{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2025:SFIB4GHZF4TLKG4ZR2KZXKRTWD","short_pith_number":"pith:SFIB4GHZ","canonical_record":{"source":{"id":"2501.16393","kind":"arxiv","version":2},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.LG","submitted_at":"2025-01-26T14:59:47Z","cross_cats_sorted":["cs.CR","stat.ML"],"title_canon_sha256":"722e7dfcf4c00cecc6a41f8faf52ab76dd2eccf928650c2f553a04c79648aebf","abstract_canon_sha256":"3581584c5b0988e0e68ad6cfec870c4d1a680a59828c151170fe68a8ab74e07e"},"schema_version":"1.0"},"canonical_sha256":"91501e18f92f26b51b998e959baa33b0d785d232f5e6af1f5d23c370d979a9a7","source":{"kind":"arxiv","id":"2501.16393","version":2},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2501.16393","created_at":"2026-07-05T11:03:02Z"},{"alias_kind":"arxiv_version","alias_value":"2501.16393v2","created_at":"2026-07-05T11:03:02Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2501.16393","created_at":"2026-07-05T11:03:02Z"},{"alias_kind":"pith_short_12","alias_value":"SFIB4GHZF4TL","created_at":"2026-07-05T11:03:02Z"},{"alias_kind":"pith_short_16","alias_value":"SFIB4GHZF4TLKG4Z","created_at":"2026-07-05T11:03:02Z"},{"alias_kind":"pith_short_8","alias_value":"SFIB4GHZ","created_at":"2026-07-05T11:03:02Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2025:SFIB4GHZF4TLKG4ZR2KZXKRTWD","target":"record","payload":{"canonical_record":{"source":{"id":"2501.16393","kind":"arxiv","version":2},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.LG","submitted_at":"2025-01-26T14:59:47Z","cross_cats_sorted":["cs.CR","stat.ML"],"title_canon_sha256":"722e7dfcf4c00cecc6a41f8faf52ab76dd2eccf928650c2f553a04c79648aebf","abstract_canon_sha256":"3581584c5b0988e0e68ad6cfec870c4d1a680a59828c151170fe68a8ab74e07e"},"schema_version":"1.0"},"canonical_sha256":"91501e18f92f26b51b998e959baa33b0d785d232f5e6af1f5d23c370d979a9a7","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T11:03:02.940508Z","signature_b64":"HByqTiEc7ADH+KSOB1EJe5BaTVZQ9QySOuL5f8lkKJGvaYJ5TXENibt1FPqmMnuS9JoQmJNzZwc50Naif2d0AA==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"91501e18f92f26b51b998e959baa33b0d785d232f5e6af1f5d23c370d979a9a7","last_reissued_at":"2026-07-05T11:03:02.940022Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T11:03:02.940022Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2501.16393","source_version":2,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T11:03:02Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"NSfSLThBeLIPG9dFXscqBwpCxa6pVscFGz2EZ4UzSdh+dw4o6ceZS2UEfOVU/I/jUSODGscAxcFDJaukrrBNCA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-18T20:01:38.220730Z"},"content_sha256":"ecbe5015bcb1b56e48a60cb7f258eb910b5e43ccc28e591c79b4061f3474192a","schema_version":"1.0","event_id":"sha256:ecbe5015bcb1b56e48a60cb7f258eb910b5e43ccc28e591c79b4061f3474192a"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2025:SFIB4GHZF4TLKG4ZR2KZXKRTWD","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Improving Network Threat Detection by Knowledge Graph, Large Language Model, and Imbalanced Learning","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":["cs.CR","stat.ML"],"primary_cat":"cs.LG","authors_text":"Herman Ray, Lili Zhang, Quanyan Zhu, Ying Xie","submitted_at":"2025-01-26T14:59:47Z","abstract_excerpt":"Network threat detection has been challenging due to the complexities of attack activities and the limitation of historical threat data to learn from. To help enhance the existing practices of using analytics, machine learning, and artificial intelligence methods to detect the network threats, we propose an integrated modelling framework, where Knowledge Graph is used to analyze the users' activity patterns, Imbalanced Learning techniques are used to prune and weigh Knowledge Graph, and LLM is used to retrieve and interpret the users' activities from Knowledge Graph. The proposed framework is "},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2501.16393","kind":"arxiv","version":2},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2501.16393/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T11:03:02Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"GVCOkq0+phF87CTQhAlRacljkmW9/IQJqP5f4WaQrd9q0Qy5rJgXaL4GnhT2Uycj8gXfITyqQQelEcZpJjHcAQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-18T20:01:38.221062Z"},"content_sha256":"93cff10ed26e3dcd6e9d35c061ea403174d3da55bf38a11d33c51783bf4823b6","schema_version":"1.0","event_id":"sha256:93cff10ed26e3dcd6e9d35c061ea403174d3da55bf38a11d33c51783bf4823b6"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/SFIB4GHZF4TLKG4ZR2KZXKRTWD/bundle.json","state_url":"https://pith.science/pith/SFIB4GHZF4TLKG4ZR2KZXKRTWD/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/SFIB4GHZF4TLKG4ZR2KZXKRTWD/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-18T20:01:38Z","links":{"resolver":"https://pith.science/pith/SFIB4GHZF4TLKG4ZR2KZXKRTWD","bundle":"https://pith.science/pith/SFIB4GHZF4TLKG4ZR2KZXKRTWD/bundle.json","state":"https://pith.science/pith/SFIB4GHZF4TLKG4ZR2KZXKRTWD/state.json","well_known_bundle":"https://pith.science/.well-known/pith/SFIB4GHZF4TLKG4ZR2KZXKRTWD/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2025:SFIB4GHZF4TLKG4ZR2KZXKRTWD","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"3581584c5b0988e0e68ad6cfec870c4d1a680a59828c151170fe68a8ab74e07e","cross_cats_sorted":["cs.CR","stat.ML"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.LG","submitted_at":"2025-01-26T14:59:47Z","title_canon_sha256":"722e7dfcf4c00cecc6a41f8faf52ab76dd2eccf928650c2f553a04c79648aebf"},"schema_version":"1.0","source":{"id":"2501.16393","kind":"arxiv","version":2}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2501.16393","created_at":"2026-07-05T11:03:02Z"},{"alias_kind":"arxiv_version","alias_value":"2501.16393v2","created_at":"2026-07-05T11:03:02Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2501.16393","created_at":"2026-07-05T11:03:02Z"},{"alias_kind":"pith_short_12","alias_value":"SFIB4GHZF4TL","created_at":"2026-07-05T11:03:02Z"},{"alias_kind":"pith_short_16","alias_value":"SFIB4GHZF4TLKG4Z","created_at":"2026-07-05T11:03:02Z"},{"alias_kind":"pith_short_8","alias_value":"SFIB4GHZ","created_at":"2026-07-05T11:03:02Z"}],"graph_snapshots":[{"event_id":"sha256:93cff10ed26e3dcd6e9d35c061ea403174d3da55bf38a11d33c51783bf4823b6","target":"graph","created_at":"2026-07-05T11:03:02Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2501.16393/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Network threat detection has been challenging due to the complexities of attack activities and the limitation of historical threat data to learn from. To help enhance the existing practices of using analytics, machine learning, and artificial intelligence methods to detect the network threats, we propose an integrated modelling framework, where Knowledge Graph is used to analyze the users' activity patterns, Imbalanced Learning techniques are used to prune and weigh Knowledge Graph, and LLM is used to retrieve and interpret the users' activities from Knowledge Graph. The proposed framework is ","authors_text":"Herman Ray, Lili Zhang, Quanyan Zhu, Ying Xie","cross_cats":["cs.CR","stat.ML"],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.LG","submitted_at":"2025-01-26T14:59:47Z","title":"Improving Network Threat Detection by Knowledge Graph, Large Language Model, and Imbalanced Learning"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2501.16393","kind":"arxiv","version":2},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:ecbe5015bcb1b56e48a60cb7f258eb910b5e43ccc28e591c79b4061f3474192a","target":"record","created_at":"2026-07-05T11:03:02Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"3581584c5b0988e0e68ad6cfec870c4d1a680a59828c151170fe68a8ab74e07e","cross_cats_sorted":["cs.CR","stat.ML"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.LG","submitted_at":"2025-01-26T14:59:47Z","title_canon_sha256":"722e7dfcf4c00cecc6a41f8faf52ab76dd2eccf928650c2f553a04c79648aebf"},"schema_version":"1.0","source":{"id":"2501.16393","kind":"arxiv","version":2}},"canonical_sha256":"91501e18f92f26b51b998e959baa33b0d785d232f5e6af1f5d23c370d979a9a7","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"91501e18f92f26b51b998e959baa33b0d785d232f5e6af1f5d23c370d979a9a7","first_computed_at":"2026-07-05T11:03:02.940022Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T11:03:02.940022Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"HByqTiEc7ADH+KSOB1EJe5BaTVZQ9QySOuL5f8lkKJGvaYJ5TXENibt1FPqmMnuS9JoQmJNzZwc50Naif2d0AA==","signature_status":"signed_v1","signed_at":"2026-07-05T11:03:02.940508Z","signed_message":"canonical_sha256_bytes"},"source_id":"2501.16393","source_kind":"arxiv","source_version":2}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:ecbe5015bcb1b56e48a60cb7f258eb910b5e43ccc28e591c79b4061f3474192a","sha256:93cff10ed26e3dcd6e9d35c061ea403174d3da55bf38a11d33c51783bf4823b6"],"state_sha256":"ca12eb28ed43f4992897771e9a912868105f3c56f6e8c000d1e319b90c035b3c"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"JRoAo/f/yyk0qSl6pMO/jfJDgbPS8+KfDQ8wfmxht04b5DqIoF7qnf5bCzp0EQK6qQAC+lTEm03IftcEu9BAAA==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-18T20:01:38.224420Z","bundle_sha256":"dd626d511d0423cf17793fb2515c530788f3fc56c1ab387306d260528039135d"}}