{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2016:QPLQOO5FXWCYPHNJCDI3PTZTO5","short_pith_number":"pith:QPLQOO5F","canonical_record":{"source":{"id":"1609.06676","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2016-09-21T18:44:48Z","cross_cats_sorted":[],"title_canon_sha256":"f2fc365722a38f9f9d511fbf3775fd87b8c3c9ffa47992811f4b1ffc3ef3abe8","abstract_canon_sha256":"229351d2e6dd41ff85ee59916b15b09c4074ef82b8c6a05491a9931fd593d89c"},"schema_version":"1.0"},"canonical_sha256":"83d7073ba5bd85879da910d1b7cf337763ad0dfef1e827e9a2afe233ba45ae11","source":{"kind":"arxiv","id":"1609.06676","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"1609.06676","created_at":"2026-05-18T01:04:06Z"},{"alias_kind":"arxiv_version","alias_value":"1609.06676v1","created_at":"2026-05-18T01:04:06Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.1609.06676","created_at":"2026-05-18T01:04:06Z"},{"alias_kind":"pith_short_12","alias_value":"QPLQOO5FXWCY","created_at":"2026-05-18T12:30:41Z"},{"alias_kind":"pith_short_16","alias_value":"QPLQOO5FXWCYPHNJ","created_at":"2026-05-18T12:30:41Z"},{"alias_kind":"pith_short_8","alias_value":"QPLQOO5F","created_at":"2026-05-18T12:30:41Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2016:QPLQOO5FXWCYPHNJCDI3PTZTO5","target":"record","payload":{"canonical_record":{"source":{"id":"1609.06676","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2016-09-21T18:44:48Z","cross_cats_sorted":[],"title_canon_sha256":"f2fc365722a38f9f9d511fbf3775fd87b8c3c9ffa47992811f4b1ffc3ef3abe8","abstract_canon_sha256":"229351d2e6dd41ff85ee59916b15b09c4074ef82b8c6a05491a9931fd593d89c"},"schema_version":"1.0"},"canonical_sha256":"83d7073ba5bd85879da910d1b7cf337763ad0dfef1e827e9a2afe233ba45ae11","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-05-18T01:04:06.212962Z","signature_b64":"DkTtGSHCQT7fcHMW2t/QzXhGj7quONeZRqtMBbNgy3O7m+9L1CAJaSjzVLRvkEDKTthRSHTbhepQT/G7tbiPAA==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"83d7073ba5bd85879da910d1b7cf337763ad0dfef1e827e9a2afe233ba45ae11","last_reissued_at":"2026-05-18T01:04:06.212439Z","signature_status":"signed_v1","first_computed_at":"2026-05-18T01:04:06.212439Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"1609.06676","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-05-18T01:04:06Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"omt1Z5ellfKXRCe3/E7Z9FgOmmd4C/kg/g+Snx9VZL28V+PXbyPIMjtG3CPkuyBNPXHO2KlZtl+zZjg8h2SxCA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-05-30T00:49:53.937372Z"},"content_sha256":"17f326589b46647ca1ecdc0f5f7d9bec0dc213330e1dc23318f1be268c57921a","schema_version":"1.0","event_id":"sha256:17f326589b46647ca1ecdc0f5f7d9bec0dc213330e1dc23318f1be268c57921a"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2016:QPLQOO5FXWCYPHNJCDI3PTZTO5","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Detecting Anomalous User Behavior Using an Extended Isolation Forest Algorithm: An Enterprise Case Study","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":[],"primary_cat":"cs.CR","authors_text":"Asha Rao, Li Sun, Serdar Boztas, Steven Versteeg","submitted_at":"2016-09-21T18:44:48Z","abstract_excerpt":"Anomalous user behavior detection is the core component of many information security systems, such as intrusion detection, insider threat detection and authentication systems. Anomalous behavior will raise an alarm to the system administrator and can be further combined with other information to determine whether it constitutes an unauthorised or malicious use of a resource. This paper presents an anomalous user behaviour detection framework that applies an extended version of Isolation Forest algorithm. Our method is fast and scalable and does not require example anomalies in the training dat"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"1609.06676","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-05-18T01:04:06Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"7Vv86hNmm9tCoq2YVqS/eeuKrMeF6qPr3p3PDliEvowo0jrQqb+pYLyhOAyphcg2nE+kB2pjirxTYifBvGq7Cg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-05-30T00:49:53.937727Z"},"content_sha256":"b0bfa42931a31ff960f59a0f559efe9ad4e43a9af2685deff0d6817e76e84687","schema_version":"1.0","event_id":"sha256:b0bfa42931a31ff960f59a0f559efe9ad4e43a9af2685deff0d6817e76e84687"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/QPLQOO5FXWCYPHNJCDI3PTZTO5/bundle.json","state_url":"https://pith.science/pith/QPLQOO5FXWCYPHNJCDI3PTZTO5/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/QPLQOO5FXWCYPHNJCDI3PTZTO5/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-05-30T00:49:53Z","links":{"resolver":"https://pith.science/pith/QPLQOO5FXWCYPHNJCDI3PTZTO5","bundle":"https://pith.science/pith/QPLQOO5FXWCYPHNJCDI3PTZTO5/bundle.json","state":"https://pith.science/pith/QPLQOO5FXWCYPHNJCDI3PTZTO5/state.json","well_known_bundle":"https://pith.science/.well-known/pith/QPLQOO5FXWCYPHNJCDI3PTZTO5/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2016:QPLQOO5FXWCYPHNJCDI3PTZTO5","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"229351d2e6dd41ff85ee59916b15b09c4074ef82b8c6a05491a9931fd593d89c","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2016-09-21T18:44:48Z","title_canon_sha256":"f2fc365722a38f9f9d511fbf3775fd87b8c3c9ffa47992811f4b1ffc3ef3abe8"},"schema_version":"1.0","source":{"id":"1609.06676","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"1609.06676","created_at":"2026-05-18T01:04:06Z"},{"alias_kind":"arxiv_version","alias_value":"1609.06676v1","created_at":"2026-05-18T01:04:06Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.1609.06676","created_at":"2026-05-18T01:04:06Z"},{"alias_kind":"pith_short_12","alias_value":"QPLQOO5FXWCY","created_at":"2026-05-18T12:30:41Z"},{"alias_kind":"pith_short_16","alias_value":"QPLQOO5FXWCYPHNJ","created_at":"2026-05-18T12:30:41Z"},{"alias_kind":"pith_short_8","alias_value":"QPLQOO5F","created_at":"2026-05-18T12:30:41Z"}],"graph_snapshots":[{"event_id":"sha256:b0bfa42931a31ff960f59a0f559efe9ad4e43a9af2685deff0d6817e76e84687","target":"graph","created_at":"2026-05-18T01:04:06Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"paper":{"abstract_excerpt":"Anomalous user behavior detection is the core component of many information security systems, such as intrusion detection, insider threat detection and authentication systems. Anomalous behavior will raise an alarm to the system administrator and can be further combined with other information to determine whether it constitutes an unauthorised or malicious use of a resource. This paper presents an anomalous user behaviour detection framework that applies an extended version of Isolation Forest algorithm. Our method is fast and scalable and does not require example anomalies in the training dat","authors_text":"Asha Rao, Li Sun, Serdar Boztas, Steven Versteeg","cross_cats":[],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2016-09-21T18:44:48Z","title":"Detecting Anomalous User Behavior Using an Extended Isolation Forest Algorithm: An Enterprise Case Study"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"1609.06676","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:17f326589b46647ca1ecdc0f5f7d9bec0dc213330e1dc23318f1be268c57921a","target":"record","created_at":"2026-05-18T01:04:06Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"229351d2e6dd41ff85ee59916b15b09c4074ef82b8c6a05491a9931fd593d89c","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2016-09-21T18:44:48Z","title_canon_sha256":"f2fc365722a38f9f9d511fbf3775fd87b8c3c9ffa47992811f4b1ffc3ef3abe8"},"schema_version":"1.0","source":{"id":"1609.06676","kind":"arxiv","version":1}},"canonical_sha256":"83d7073ba5bd85879da910d1b7cf337763ad0dfef1e827e9a2afe233ba45ae11","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"83d7073ba5bd85879da910d1b7cf337763ad0dfef1e827e9a2afe233ba45ae11","first_computed_at":"2026-05-18T01:04:06.212439Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-05-18T01:04:06.212439Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"DkTtGSHCQT7fcHMW2t/QzXhGj7quONeZRqtMBbNgy3O7m+9L1CAJaSjzVLRvkEDKTthRSHTbhepQT/G7tbiPAA==","signature_status":"signed_v1","signed_at":"2026-05-18T01:04:06.212962Z","signed_message":"canonical_sha256_bytes"},"source_id":"1609.06676","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:17f326589b46647ca1ecdc0f5f7d9bec0dc213330e1dc23318f1be268c57921a","sha256:b0bfa42931a31ff960f59a0f559efe9ad4e43a9af2685deff0d6817e76e84687"],"state_sha256":"203098084eb5d3b640526c85616045932ae0df04181b0121043995b7c22fd861"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"hzubAQuuopw82/sb8Ic4Rox1XG9InNd6Lojirl5Hp0Daw3XxKzKgwhPWIK7lMcaEgHOXWblwu6+xjbmtnkA3Bg==","signed_message":"bundle_sha256_bytes","signed_at":"2026-05-30T00:49:53.939928Z","bundle_sha256":"de4e9c895fda26d560299688c635ae9c824c94eb62dea2a52ee144285209d1a3"}}