{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2024:SVQFLS2U6UP2YYOV7YSCFXXK4W","short_pith_number":"pith:SVQFLS2U","canonical_record":{"source":{"id":"2411.10279","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2024-11-15T15:35:56Z","cross_cats_sorted":["cs.AI"],"title_canon_sha256":"f582c64ceb958f84a09e020eddb7a2c9c80db1e63df1cb542355413e4dcd2aa5","abstract_canon_sha256":"1d0d254f1a786da6998df8b89e282f90d1e029fd66a7e0957c08e59f66d23843"},"schema_version":"1.0"},"canonical_sha256":"956055cb54f51fac61d5fe2422deeae5912c276727f928aa21547cea28230148","source":{"kind":"arxiv","id":"2411.10279","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2411.10279","created_at":"2026-07-05T09:36:02Z"},{"alias_kind":"arxiv_version","alias_value":"2411.10279v1","created_at":"2026-07-05T09:36:02Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2411.10279","created_at":"2026-07-05T09:36:02Z"},{"alias_kind":"pith_short_12","alias_value":"SVQFLS2U6UP2","created_at":"2026-07-05T09:36:02Z"},{"alias_kind":"pith_short_16","alias_value":"SVQFLS2U6UP2YYOV","created_at":"2026-07-05T09:36:02Z"},{"alias_kind":"pith_short_8","alias_value":"SVQFLS2U","created_at":"2026-07-05T09:36:02Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2024:SVQFLS2U6UP2YYOV7YSCFXXK4W","target":"record","payload":{"canonical_record":{"source":{"id":"2411.10279","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2024-11-15T15:35:56Z","cross_cats_sorted":["cs.AI"],"title_canon_sha256":"f582c64ceb958f84a09e020eddb7a2c9c80db1e63df1cb542355413e4dcd2aa5","abstract_canon_sha256":"1d0d254f1a786da6998df8b89e282f90d1e029fd66a7e0957c08e59f66d23843"},"schema_version":"1.0"},"canonical_sha256":"956055cb54f51fac61d5fe2422deeae5912c276727f928aa21547cea28230148","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T09:36:02.729782Z","signature_b64":"9YPPjCLaWv2sELwGM0kReFZT03i2nJhLc2ZqHew2VlXsJTLGvup5umhP9SJMu4ZD74zgbMtunHooJfIGcHKgDQ==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"956055cb54f51fac61d5fe2422deeae5912c276727f928aa21547cea28230148","last_reissued_at":"2026-07-05T09:36:02.729404Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T09:36:02.729404Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2411.10279","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T09:36:02Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"OhjIyv2pZX9fSuEbg751oP4cxe7HTqKacrha/UIc6Y6HnUAZufppbANAhxKdX2TFcvR0lhWFGoEo5swGxQCcCQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-20T15:54:33.686792Z"},"content_sha256":"0ed45ec06ea8e08723fdb7b05dfbae48fa85c091526568a62cd84cd23e8c5fe9","schema_version":"1.0","event_id":"sha256:0ed45ec06ea8e08723fdb7b05dfbae48fa85c091526568a62cd84cd23e8c5fe9"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2024:SVQFLS2U6UP2YYOV7YSCFXXK4W","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Lateral Movement Detection via Time-aware Subgraph Classification on Authentication Logs","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":["cs.AI"],"primary_cat":"cs.CR","authors_text":"Jiacheng Yao, Jiajun Zhou, Qi Xuan, Shanqing Yu, Xiaoniu Yang, Xuanze Chen","submitted_at":"2024-11-15T15:35:56Z","abstract_excerpt":"Lateral movement is a crucial component of advanced persistent threat (APT) attacks in networks. Attackers exploit security vulnerabilities in internal networks or IoT devices, expanding their control after initial infiltration to steal sensitive data or carry out other malicious activities, posing a serious threat to system security. Existing research suggests that attackers generally employ seemingly unrelated operations to mask their malicious intentions, thereby evading existing lateral movement detection methods and hiding their intrusion traces. In this regard, we analyze host authentica"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2411.10279","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2411.10279/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T09:36:02Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"d2KRMTeuno5AosKy6TS8+WC29Zp4TgIzuw+VQQZtvpSDYtwkJXmtndZYoMCmeT5CGxCVxrLyN+0d0O9Vc8MNCA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-20T15:54:33.687293Z"},"content_sha256":"ac3afc6a3991a3fc4fef3b9f4550575d57b537284d8763c2daaddcc2cb082ae4","schema_version":"1.0","event_id":"sha256:ac3afc6a3991a3fc4fef3b9f4550575d57b537284d8763c2daaddcc2cb082ae4"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/SVQFLS2U6UP2YYOV7YSCFXXK4W/bundle.json","state_url":"https://pith.science/pith/SVQFLS2U6UP2YYOV7YSCFXXK4W/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/SVQFLS2U6UP2YYOV7YSCFXXK4W/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-20T15:54:33Z","links":{"resolver":"https://pith.science/pith/SVQFLS2U6UP2YYOV7YSCFXXK4W","bundle":"https://pith.science/pith/SVQFLS2U6UP2YYOV7YSCFXXK4W/bundle.json","state":"https://pith.science/pith/SVQFLS2U6UP2YYOV7YSCFXXK4W/state.json","well_known_bundle":"https://pith.science/.well-known/pith/SVQFLS2U6UP2YYOV7YSCFXXK4W/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2024:SVQFLS2U6UP2YYOV7YSCFXXK4W","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"1d0d254f1a786da6998df8b89e282f90d1e029fd66a7e0957c08e59f66d23843","cross_cats_sorted":["cs.AI"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2024-11-15T15:35:56Z","title_canon_sha256":"f582c64ceb958f84a09e020eddb7a2c9c80db1e63df1cb542355413e4dcd2aa5"},"schema_version":"1.0","source":{"id":"2411.10279","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2411.10279","created_at":"2026-07-05T09:36:02Z"},{"alias_kind":"arxiv_version","alias_value":"2411.10279v1","created_at":"2026-07-05T09:36:02Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2411.10279","created_at":"2026-07-05T09:36:02Z"},{"alias_kind":"pith_short_12","alias_value":"SVQFLS2U6UP2","created_at":"2026-07-05T09:36:02Z"},{"alias_kind":"pith_short_16","alias_value":"SVQFLS2U6UP2YYOV","created_at":"2026-07-05T09:36:02Z"},{"alias_kind":"pith_short_8","alias_value":"SVQFLS2U","created_at":"2026-07-05T09:36:02Z"}],"graph_snapshots":[{"event_id":"sha256:ac3afc6a3991a3fc4fef3b9f4550575d57b537284d8763c2daaddcc2cb082ae4","target":"graph","created_at":"2026-07-05T09:36:02Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2411.10279/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Lateral movement is a crucial component of advanced persistent threat (APT) attacks in networks. Attackers exploit security vulnerabilities in internal networks or IoT devices, expanding their control after initial infiltration to steal sensitive data or carry out other malicious activities, posing a serious threat to system security. Existing research suggests that attackers generally employ seemingly unrelated operations to mask their malicious intentions, thereby evading existing lateral movement detection methods and hiding their intrusion traces. In this regard, we analyze host authentica","authors_text":"Jiacheng Yao, Jiajun Zhou, Qi Xuan, Shanqing Yu, Xiaoniu Yang, Xuanze Chen","cross_cats":["cs.AI"],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2024-11-15T15:35:56Z","title":"Lateral Movement Detection via Time-aware Subgraph Classification on Authentication Logs"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2411.10279","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:0ed45ec06ea8e08723fdb7b05dfbae48fa85c091526568a62cd84cd23e8c5fe9","target":"record","created_at":"2026-07-05T09:36:02Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"1d0d254f1a786da6998df8b89e282f90d1e029fd66a7e0957c08e59f66d23843","cross_cats_sorted":["cs.AI"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2024-11-15T15:35:56Z","title_canon_sha256":"f582c64ceb958f84a09e020eddb7a2c9c80db1e63df1cb542355413e4dcd2aa5"},"schema_version":"1.0","source":{"id":"2411.10279","kind":"arxiv","version":1}},"canonical_sha256":"956055cb54f51fac61d5fe2422deeae5912c276727f928aa21547cea28230148","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"956055cb54f51fac61d5fe2422deeae5912c276727f928aa21547cea28230148","first_computed_at":"2026-07-05T09:36:02.729404Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T09:36:02.729404Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"9YPPjCLaWv2sELwGM0kReFZT03i2nJhLc2ZqHew2VlXsJTLGvup5umhP9SJMu4ZD74zgbMtunHooJfIGcHKgDQ==","signature_status":"signed_v1","signed_at":"2026-07-05T09:36:02.729782Z","signed_message":"canonical_sha256_bytes"},"source_id":"2411.10279","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:0ed45ec06ea8e08723fdb7b05dfbae48fa85c091526568a62cd84cd23e8c5fe9","sha256:ac3afc6a3991a3fc4fef3b9f4550575d57b537284d8763c2daaddcc2cb082ae4"],"state_sha256":"08cad337e4579f4d4f29f7d6cef66287dd9dabdb5400d085910b1fda7d32ee3b"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"afQITYsWfI7mta1Wk6bmQDDI5KBapyBGtHvyuVjruYwIMYf7IjnrO8dImSlnJ9+DRMq9jrAfB+Wg6MTXVji4DQ==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-20T15:54:33.691423Z","bundle_sha256":"e51f94d72da6fae231598accff70cf48ed38eb014d5adc6add8618152a200c5d"}}