{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2025:PAU7DO5ADRD2IDJ3WYSGNUFRPI","short_pith_number":"pith:PAU7DO5A","canonical_record":{"source":{"id":"2504.09115","kind":"arxiv","version":4},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2025-04-12T07:58:54Z","cross_cats_sorted":["cs.SE"],"title_canon_sha256":"a423d65fc076cf226d02b8fd51843b6087eb3eaf779e6fc02339b03353bb8afb","abstract_canon_sha256":"327b79fd3c5b3323f5221dcf88ddef932764ff39ec32037a40b311c1cbb735b1"},"schema_version":"1.0"},"canonical_sha256":"7829f1bba01c47a40d3bb62466d0b17a1003cd2b3e56b26a39417bd3a2e65890","source":{"kind":"arxiv","id":"2504.09115","version":4},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2504.09115","created_at":"2026-07-05T10:55:34Z"},{"alias_kind":"arxiv_version","alias_value":"2504.09115v4","created_at":"2026-07-05T10:55:34Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2504.09115","created_at":"2026-07-05T10:55:34Z"},{"alias_kind":"pith_short_12","alias_value":"PAU7DO5ADRD2","created_at":"2026-07-05T10:55:34Z"},{"alias_kind":"pith_short_16","alias_value":"PAU7DO5ADRD2IDJ3","created_at":"2026-07-05T10:55:34Z"},{"alias_kind":"pith_short_8","alias_value":"PAU7DO5A","created_at":"2026-07-05T10:55:34Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2025:PAU7DO5ADRD2IDJ3WYSGNUFRPI","target":"record","payload":{"canonical_record":{"source":{"id":"2504.09115","kind":"arxiv","version":4},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2025-04-12T07:58:54Z","cross_cats_sorted":["cs.SE"],"title_canon_sha256":"a423d65fc076cf226d02b8fd51843b6087eb3eaf779e6fc02339b03353bb8afb","abstract_canon_sha256":"327b79fd3c5b3323f5221dcf88ddef932764ff39ec32037a40b311c1cbb735b1"},"schema_version":"1.0"},"canonical_sha256":"7829f1bba01c47a40d3bb62466d0b17a1003cd2b3e56b26a39417bd3a2e65890","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T10:55:34.098743Z","signature_b64":"+V+8ZScWu8FItagb4EpsPnK/Gt7JSbaeblobdZaTvJZdZhbb+4/HlEYsRp3IkDisSFNiklPxVUruhZJ/MQsdCg==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"7829f1bba01c47a40d3bb62466d0b17a1003cd2b3e56b26a39417bd3a2e65890","last_reissued_at":"2026-07-05T10:55:34.098190Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T10:55:34.098190Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2504.09115","source_version":4,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T10:55:34Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"lRoiERDmrYzXPnqCYTTl/dCJ60MgRMtlz9tmuuQD4VlSvy3ClZzmnJFpFIZUbFYa8BblXQj+1C6TgvsbT5XfDA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-05T22:09:16.410707Z"},"content_sha256":"5653515e9156913acf70fb970694f4b26b637ae001ed6c02b0bf93a4064aa3a2","schema_version":"1.0","event_id":"sha256:5653515e9156913acf70fb970694f4b26b637ae001ed6c02b0bf93a4064aa3a2"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2025:PAU7DO5ADRD2IDJ3WYSGNUFRPI","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"CAShift: Benchmarking Log-Based Cloud Attack Detection under Normality Shift","license":"http://creativecommons.org/licenses/by/4.0/","headline":"","cross_cats":["cs.SE"],"primary_cat":"cs.CR","authors_text":"Bowen Zhang, Frank Liauw, Jiongchi Yu, Lei Ma, Qiang Hu, Ruitao Feng, Xiaofei Xie, Yun Lin, Ziming Zhao","submitted_at":"2025-04-12T07:58:54Z","abstract_excerpt":"With the rapid advancement of cloud-native computing, securing cloud environments has become an important task. Log-based Anomaly Detection (LAD) is the most representative technique used in different systems for attack detection and safety guarantee, where multiple LAD methods and relevant datasets have been proposed. However, even though some of these datasets are specifically prepared for cloud systems, they only cover limited cloud behaviors and lack information from a whole-system perspective. Another critical issue to consider is normality shift, which implies that the test distribution "},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2504.09115","kind":"arxiv","version":4},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2504.09115/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T10:55:34Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"GK2GrQOGOMzK2a1wJyzy4LsKdTc90vkxN8D58LfxJVB/1eMOdWfOBjb5dhejNjDjWxKdEUy4ct+hBWh6d24fBg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-05T22:09:16.411574Z"},"content_sha256":"b734da778b0a8534d60449c12551645f2f04761b5f0493c7a279afea0669dfc7","schema_version":"1.0","event_id":"sha256:b734da778b0a8534d60449c12551645f2f04761b5f0493c7a279afea0669dfc7"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/PAU7DO5ADRD2IDJ3WYSGNUFRPI/bundle.json","state_url":"https://pith.science/pith/PAU7DO5ADRD2IDJ3WYSGNUFRPI/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/PAU7DO5ADRD2IDJ3WYSGNUFRPI/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-05T22:09:16Z","links":{"resolver":"https://pith.science/pith/PAU7DO5ADRD2IDJ3WYSGNUFRPI","bundle":"https://pith.science/pith/PAU7DO5ADRD2IDJ3WYSGNUFRPI/bundle.json","state":"https://pith.science/pith/PAU7DO5ADRD2IDJ3WYSGNUFRPI/state.json","well_known_bundle":"https://pith.science/.well-known/pith/PAU7DO5ADRD2IDJ3WYSGNUFRPI/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2025:PAU7DO5ADRD2IDJ3WYSGNUFRPI","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"327b79fd3c5b3323f5221dcf88ddef932764ff39ec32037a40b311c1cbb735b1","cross_cats_sorted":["cs.SE"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2025-04-12T07:58:54Z","title_canon_sha256":"a423d65fc076cf226d02b8fd51843b6087eb3eaf779e6fc02339b03353bb8afb"},"schema_version":"1.0","source":{"id":"2504.09115","kind":"arxiv","version":4}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2504.09115","created_at":"2026-07-05T10:55:34Z"},{"alias_kind":"arxiv_version","alias_value":"2504.09115v4","created_at":"2026-07-05T10:55:34Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2504.09115","created_at":"2026-07-05T10:55:34Z"},{"alias_kind":"pith_short_12","alias_value":"PAU7DO5ADRD2","created_at":"2026-07-05T10:55:34Z"},{"alias_kind":"pith_short_16","alias_value":"PAU7DO5ADRD2IDJ3","created_at":"2026-07-05T10:55:34Z"},{"alias_kind":"pith_short_8","alias_value":"PAU7DO5A","created_at":"2026-07-05T10:55:34Z"}],"graph_snapshots":[{"event_id":"sha256:b734da778b0a8534d60449c12551645f2f04761b5f0493c7a279afea0669dfc7","target":"graph","created_at":"2026-07-05T10:55:34Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2504.09115/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"With the rapid advancement of cloud-native computing, securing cloud environments has become an important task. Log-based Anomaly Detection (LAD) is the most representative technique used in different systems for attack detection and safety guarantee, where multiple LAD methods and relevant datasets have been proposed. However, even though some of these datasets are specifically prepared for cloud systems, they only cover limited cloud behaviors and lack information from a whole-system perspective. Another critical issue to consider is normality shift, which implies that the test distribution ","authors_text":"Bowen Zhang, Frank Liauw, Jiongchi Yu, Lei Ma, Qiang Hu, Ruitao Feng, Xiaofei Xie, Yun Lin, Ziming Zhao","cross_cats":["cs.SE"],"headline":"","license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2025-04-12T07:58:54Z","title":"CAShift: Benchmarking Log-Based Cloud Attack Detection under Normality Shift"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2504.09115","kind":"arxiv","version":4},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:5653515e9156913acf70fb970694f4b26b637ae001ed6c02b0bf93a4064aa3a2","target":"record","created_at":"2026-07-05T10:55:34Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"327b79fd3c5b3323f5221dcf88ddef932764ff39ec32037a40b311c1cbb735b1","cross_cats_sorted":["cs.SE"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2025-04-12T07:58:54Z","title_canon_sha256":"a423d65fc076cf226d02b8fd51843b6087eb3eaf779e6fc02339b03353bb8afb"},"schema_version":"1.0","source":{"id":"2504.09115","kind":"arxiv","version":4}},"canonical_sha256":"7829f1bba01c47a40d3bb62466d0b17a1003cd2b3e56b26a39417bd3a2e65890","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"7829f1bba01c47a40d3bb62466d0b17a1003cd2b3e56b26a39417bd3a2e65890","first_computed_at":"2026-07-05T10:55:34.098190Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T10:55:34.098190Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"+V+8ZScWu8FItagb4EpsPnK/Gt7JSbaeblobdZaTvJZdZhbb+4/HlEYsRp3IkDisSFNiklPxVUruhZJ/MQsdCg==","signature_status":"signed_v1","signed_at":"2026-07-05T10:55:34.098743Z","signed_message":"canonical_sha256_bytes"},"source_id":"2504.09115","source_kind":"arxiv","source_version":4}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:5653515e9156913acf70fb970694f4b26b637ae001ed6c02b0bf93a4064aa3a2","sha256:b734da778b0a8534d60449c12551645f2f04761b5f0493c7a279afea0669dfc7"],"state_sha256":"b4219277e041751f9a005a64654cf134ec46c8948572ab400b9524378c89c084"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"mXW+iqZjjaipuHG0dyBJVayJUKmxfGJqf9zoFgzRI2MwKdTV5r5rVPShEhTmhpWFrRc7UyyRHCHOBRAO7qzUDQ==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-05T22:09:16.416622Z","bundle_sha256":"916cf45c4c0c326e6246fd29dbb7366d35f21e0320005579ceeaec2bb2943234"}}