{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2017:PJN36LHK3TAOII6ZBXPBQ2HN7Q","short_pith_number":"pith:PJN36LHK","canonical_record":{"source":{"id":"1710.00811","kind":"arxiv","version":2},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.NE","submitted_at":"2017-10-02T17:54:28Z","cross_cats_sorted":["cs.CR","cs.LG","stat.ML"],"title_canon_sha256":"4ba0e716ef5eb24d73d025e31339cf77889e21f9f227b546b376ac765a7e9afd","abstract_canon_sha256":"60599c5c71ea4b8d3e2305fe1e283ecbead2edbe9df3006b72a46b4bffdd6486"},"schema_version":"1.0"},"canonical_sha256":"7a5bbf2ceadcc0e423d90dde1868edfc36d78709c6e984bc0b8ae9fd68b752d8","source":{"kind":"arxiv","id":"1710.00811","version":2},"source_aliases":[{"alias_kind":"arxiv","alias_value":"1710.00811","created_at":"2026-05-18T00:27:52Z"},{"alias_kind":"arxiv_version","alias_value":"1710.00811v2","created_at":"2026-05-18T00:27:52Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.1710.00811","created_at":"2026-05-18T00:27:52Z"},{"alias_kind":"pith_short_12","alias_value":"PJN36LHK3TAO","created_at":"2026-05-18T12:31:37Z"},{"alias_kind":"pith_short_16","alias_value":"PJN36LHK3TAOII6Z","created_at":"2026-05-18T12:31:37Z"},{"alias_kind":"pith_short_8","alias_value":"PJN36LHK","created_at":"2026-05-18T12:31:37Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2017:PJN36LHK3TAOII6ZBXPBQ2HN7Q","target":"record","payload":{"canonical_record":{"source":{"id":"1710.00811","kind":"arxiv","version":2},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.NE","submitted_at":"2017-10-02T17:54:28Z","cross_cats_sorted":["cs.CR","cs.LG","stat.ML"],"title_canon_sha256":"4ba0e716ef5eb24d73d025e31339cf77889e21f9f227b546b376ac765a7e9afd","abstract_canon_sha256":"60599c5c71ea4b8d3e2305fe1e283ecbead2edbe9df3006b72a46b4bffdd6486"},"schema_version":"1.0"},"canonical_sha256":"7a5bbf2ceadcc0e423d90dde1868edfc36d78709c6e984bc0b8ae9fd68b752d8","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-05-18T00:27:52.137333Z","signature_b64":"GxjKUNY6AnR2HE937NYHcZtK5Wi9zLSL6E5E2LNTcDzG0MH205TXBLmglA+vWSVzvu1XEW06aWNChH1GFxNMDA==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"7a5bbf2ceadcc0e423d90dde1868edfc36d78709c6e984bc0b8ae9fd68b752d8","last_reissued_at":"2026-05-18T00:27:52.136587Z","signature_status":"signed_v1","first_computed_at":"2026-05-18T00:27:52.136587Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"1710.00811","source_version":2,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-05-18T00:27:52Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"PGojmgfUkpzt9x2IDEH6YFG7oAVepPlMzf7A/Z0EkqM1gpyOISPJpFo/c6N/4M1LJ+rmrX1GEN3uYO3vPVlzBw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-07-07T13:50:04.670017Z"},"content_sha256":"1052ef3c3ddfd5ccf17a2e9db7e411ddffd7ede8e947183f8396c529b93c77ba","schema_version":"1.0","event_id":"sha256:1052ef3c3ddfd5ccf17a2e9db7e411ddffd7ede8e947183f8396c529b93c77ba"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2017:PJN36LHK3TAOII6ZBXPBQ2HN7Q","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Deep Learning for Unsupervised Insider Threat Detection in Structured Cybersecurity Data Streams","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":["cs.CR","cs.LG","stat.ML"],"primary_cat":"cs.NE","authors_text":"Aaron Tuor, Brian Hutchinson, Nicole Nichols, Samuel Kaplan, Sean Robinson","submitted_at":"2017-10-02T17:54:28Z","abstract_excerpt":"Analysis of an organization's computer network activity is a key component of early detection and mitigation of insider threat, a growing concern for many organizations. Raw system logs are a prototypical example of streaming data that can quickly scale beyond the cognitive power of a human analyst. As a prospective filter for the human analyst, we present an online unsupervised deep learning approach to detect anomalous network activity from system logs in real time. Our models decompose anomaly scores into the contributions of individual user behavior features for increased interpretability "},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"1710.00811","kind":"arxiv","version":2},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-05-18T00:27:52Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"yRr1JeUxyCJt1gJur41akxECkavNB5cZ/ZCk6xpki0An0U9blA2xYrzJeYImQLi1+8zeU5eIfS5Wde4EMpVuAw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-07-07T13:50:04.670375Z"},"content_sha256":"56308fe9b5659f7b74acd073a94e4b59d15be52c8566c788362e62c9a80fc0b9","schema_version":"1.0","event_id":"sha256:56308fe9b5659f7b74acd073a94e4b59d15be52c8566c788362e62c9a80fc0b9"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/PJN36LHK3TAOII6ZBXPBQ2HN7Q/bundle.json","state_url":"https://pith.science/pith/PJN36LHK3TAOII6ZBXPBQ2HN7Q/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/PJN36LHK3TAOII6ZBXPBQ2HN7Q/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-07-07T13:50:04Z","links":{"resolver":"https://pith.science/pith/PJN36LHK3TAOII6ZBXPBQ2HN7Q","bundle":"https://pith.science/pith/PJN36LHK3TAOII6ZBXPBQ2HN7Q/bundle.json","state":"https://pith.science/pith/PJN36LHK3TAOII6ZBXPBQ2HN7Q/state.json","well_known_bundle":"https://pith.science/.well-known/pith/PJN36LHK3TAOII6ZBXPBQ2HN7Q/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2017:PJN36LHK3TAOII6ZBXPBQ2HN7Q","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"60599c5c71ea4b8d3e2305fe1e283ecbead2edbe9df3006b72a46b4bffdd6486","cross_cats_sorted":["cs.CR","cs.LG","stat.ML"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.NE","submitted_at":"2017-10-02T17:54:28Z","title_canon_sha256":"4ba0e716ef5eb24d73d025e31339cf77889e21f9f227b546b376ac765a7e9afd"},"schema_version":"1.0","source":{"id":"1710.00811","kind":"arxiv","version":2}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"1710.00811","created_at":"2026-05-18T00:27:52Z"},{"alias_kind":"arxiv_version","alias_value":"1710.00811v2","created_at":"2026-05-18T00:27:52Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.1710.00811","created_at":"2026-05-18T00:27:52Z"},{"alias_kind":"pith_short_12","alias_value":"PJN36LHK3TAO","created_at":"2026-05-18T12:31:37Z"},{"alias_kind":"pith_short_16","alias_value":"PJN36LHK3TAOII6Z","created_at":"2026-05-18T12:31:37Z"},{"alias_kind":"pith_short_8","alias_value":"PJN36LHK","created_at":"2026-05-18T12:31:37Z"}],"graph_snapshots":[{"event_id":"sha256:56308fe9b5659f7b74acd073a94e4b59d15be52c8566c788362e62c9a80fc0b9","target":"graph","created_at":"2026-05-18T00:27:52Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"paper":{"abstract_excerpt":"Analysis of an organization's computer network activity is a key component of early detection and mitigation of insider threat, a growing concern for many organizations. Raw system logs are a prototypical example of streaming data that can quickly scale beyond the cognitive power of a human analyst. As a prospective filter for the human analyst, we present an online unsupervised deep learning approach to detect anomalous network activity from system logs in real time. Our models decompose anomaly scores into the contributions of individual user behavior features for increased interpretability ","authors_text":"Aaron Tuor, Brian Hutchinson, Nicole Nichols, Samuel Kaplan, Sean Robinson","cross_cats":["cs.CR","cs.LG","stat.ML"],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.NE","submitted_at":"2017-10-02T17:54:28Z","title":"Deep Learning for Unsupervised Insider Threat Detection in Structured Cybersecurity Data Streams"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"1710.00811","kind":"arxiv","version":2},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:1052ef3c3ddfd5ccf17a2e9db7e411ddffd7ede8e947183f8396c529b93c77ba","target":"record","created_at":"2026-05-18T00:27:52Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"60599c5c71ea4b8d3e2305fe1e283ecbead2edbe9df3006b72a46b4bffdd6486","cross_cats_sorted":["cs.CR","cs.LG","stat.ML"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.NE","submitted_at":"2017-10-02T17:54:28Z","title_canon_sha256":"4ba0e716ef5eb24d73d025e31339cf77889e21f9f227b546b376ac765a7e9afd"},"schema_version":"1.0","source":{"id":"1710.00811","kind":"arxiv","version":2}},"canonical_sha256":"7a5bbf2ceadcc0e423d90dde1868edfc36d78709c6e984bc0b8ae9fd68b752d8","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"7a5bbf2ceadcc0e423d90dde1868edfc36d78709c6e984bc0b8ae9fd68b752d8","first_computed_at":"2026-05-18T00:27:52.136587Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-05-18T00:27:52.136587Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"GxjKUNY6AnR2HE937NYHcZtK5Wi9zLSL6E5E2LNTcDzG0MH205TXBLmglA+vWSVzvu1XEW06aWNChH1GFxNMDA==","signature_status":"signed_v1","signed_at":"2026-05-18T00:27:52.137333Z","signed_message":"canonical_sha256_bytes"},"source_id":"1710.00811","source_kind":"arxiv","source_version":2}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:1052ef3c3ddfd5ccf17a2e9db7e411ddffd7ede8e947183f8396c529b93c77ba","sha256:56308fe9b5659f7b74acd073a94e4b59d15be52c8566c788362e62c9a80fc0b9"],"state_sha256":"3388e5e9f826e147f5d65845ece98fb0abd06694aa856f6fb0cd25cd92156226"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"nOWW0oWhOnxYNux8C3gGhyWONa/P5++c+el0xRERstKZ4jkNSDnZSxEnR39kb67P6jUVfzIqMaT0eQ1Q0hmeCQ==","signed_message":"bundle_sha256_bytes","signed_at":"2026-07-07T13:50:04.672370Z","bundle_sha256":"21c871842191547daf7c21557273b7ae0b86e94bc5fa25426f70fa43f5a81cab"}}