","primary_cat":"cs.CR","submitted_at":"2016-09-14T10:51:00Z","title_canon_sha256":"5c26565a3d52e9e233f4552b877ef1f8a422ff8abee826092d917d95f543a6e5"},"schema_version":"1.0","source":{"id":"1609.04214","kind":"arxiv","version":2}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"1609.04214","created_at":"2026-05-18T00:52:25Z"},{"alias_kind":"arxiv_version","alias_value":"1609.04214v2","created_at":"2026-05-18T00:52:25Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.1609.04214","created_at":"2026-05-18T00:52:25Z"},{"alias_kind":"pith_short_12","alias_value":"NXA63FE6EVYU","created_at":"2026-05-18T12:30:36Z"},{"alias_kind":"pith_short_16","alias_value":"NXA63FE6EVYUAKZU","created_at":"2026-05-18T12:30:36Z"},{"alias_kind":"pith_short_8","alias_value":"NXA63FE6","created_at":"2026-05-18T12:30:36Z"}],"graph_snapshots":[{"event_id":"sha256:32cb7dc56a563ba61f93da7a41e5422eb1b2563515f4d642c25387fe402f588d","target":"graph","created_at":"2026-05-18T00:52:25Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"paper":{"abstract_excerpt":"Statistical characteristics of network traffic have attracted a significant amount of research for automated network intrusion detection, some of which looked at applications of natural statistical laws such as Zipf's law, Benford's law and the Pareto distribution. In this paper, we present the application of Benford's law to a new network flow metric \"flow size difference\", which have not been studied before by other researchers, to build an unsupervised flow-based intrusion detection system (IDS). The method was inspired by our observation on a large number of TCP flow datasets where normal ","authors_text":"Aamo Iorliam, Adrian Waller, Anthony T.S. Ho, Norman Poh, Santosh Tirunagari, Shujun Li","cross_cats":["cs.AI","cs.NI"],"headline":"","license":"http://creativecommons.org/licenses/by-nc-sa/4.0/","primary_cat":"cs.CR","submitted_at":"2016-09-14T10:51:00Z","title":"\"Flow Size Difference\" Can Make a Difference: Detecting Malicious TCP Network Flows Based on Benford's Law"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"1609.04214","kind":"arxiv","version":2},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:9be2bac1990dc1e0919a3de8ff96bac66dae776b4cf7dc48a729b244412c7f43","target":"record","created_at":"2026-05-18T00:52:25Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"548bd8d798ca149400ce018d43f10368b55f05c517337cbc5299d2a620bba583","cross_cats_sorted":["cs.AI","cs.NI"],"license":"http://creativecommons.org/licenses/by-nc-sa/4.0/","primary_cat":"cs.CR","submitted_at":"2016-09-14T10:51:00Z","title_canon_sha256":"5c26565a3d52e9e233f4552b877ef1f8a422ff8abee826092d917d95f543a6e5"},"schema_version":"1.0","source":{"id":"1609.04214","kind":"arxiv","version":2}},"canonical_sha256":"6dc1ed949e2571402b3411ec5c798db4bd930dcc21a052345161d874a90d1fea","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"6dc1ed949e2571402b3411ec5c798db4bd930dcc21a052345161d874a90d1fea","first_computed_at":"2026-05-18T00:52:25.341883Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-05-18T00:52:25.341883Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"SaAkmSSzv/ExAb71zyc4Jjd0LIqGnD/kYgzw0UhF8WyYv5IF2c1YVhLGkM0BgFHbiI8DAYYu51e2PYC+FSLqCQ==","signature_status":"signed_v1","signed_at":"2026-05-18T00:52:25.342564Z","signed_message":"canonical_sha256_bytes"},"source_id":"1609.04214","source_kind":"arxiv","source_version":2}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:9be2bac1990dc1e0919a3de8ff96bac66dae776b4cf7dc48a729b244412c7f43","sha256:32cb7dc56a563ba61f93da7a41e5422eb1b2563515f4d642c25387fe402f588d"],"state_sha256":"a1555ad33d56bbdf8704e9a21cee647bfa2c902e0a780ca0791f32ed3ff476d9"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"kgBiV82+Z8Ux2m6qssLd9VYfnge4hfCfKPKghEHNjYt5KjZ+7E2J2+dt/CMyeo6hCyRVOLKlXGtyQ5sQp5tDBQ==","signed_message":"bundle_sha256_bytes","signed_at":"2026-05-27T03:58:54.931597Z","bundle_sha256":"aeb1667a90d4e37806b0ca4528ca60cedda9118849fc173bb9819654dc8a6eea"}}