{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2021:TYV475G6KTWXPMLNG6N2ZK4AMU","short_pith_number":"pith:TYV475G6","canonical_record":{"source":{"id":"2105.13442","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2021-05-27T20:37:56Z","cross_cats_sorted":[],"title_canon_sha256":"8c15c5dd55e095f2dd1041a943bfe9ee9e3918ce0a9426e756797052dbfc5262","abstract_canon_sha256":"2ab5f751132ad1ef05f789b550a7b82d91a5b8c15b0eb8c8083433cf0653c8fc"},"schema_version":"1.0"},"canonical_sha256":"9e2bcff4de54ed77b16d379bacab80653e7fb8353c61a4ded71ed5d0658a4eff","source":{"kind":"arxiv","id":"2105.13442","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2105.13442","created_at":"2026-07-05T02:44:08Z"},{"alias_kind":"arxiv_version","alias_value":"2105.13442v1","created_at":"2026-07-05T02:44:08Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2105.13442","created_at":"2026-07-05T02:44:08Z"},{"alias_kind":"pith_short_12","alias_value":"TYV475G6KTWX","created_at":"2026-07-05T02:44:08Z"},{"alias_kind":"pith_short_16","alias_value":"TYV475G6KTWXPMLN","created_at":"2026-07-05T02:44:08Z"},{"alias_kind":"pith_short_8","alias_value":"TYV475G6","created_at":"2026-07-05T02:44:08Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2021:TYV475G6KTWXPMLNG6N2ZK4AMU","target":"record","payload":{"canonical_record":{"source":{"id":"2105.13442","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2021-05-27T20:37:56Z","cross_cats_sorted":[],"title_canon_sha256":"8c15c5dd55e095f2dd1041a943bfe9ee9e3918ce0a9426e756797052dbfc5262","abstract_canon_sha256":"2ab5f751132ad1ef05f789b550a7b82d91a5b8c15b0eb8c8083433cf0653c8fc"},"schema_version":"1.0"},"canonical_sha256":"9e2bcff4de54ed77b16d379bacab80653e7fb8353c61a4ded71ed5d0658a4eff","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T02:44:08.106561Z","signature_b64":"advwi6VdRqiBXFLcooU2vAHkGj8QakmySwt/bVXoyNnCkTts1eqsZDyQIClRGVKht8ZGF95lvVtisOx3S6z/Cw==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"9e2bcff4de54ed77b16d379bacab80653e7fb8353c61a4ded71ed5d0658a4eff","last_reissued_at":"2026-07-05T02:44:08.106170Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T02:44:08.106170Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2105.13442","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T02:44:08Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"Nj8W/ZkrvoPYxlIm1pAKCqEYqtgvqHdObUMbT26PMJKNxERV/2Wh5OO6Av/kQpY5pnM3WzOFCLl6pGukCYGcCQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-18T17:53:22.912609Z"},"content_sha256":"4e9f1520c96b3cc706c1f997c6472a8c2ead871bc6c4cddb7a3f91c6056470e3","schema_version":"1.0","event_id":"sha256:4e9f1520c96b3cc706c1f997c6472a8c2ead871bc6c4cddb7a3f91c6056470e3"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2021:TYV475G6KTWXPMLNG6N2ZK4AMU","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Hopper: Modeling and Detecting Lateral Movement (Extended Report)","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":[],"primary_cat":"cs.CR","authors_text":"David Wagner, Devdatta Akhawe, Geoffrey M. Voelker, Grant Ho, Mayank Dhiman, Stefan Savage, Vern Paxson","submitted_at":"2021-05-27T20:37:56Z","abstract_excerpt":"In successful enterprise attacks, adversaries often need to gain access to additional machines beyond their initial point of compromise, a set of internal movements known as lateral movement. We present Hopper, a system for detecting lateral movement based on commonly available enterprise logs. Hopper constructs a graph of login activity among internal machines and then identifies suspicious sequences of loginsthat correspond to lateral movement. To understand the larger context of each login, Hopper employs an inference algorithm to identify the broader path(s) of movement that each login bel"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2105.13442","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2105.13442/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T02:44:08Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"idAhqI1EXIYekfu1dzzuvmcJumN9P4Q/RYHg6ugFhtUI/cktKIrNph56vVEn/jxtZJz1UYzRyL1rCEfd/4ucCQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-18T17:53:22.913691Z"},"content_sha256":"e829b2769319a3144474a75f6f15734d40e76839495df5f2e00bb029557b770d","schema_version":"1.0","event_id":"sha256:e829b2769319a3144474a75f6f15734d40e76839495df5f2e00bb029557b770d"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/TYV475G6KTWXPMLNG6N2ZK4AMU/bundle.json","state_url":"https://pith.science/pith/TYV475G6KTWXPMLNG6N2ZK4AMU/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/TYV475G6KTWXPMLNG6N2ZK4AMU/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-18T17:53:22Z","links":{"resolver":"https://pith.science/pith/TYV475G6KTWXPMLNG6N2ZK4AMU","bundle":"https://pith.science/pith/TYV475G6KTWXPMLNG6N2ZK4AMU/bundle.json","state":"https://pith.science/pith/TYV475G6KTWXPMLNG6N2ZK4AMU/state.json","well_known_bundle":"https://pith.science/.well-known/pith/TYV475G6KTWXPMLNG6N2ZK4AMU/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2021:TYV475G6KTWXPMLNG6N2ZK4AMU","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"2ab5f751132ad1ef05f789b550a7b82d91a5b8c15b0eb8c8083433cf0653c8fc","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2021-05-27T20:37:56Z","title_canon_sha256":"8c15c5dd55e095f2dd1041a943bfe9ee9e3918ce0a9426e756797052dbfc5262"},"schema_version":"1.0","source":{"id":"2105.13442","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2105.13442","created_at":"2026-07-05T02:44:08Z"},{"alias_kind":"arxiv_version","alias_value":"2105.13442v1","created_at":"2026-07-05T02:44:08Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2105.13442","created_at":"2026-07-05T02:44:08Z"},{"alias_kind":"pith_short_12","alias_value":"TYV475G6KTWX","created_at":"2026-07-05T02:44:08Z"},{"alias_kind":"pith_short_16","alias_value":"TYV475G6KTWXPMLN","created_at":"2026-07-05T02:44:08Z"},{"alias_kind":"pith_short_8","alias_value":"TYV475G6","created_at":"2026-07-05T02:44:08Z"}],"graph_snapshots":[{"event_id":"sha256:e829b2769319a3144474a75f6f15734d40e76839495df5f2e00bb029557b770d","target":"graph","created_at":"2026-07-05T02:44:08Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2105.13442/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"In successful enterprise attacks, adversaries often need to gain access to additional machines beyond their initial point of compromise, a set of internal movements known as lateral movement. We present Hopper, a system for detecting lateral movement based on commonly available enterprise logs. Hopper constructs a graph of login activity among internal machines and then identifies suspicious sequences of loginsthat correspond to lateral movement. To understand the larger context of each login, Hopper employs an inference algorithm to identify the broader path(s) of movement that each login bel","authors_text":"David Wagner, Devdatta Akhawe, Geoffrey M. Voelker, Grant Ho, Mayank Dhiman, Stefan Savage, Vern Paxson","cross_cats":[],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2021-05-27T20:37:56Z","title":"Hopper: Modeling and Detecting Lateral Movement (Extended Report)"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2105.13442","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:4e9f1520c96b3cc706c1f997c6472a8c2ead871bc6c4cddb7a3f91c6056470e3","target":"record","created_at":"2026-07-05T02:44:08Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"2ab5f751132ad1ef05f789b550a7b82d91a5b8c15b0eb8c8083433cf0653c8fc","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2021-05-27T20:37:56Z","title_canon_sha256":"8c15c5dd55e095f2dd1041a943bfe9ee9e3918ce0a9426e756797052dbfc5262"},"schema_version":"1.0","source":{"id":"2105.13442","kind":"arxiv","version":1}},"canonical_sha256":"9e2bcff4de54ed77b16d379bacab80653e7fb8353c61a4ded71ed5d0658a4eff","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"9e2bcff4de54ed77b16d379bacab80653e7fb8353c61a4ded71ed5d0658a4eff","first_computed_at":"2026-07-05T02:44:08.106170Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T02:44:08.106170Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"advwi6VdRqiBXFLcooU2vAHkGj8QakmySwt/bVXoyNnCkTts1eqsZDyQIClRGVKht8ZGF95lvVtisOx3S6z/Cw==","signature_status":"signed_v1","signed_at":"2026-07-05T02:44:08.106561Z","signed_message":"canonical_sha256_bytes"},"source_id":"2105.13442","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:4e9f1520c96b3cc706c1f997c6472a8c2ead871bc6c4cddb7a3f91c6056470e3","sha256:e829b2769319a3144474a75f6f15734d40e76839495df5f2e00bb029557b770d"],"state_sha256":"90530f7b0e046bfb47e9c3d9f48ad2fda8ba200b29efa0d5a206ad8666f9dd3e"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"A1tJ3AApBsFULiAe59Yg+yRjqyIPNTVLd098/ZgElC/CSrR1X2QHoQfAikzyRKdknxC64u+08pTG86YNp5hoBA==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-18T17:53:22.921527Z","bundle_sha256":"103e682201e2506d9eac7161b75c67527bc54d8cda05892c526f8ac249523470"}}