{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2021:S3BWGANLYSRT72HDOUGI4UUSA3","short_pith_number":"pith:S3BWGANL","canonical_record":{"source":{"id":"2111.04333","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2021-11-08T08:48:26Z","cross_cats_sorted":["cs.LG"],"title_canon_sha256":"577f49caac690d7f47288fa4157c56d6f2fa5ec889b0cc98c2370f537a5f95b2","abstract_canon_sha256":"eafda33832f21b4dfb848c61f74848337cd196f5915067f64b42785975928c4a"},"schema_version":"1.0"},"canonical_sha256":"96c36301abc4a33fe8e3750c8e529206f90102940b358c8fe678bf8ab4333ae2","source":{"kind":"arxiv","id":"2111.04333","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2111.04333","created_at":"2026-07-05T10:43:32Z"},{"alias_kind":"arxiv_version","alias_value":"2111.04333v1","created_at":"2026-07-05T10:43:32Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2111.04333","created_at":"2026-07-05T10:43:32Z"},{"alias_kind":"pith_short_12","alias_value":"S3BWGANLYSRT","created_at":"2026-07-05T10:43:32Z"},{"alias_kind":"pith_short_16","alias_value":"S3BWGANLYSRT72HD","created_at":"2026-07-05T10:43:32Z"},{"alias_kind":"pith_short_8","alias_value":"S3BWGANL","created_at":"2026-07-05T10:43:32Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2021:S3BWGANLYSRT72HDOUGI4UUSA3","target":"record","payload":{"canonical_record":{"source":{"id":"2111.04333","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2021-11-08T08:48:26Z","cross_cats_sorted":["cs.LG"],"title_canon_sha256":"577f49caac690d7f47288fa4157c56d6f2fa5ec889b0cc98c2370f537a5f95b2","abstract_canon_sha256":"eafda33832f21b4dfb848c61f74848337cd196f5915067f64b42785975928c4a"},"schema_version":"1.0"},"canonical_sha256":"96c36301abc4a33fe8e3750c8e529206f90102940b358c8fe678bf8ab4333ae2","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T10:43:32.875935Z","signature_b64":"lOLgr87T5JyTyIjeWd0TczXN9ogPMA83EawvYCM1V/Krx8EclvVEwtTrGdFvtJmslfaLgj5SCiep4I1wG7L6Cw==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"96c36301abc4a33fe8e3750c8e529206f90102940b358c8fe678bf8ab4333ae2","last_reissued_at":"2026-07-05T10:43:32.875431Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T10:43:32.875431Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2111.04333","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T10:43:32Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"HLneTK0qOlUrPMCgkWPjUsdj3/JyJyLG5fwVJ/zY1fI7qD6yePYF69Cz8/WE9DQSYU6IGepBN/3rIeLFkTA9Bg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-07-07T14:26:15.179043Z"},"content_sha256":"df9ab446f643931061811369426782a8788b67d32cb777ef8ff93afc5ee63a30","schema_version":"1.0","event_id":"sha256:df9ab446f643931061811369426782a8788b67d32cb777ef8ff93afc5ee63a30"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2021:S3BWGANLYSRT72HDOUGI4UUSA3","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"threaTrace: Detecting and Tracing Host-based Threats in Node Level Through Provenance Graph Learning","license":"http://creativecommons.org/licenses/by/4.0/","headline":"","cross_cats":["cs.LG"],"primary_cat":"cs.CR","authors_text":"Dongqi Han, Han Zhang, Hongbin Sun, Jiahai Yang, Su Wang, Tao Zhou, Xia Yin, Xingang Shi, Zhiliang Wang","submitted_at":"2021-11-08T08:48:26Z","abstract_excerpt":"Host-based threats such as Program Attack, Malware Implantation, and Advanced Persistent Threats (APT), are commonly adopted by modern attackers. Recent studies propose leveraging the rich contextual information in data provenance to detect threats in a host. Data provenance is a directed acyclic graph constructed from system audit data. Nodes in a provenance graph represent system entities (e.g., $processes$ and $files$) and edges represent system calls in the direction of information flow. However, previous studies, which extract features of the whole provenance graph, are not sensitive to t"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2111.04333","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2111.04333/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T10:43:32Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"R1AHfk0HrX3fS/xR4QM13HWUUw8a5ULO/HZY9AfZ1tK62XCyYcE63bzTbmtfH1fxlbLWq2KAYXUNHaJeW1gQBA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-07-07T14:26:15.179428Z"},"content_sha256":"df44214a930bad4559dc5569efc89d693ea1bb710f564a5fe0a6a34acf649c4e","schema_version":"1.0","event_id":"sha256:df44214a930bad4559dc5569efc89d693ea1bb710f564a5fe0a6a34acf649c4e"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/S3BWGANLYSRT72HDOUGI4UUSA3/bundle.json","state_url":"https://pith.science/pith/S3BWGANLYSRT72HDOUGI4UUSA3/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/S3BWGANLYSRT72HDOUGI4UUSA3/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-07-07T14:26:15Z","links":{"resolver":"https://pith.science/pith/S3BWGANLYSRT72HDOUGI4UUSA3","bundle":"https://pith.science/pith/S3BWGANLYSRT72HDOUGI4UUSA3/bundle.json","state":"https://pith.science/pith/S3BWGANLYSRT72HDOUGI4UUSA3/state.json","well_known_bundle":"https://pith.science/.well-known/pith/S3BWGANLYSRT72HDOUGI4UUSA3/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2021:S3BWGANLYSRT72HDOUGI4UUSA3","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"eafda33832f21b4dfb848c61f74848337cd196f5915067f64b42785975928c4a","cross_cats_sorted":["cs.LG"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2021-11-08T08:48:26Z","title_canon_sha256":"577f49caac690d7f47288fa4157c56d6f2fa5ec889b0cc98c2370f537a5f95b2"},"schema_version":"1.0","source":{"id":"2111.04333","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2111.04333","created_at":"2026-07-05T10:43:32Z"},{"alias_kind":"arxiv_version","alias_value":"2111.04333v1","created_at":"2026-07-05T10:43:32Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2111.04333","created_at":"2026-07-05T10:43:32Z"},{"alias_kind":"pith_short_12","alias_value":"S3BWGANLYSRT","created_at":"2026-07-05T10:43:32Z"},{"alias_kind":"pith_short_16","alias_value":"S3BWGANLYSRT72HD","created_at":"2026-07-05T10:43:32Z"},{"alias_kind":"pith_short_8","alias_value":"S3BWGANL","created_at":"2026-07-05T10:43:32Z"}],"graph_snapshots":[{"event_id":"sha256:df44214a930bad4559dc5569efc89d693ea1bb710f564a5fe0a6a34acf649c4e","target":"graph","created_at":"2026-07-05T10:43:32Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2111.04333/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Host-based threats such as Program Attack, Malware Implantation, and Advanced Persistent Threats (APT), are commonly adopted by modern attackers. Recent studies propose leveraging the rich contextual information in data provenance to detect threats in a host. Data provenance is a directed acyclic graph constructed from system audit data. Nodes in a provenance graph represent system entities (e.g., $processes$ and $files$) and edges represent system calls in the direction of information flow. However, previous studies, which extract features of the whole provenance graph, are not sensitive to t","authors_text":"Dongqi Han, Han Zhang, Hongbin Sun, Jiahai Yang, Su Wang, Tao Zhou, Xia Yin, Xingang Shi, Zhiliang Wang","cross_cats":["cs.LG"],"headline":"","license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2021-11-08T08:48:26Z","title":"threaTrace: Detecting and Tracing Host-based Threats in Node Level Through Provenance Graph Learning"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2111.04333","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:df9ab446f643931061811369426782a8788b67d32cb777ef8ff93afc5ee63a30","target":"record","created_at":"2026-07-05T10:43:32Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"eafda33832f21b4dfb848c61f74848337cd196f5915067f64b42785975928c4a","cross_cats_sorted":["cs.LG"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2021-11-08T08:48:26Z","title_canon_sha256":"577f49caac690d7f47288fa4157c56d6f2fa5ec889b0cc98c2370f537a5f95b2"},"schema_version":"1.0","source":{"id":"2111.04333","kind":"arxiv","version":1}},"canonical_sha256":"96c36301abc4a33fe8e3750c8e529206f90102940b358c8fe678bf8ab4333ae2","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"96c36301abc4a33fe8e3750c8e529206f90102940b358c8fe678bf8ab4333ae2","first_computed_at":"2026-07-05T10:43:32.875431Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T10:43:32.875431Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"lOLgr87T5JyTyIjeWd0TczXN9ogPMA83EawvYCM1V/Krx8EclvVEwtTrGdFvtJmslfaLgj5SCiep4I1wG7L6Cw==","signature_status":"signed_v1","signed_at":"2026-07-05T10:43:32.875935Z","signed_message":"canonical_sha256_bytes"},"source_id":"2111.04333","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:df9ab446f643931061811369426782a8788b67d32cb777ef8ff93afc5ee63a30","sha256:df44214a930bad4559dc5569efc89d693ea1bb710f564a5fe0a6a34acf649c4e"],"state_sha256":"baa9a72f55a2d87c0e0af634daaf9330ebd0b297ce02cbbe30a5da4817464bf5"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"wmwq+4eOFcrc7pJ7pQ2h6/GJwrMFnwI55YcjFEUQjb9YCEfRAZKLR2+E8E48RqfZWyHe5MqdrlkxaxvrrEVsCg==","signed_message":"bundle_sha256_bytes","signed_at":"2026-07-07T14:26:15.181528Z","bundle_sha256":"2ff40c90ba41c8726db3defdc7fea2f50496281b28c40f9e4b30c67810f4eba1"}}