{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2025:OX4NWQ6E2KLRPP2OOETYTSCJBG","short_pith_number":"pith:OX4NWQ6E","canonical_record":{"source":{"id":"2508.18684","kind":"arxiv","version":2},"metadata":{"license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","primary_cat":"cs.CR","submitted_at":"2025-08-26T05:08:53Z","cross_cats_sorted":["cs.AI","cs.CL","cs.LG","cs.SY","eess.SY"],"title_canon_sha256":"f72ae80255affd7c4153a05d0d55287b4986e7bbdf89efcce8d680b58eef25b5","abstract_canon_sha256":"33f6ca5783bc075b3c4a53b8e0514d50d9848a79c42cb133289408a708731bbd"},"schema_version":"1.0"},"canonical_sha256":"75f8db43c4d29717bf4e712789c849099a2456baeb6c3d6b99504ed1bfc6378a","source":{"kind":"arxiv","id":"2508.18684","version":2},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2508.18684","created_at":"2026-06-24T01:14:21Z"},{"alias_kind":"arxiv_version","alias_value":"2508.18684v2","created_at":"2026-06-24T01:14:21Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2508.18684","created_at":"2026-06-24T01:14:21Z"},{"alias_kind":"pith_short_12","alias_value":"OX4NWQ6E2KLR","created_at":"2026-06-24T01:14:21Z"},{"alias_kind":"pith_short_16","alias_value":"OX4NWQ6E2KLRPP2O","created_at":"2026-06-24T01:14:21Z"},{"alias_kind":"pith_short_8","alias_value":"OX4NWQ6E","created_at":"2026-06-24T01:14:21Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2025:OX4NWQ6E2KLRPP2OOETYTSCJBG","target":"record","payload":{"canonical_record":{"source":{"id":"2508.18684","kind":"arxiv","version":2},"metadata":{"license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","primary_cat":"cs.CR","submitted_at":"2025-08-26T05:08:53Z","cross_cats_sorted":["cs.AI","cs.CL","cs.LG","cs.SY","eess.SY"],"title_canon_sha256":"f72ae80255affd7c4153a05d0d55287b4986e7bbdf89efcce8d680b58eef25b5","abstract_canon_sha256":"33f6ca5783bc075b3c4a53b8e0514d50d9848a79c42cb133289408a708731bbd"},"schema_version":"1.0"},"canonical_sha256":"75f8db43c4d29717bf4e712789c849099a2456baeb6c3d6b99504ed1bfc6378a","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-06-24T01:14:21.848046Z","signature_b64":"iTBcVsHdvZNDWOMS4EpM9IzOW01yotYRQT5lUOswKNAyGZgbxf7hs4WRRcdPhm+3d8dPcmDZ9qwSNWalvZt+Dg==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"75f8db43c4d29717bf4e712789c849099a2456baeb6c3d6b99504ed1bfc6378a","last_reissued_at":"2026-06-24T01:14:21.847555Z","signature_status":"signed_v1","first_computed_at":"2026-06-24T01:14:21.847555Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2508.18684","source_version":2,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-06-24T01:14:21Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"fMIxb52Zs9kwN5RYUoS4CZhOSgtafWgRUmZO5tuPvqaFgiuLShXayURIo2qH3cemUuMOvdjQoVoRVJ3vtjE7BQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-06-27T12:34:06.966377Z"},"content_sha256":"a0c84c62c62e1bfed7ea788108f557fef619245b9b788f757b885e4a9fc8854b","schema_version":"1.0","event_id":"sha256:a0c84c62c62e1bfed7ea788108f557fef619245b9b788f757b885e4a9fc8854b"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2025:OX4NWQ6E2KLRPP2OOETYTSCJBG","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"FALCON: Transforming Cyber Threat Intelligence into Deployable IDS Rules with Self-Reflection","license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","headline":"","cross_cats":["cs.AI","cs.CL","cs.LG","cs.SY","eess.SY"],"primary_cat":"cs.CR","authors_text":"Aritran Piplai, Edward Zieglar, Martin Duclos, Md Rayhanur Rahman, Shahram Rahimi, Shaswata Mitra, Subash Neupane, Sudip Mittal","submitted_at":"2025-08-26T05:08:53Z","abstract_excerpt":"Signature-based Intrusion Detection Systems (IDS) detect malicious activity by matching network or host events against predefined rules. Security analysts manually develop these rules from Cyber Threat Intelligence (CTI). As threats evolve, this manual pipeline faces two bottlenecks. Before authoring a new rule, an analyst must reconcile the incoming CTI with the existing rule base and determine whether to create, update, or retire one. This process is challenging due to the representational differences between the CTI and Rule formats. This gap limits the effectiveness of keyword- and embeddi"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2508.18684","kind":"arxiv","version":2},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2508.18684/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-06-24T01:14:21Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"ZOnzcdWVQnwuVSAXs7dLwvNy7rwhVGmJIk+MEAj3vFF2LkbeHaqBgSqXDN+aBEu6MdhhvpSZI6g6EnQ56TGDDQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-06-27T12:34:06.966758Z"},"content_sha256":"a4e120a9d5bd94df9b752a7804d702b480e660fe2a2d8e8d839cf6b82b94cc9f","schema_version":"1.0","event_id":"sha256:a4e120a9d5bd94df9b752a7804d702b480e660fe2a2d8e8d839cf6b82b94cc9f"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/OX4NWQ6E2KLRPP2OOETYTSCJBG/bundle.json","state_url":"https://pith.science/pith/OX4NWQ6E2KLRPP2OOETYTSCJBG/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/OX4NWQ6E2KLRPP2OOETYTSCJBG/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-06-27T12:34:06Z","links":{"resolver":"https://pith.science/pith/OX4NWQ6E2KLRPP2OOETYTSCJBG","bundle":"https://pith.science/pith/OX4NWQ6E2KLRPP2OOETYTSCJBG/bundle.json","state":"https://pith.science/pith/OX4NWQ6E2KLRPP2OOETYTSCJBG/state.json","well_known_bundle":"https://pith.science/.well-known/pith/OX4NWQ6E2KLRPP2OOETYTSCJBG/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2025:OX4NWQ6E2KLRPP2OOETYTSCJBG","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"33f6ca5783bc075b3c4a53b8e0514d50d9848a79c42cb133289408a708731bbd","cross_cats_sorted":["cs.AI","cs.CL","cs.LG","cs.SY","eess.SY"],"license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","primary_cat":"cs.CR","submitted_at":"2025-08-26T05:08:53Z","title_canon_sha256":"f72ae80255affd7c4153a05d0d55287b4986e7bbdf89efcce8d680b58eef25b5"},"schema_version":"1.0","source":{"id":"2508.18684","kind":"arxiv","version":2}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2508.18684","created_at":"2026-06-24T01:14:21Z"},{"alias_kind":"arxiv_version","alias_value":"2508.18684v2","created_at":"2026-06-24T01:14:21Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2508.18684","created_at":"2026-06-24T01:14:21Z"},{"alias_kind":"pith_short_12","alias_value":"OX4NWQ6E2KLR","created_at":"2026-06-24T01:14:21Z"},{"alias_kind":"pith_short_16","alias_value":"OX4NWQ6E2KLRPP2O","created_at":"2026-06-24T01:14:21Z"},{"alias_kind":"pith_short_8","alias_value":"OX4NWQ6E","created_at":"2026-06-24T01:14:21Z"}],"graph_snapshots":[{"event_id":"sha256:a4e120a9d5bd94df9b752a7804d702b480e660fe2a2d8e8d839cf6b82b94cc9f","target":"graph","created_at":"2026-06-24T01:14:21Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2508.18684/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Signature-based Intrusion Detection Systems (IDS) detect malicious activity by matching network or host events against predefined rules. Security analysts manually develop these rules from Cyber Threat Intelligence (CTI). As threats evolve, this manual pipeline faces two bottlenecks. Before authoring a new rule, an analyst must reconcile the incoming CTI with the existing rule base and determine whether to create, update, or retire one. This process is challenging due to the representational differences between the CTI and Rule formats. This gap limits the effectiveness of keyword- and embeddi","authors_text":"Aritran Piplai, Edward Zieglar, Martin Duclos, Md Rayhanur Rahman, Shahram Rahimi, Shaswata Mitra, Subash Neupane, Sudip Mittal","cross_cats":["cs.AI","cs.CL","cs.LG","cs.SY","eess.SY"],"headline":"","license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","primary_cat":"cs.CR","submitted_at":"2025-08-26T05:08:53Z","title":"FALCON: Transforming Cyber Threat Intelligence into Deployable IDS Rules with Self-Reflection"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2508.18684","kind":"arxiv","version":2},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:a0c84c62c62e1bfed7ea788108f557fef619245b9b788f757b885e4a9fc8854b","target":"record","created_at":"2026-06-24T01:14:21Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"33f6ca5783bc075b3c4a53b8e0514d50d9848a79c42cb133289408a708731bbd","cross_cats_sorted":["cs.AI","cs.CL","cs.LG","cs.SY","eess.SY"],"license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","primary_cat":"cs.CR","submitted_at":"2025-08-26T05:08:53Z","title_canon_sha256":"f72ae80255affd7c4153a05d0d55287b4986e7bbdf89efcce8d680b58eef25b5"},"schema_version":"1.0","source":{"id":"2508.18684","kind":"arxiv","version":2}},"canonical_sha256":"75f8db43c4d29717bf4e712789c849099a2456baeb6c3d6b99504ed1bfc6378a","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"75f8db43c4d29717bf4e712789c849099a2456baeb6c3d6b99504ed1bfc6378a","first_computed_at":"2026-06-24T01:14:21.847555Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-06-24T01:14:21.847555Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"iTBcVsHdvZNDWOMS4EpM9IzOW01yotYRQT5lUOswKNAyGZgbxf7hs4WRRcdPhm+3d8dPcmDZ9qwSNWalvZt+Dg==","signature_status":"signed_v1","signed_at":"2026-06-24T01:14:21.848046Z","signed_message":"canonical_sha256_bytes"},"source_id":"2508.18684","source_kind":"arxiv","source_version":2}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:a0c84c62c62e1bfed7ea788108f557fef619245b9b788f757b885e4a9fc8854b","sha256:a4e120a9d5bd94df9b752a7804d702b480e660fe2a2d8e8d839cf6b82b94cc9f"],"state_sha256":"d2ce010a0b4d1bac30eb479bba7682c4f8d3cfde1b9f70fcf936b02442939b6c"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"cQv1yuiPkWg+tt5LJeHD2JJWzU3y8XgaOlScPdc3tck4lPcsreWergefnmfp7Ro3hLrd63URo+5S8zWa+tuXDg==","signed_message":"bundle_sha256_bytes","signed_at":"2026-06-27T12:34:06.969072Z","bundle_sha256":"81c4952c5ff27ac6db524b81b136a82ee56ef2c557b9b2ddd70f1ba0345e7fa0"}}