{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2023:T23I2PVNZZFQDZLFTSP3BSI6NX","short_pith_number":"pith:T23I2PVN","canonical_record":{"source":{"id":"2311.02331","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2023-11-04T05:36:59Z","cross_cats_sorted":[],"title_canon_sha256":"5fab98fd83b243bdeea3287d282f3fd912176877b9006c4bde0b00eee8690501","abstract_canon_sha256":"7489c79a0a47fbc1e986045904e7f14d9a41df9f65354084c18058ac01c02ffb"},"schema_version":"1.0"},"canonical_sha256":"9eb68d3eadce4b01e5659c9fb0c91e6deb748cf721688d3a17e6cc0a5b4f3d94","source":{"kind":"arxiv","id":"2311.02331","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2311.02331","created_at":"2026-07-05T07:09:09Z"},{"alias_kind":"arxiv_version","alias_value":"2311.02331v1","created_at":"2026-07-05T07:09:09Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2311.02331","created_at":"2026-07-05T07:09:09Z"},{"alias_kind":"pith_short_12","alias_value":"T23I2PVNZZFQ","created_at":"2026-07-05T07:09:09Z"},{"alias_kind":"pith_short_16","alias_value":"T23I2PVNZZFQDZLF","created_at":"2026-07-05T07:09:09Z"},{"alias_kind":"pith_short_8","alias_value":"T23I2PVN","created_at":"2026-07-05T07:09:09Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2023:T23I2PVNZZFQDZLFTSP3BSI6NX","target":"record","payload":{"canonical_record":{"source":{"id":"2311.02331","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2023-11-04T05:36:59Z","cross_cats_sorted":[],"title_canon_sha256":"5fab98fd83b243bdeea3287d282f3fd912176877b9006c4bde0b00eee8690501","abstract_canon_sha256":"7489c79a0a47fbc1e986045904e7f14d9a41df9f65354084c18058ac01c02ffb"},"schema_version":"1.0"},"canonical_sha256":"9eb68d3eadce4b01e5659c9fb0c91e6deb748cf721688d3a17e6cc0a5b4f3d94","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T07:09:09.849199Z","signature_b64":"D/ymUM3VfWYbzjS8A4cejiUtRLlZTMTDs3Dg44TK3MWvS5OR/ehzXY9OCyDvsM6uCQ4ztIXEYDqKpA2aRwGnBw==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"9eb68d3eadce4b01e5659c9fb0c91e6deb748cf721688d3a17e6cc0a5b4f3d94","last_reissued_at":"2026-07-05T07:09:09.848800Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T07:09:09.848800Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2311.02331","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T07:09:09Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"toYFqz6xOxTJ6CFd9hZB+AVkkhGbPkAN24meSy79d6f5BZpEabsOrC7ws8eRReSYICSp6y0s28YSFFlo+jLVBw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-09T18:50:48.070877Z"},"content_sha256":"50d1cd7e93f5dd48f426a7740384382a87c0055420099016595a1cecb886e02f","schema_version":"1.0","event_id":"sha256:50d1cd7e93f5dd48f426a7740384382a87c0055420099016595a1cecb886e02f"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2023:T23I2PVNZZFQDZLFTSP3BSI6NX","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"NODLINK: An Online System for Fine-Grained APT Attack Detection and Investigation","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":[],"primary_cat":"cs.CR","authors_text":"Ding Li, Fei Shao, Feng Dong, Haoyu Wang, Jiedong Chen, Shaofei Li, Xiangqun Chen, Xusheng Xiao, Yao Guo","submitted_at":"2023-11-04T05:36:59Z","abstract_excerpt":"Advanced Persistent Threats (APT) attacks have plagued modern enterprises, causing significant financial losses. To counter these attacks, researchers propose techniques that capture the complex and stealthy scenarios of APT attacks by using provenance graphs to model system entities and their dependencies. Particularly, to accelerate attack detection and reduce financial losses, online provenance-based detection systems that detect and investigate APT attacks under the constraints of timeliness and limited resources are in dire need. Unfortunately, existing online systems usually sacrifice de"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2311.02331","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2311.02331/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T07:09:09Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"4W8Slw1+FkzKUElueUJbeJDFUtS/YTi2Z7eZeafebBRHvUIdum/JgtV2R+26JyQSAafrVOoAhdnF5i6utrIkAg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-09T18:50:48.071404Z"},"content_sha256":"9d0c1ca17640aa73b787ccaaa74777c4d990a3f8e49f47ec57cd0c9c6cd7a625","schema_version":"1.0","event_id":"sha256:9d0c1ca17640aa73b787ccaaa74777c4d990a3f8e49f47ec57cd0c9c6cd7a625"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/T23I2PVNZZFQDZLFTSP3BSI6NX/bundle.json","state_url":"https://pith.science/pith/T23I2PVNZZFQDZLFTSP3BSI6NX/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/T23I2PVNZZFQDZLFTSP3BSI6NX/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-09T18:50:48Z","links":{"resolver":"https://pith.science/pith/T23I2PVNZZFQDZLFTSP3BSI6NX","bundle":"https://pith.science/pith/T23I2PVNZZFQDZLFTSP3BSI6NX/bundle.json","state":"https://pith.science/pith/T23I2PVNZZFQDZLFTSP3BSI6NX/state.json","well_known_bundle":"https://pith.science/.well-known/pith/T23I2PVNZZFQDZLFTSP3BSI6NX/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2023:T23I2PVNZZFQDZLFTSP3BSI6NX","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"7489c79a0a47fbc1e986045904e7f14d9a41df9f65354084c18058ac01c02ffb","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2023-11-04T05:36:59Z","title_canon_sha256":"5fab98fd83b243bdeea3287d282f3fd912176877b9006c4bde0b00eee8690501"},"schema_version":"1.0","source":{"id":"2311.02331","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2311.02331","created_at":"2026-07-05T07:09:09Z"},{"alias_kind":"arxiv_version","alias_value":"2311.02331v1","created_at":"2026-07-05T07:09:09Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2311.02331","created_at":"2026-07-05T07:09:09Z"},{"alias_kind":"pith_short_12","alias_value":"T23I2PVNZZFQ","created_at":"2026-07-05T07:09:09Z"},{"alias_kind":"pith_short_16","alias_value":"T23I2PVNZZFQDZLF","created_at":"2026-07-05T07:09:09Z"},{"alias_kind":"pith_short_8","alias_value":"T23I2PVN","created_at":"2026-07-05T07:09:09Z"}],"graph_snapshots":[{"event_id":"sha256:9d0c1ca17640aa73b787ccaaa74777c4d990a3f8e49f47ec57cd0c9c6cd7a625","target":"graph","created_at":"2026-07-05T07:09:09Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2311.02331/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Advanced Persistent Threats (APT) attacks have plagued modern enterprises, causing significant financial losses. To counter these attacks, researchers propose techniques that capture the complex and stealthy scenarios of APT attacks by using provenance graphs to model system entities and their dependencies. Particularly, to accelerate attack detection and reduce financial losses, online provenance-based detection systems that detect and investigate APT attacks under the constraints of timeliness and limited resources are in dire need. Unfortunately, existing online systems usually sacrifice de","authors_text":"Ding Li, Fei Shao, Feng Dong, Haoyu Wang, Jiedong Chen, Shaofei Li, Xiangqun Chen, Xusheng Xiao, Yao Guo","cross_cats":[],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2023-11-04T05:36:59Z","title":"NODLINK: An Online System for Fine-Grained APT Attack Detection and Investigation"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2311.02331","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:50d1cd7e93f5dd48f426a7740384382a87c0055420099016595a1cecb886e02f","target":"record","created_at":"2026-07-05T07:09:09Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"7489c79a0a47fbc1e986045904e7f14d9a41df9f65354084c18058ac01c02ffb","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2023-11-04T05:36:59Z","title_canon_sha256":"5fab98fd83b243bdeea3287d282f3fd912176877b9006c4bde0b00eee8690501"},"schema_version":"1.0","source":{"id":"2311.02331","kind":"arxiv","version":1}},"canonical_sha256":"9eb68d3eadce4b01e5659c9fb0c91e6deb748cf721688d3a17e6cc0a5b4f3d94","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"9eb68d3eadce4b01e5659c9fb0c91e6deb748cf721688d3a17e6cc0a5b4f3d94","first_computed_at":"2026-07-05T07:09:09.848800Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T07:09:09.848800Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"D/ymUM3VfWYbzjS8A4cejiUtRLlZTMTDs3Dg44TK3MWvS5OR/ehzXY9OCyDvsM6uCQ4ztIXEYDqKpA2aRwGnBw==","signature_status":"signed_v1","signed_at":"2026-07-05T07:09:09.849199Z","signed_message":"canonical_sha256_bytes"},"source_id":"2311.02331","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:50d1cd7e93f5dd48f426a7740384382a87c0055420099016595a1cecb886e02f","sha256:9d0c1ca17640aa73b787ccaaa74777c4d990a3f8e49f47ec57cd0c9c6cd7a625"],"state_sha256":"315577876fb1ede6f9c766e5458c02ab13fc46158aed6f1a819c16d53afb1350"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"hVcOHubCOpxj3NS6ejwg8e0+E4cfVbEMSJosaC7HnBJeb9+YB/jZQLguWmUMqOHB6iOG24EW5Jwwm3OGK4KOBw==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-09T18:50:48.077238Z","bundle_sha256":"9c6259fc2a4393468d080fa2e537cf6ba2c595bcde5d329ce0d66ee743c4ec39"}}