{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2021:TYV475G6KTWXPMLNG6N2ZK4AMU","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"2ab5f751132ad1ef05f789b550a7b82d91a5b8c15b0eb8c8083433cf0653c8fc","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2021-05-27T20:37:56Z","title_canon_sha256":"8c15c5dd55e095f2dd1041a943bfe9ee9e3918ce0a9426e756797052dbfc5262"},"schema_version":"1.0","source":{"id":"2105.13442","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2105.13442","created_at":"2026-07-05T02:44:08Z"},{"alias_kind":"arxiv_version","alias_value":"2105.13442v1","created_at":"2026-07-05T02:44:08Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2105.13442","created_at":"2026-07-05T02:44:08Z"},{"alias_kind":"pith_short_12","alias_value":"TYV475G6KTWX","created_at":"2026-07-05T02:44:08Z"},{"alias_kind":"pith_short_16","alias_value":"TYV475G6KTWXPMLN","created_at":"2026-07-05T02:44:08Z"},{"alias_kind":"pith_short_8","alias_value":"TYV475G6","created_at":"2026-07-05T02:44:08Z"}],"graph_snapshots":[{"event_id":"sha256:e829b2769319a3144474a75f6f15734d40e76839495df5f2e00bb029557b770d","target":"graph","created_at":"2026-07-05T02:44:08Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2105.13442/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"In successful enterprise attacks, adversaries often need to gain access to additional machines beyond their initial point of compromise, a set of internal movements known as lateral movement. We present Hopper, a system for detecting lateral movement based on commonly available enterprise logs. Hopper constructs a graph of login activity among internal machines and then identifies suspicious sequences of loginsthat correspond to lateral movement. To understand the larger context of each login, Hopper employs an inference algorithm to identify the broader path(s) of movement that each login bel","authors_text":"David Wagner, Devdatta Akhawe, Geoffrey M. Voelker, Grant Ho, Mayank Dhiman, Stefan Savage, Vern Paxson","cross_cats":[],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2021-05-27T20:37:56Z","title":"Hopper: Modeling and Detecting Lateral Movement (Extended Report)"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2105.13442","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:4e9f1520c96b3cc706c1f997c6472a8c2ead871bc6c4cddb7a3f91c6056470e3","target":"record","created_at":"2026-07-05T02:44:08Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"2ab5f751132ad1ef05f789b550a7b82d91a5b8c15b0eb8c8083433cf0653c8fc","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2021-05-27T20:37:56Z","title_canon_sha256":"8c15c5dd55e095f2dd1041a943bfe9ee9e3918ce0a9426e756797052dbfc5262"},"schema_version":"1.0","source":{"id":"2105.13442","kind":"arxiv","version":1}},"canonical_sha256":"9e2bcff4de54ed77b16d379bacab80653e7fb8353c61a4ded71ed5d0658a4eff","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"9e2bcff4de54ed77b16d379bacab80653e7fb8353c61a4ded71ed5d0658a4eff","first_computed_at":"2026-07-05T02:44:08.106170Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T02:44:08.106170Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"advwi6VdRqiBXFLcooU2vAHkGj8QakmySwt/bVXoyNnCkTts1eqsZDyQIClRGVKht8ZGF95lvVtisOx3S6z/Cw==","signature_status":"signed_v1","signed_at":"2026-07-05T02:44:08.106561Z","signed_message":"canonical_sha256_bytes"},"source_id":"2105.13442","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:4e9f1520c96b3cc706c1f997c6472a8c2ead871bc6c4cddb7a3f91c6056470e3","sha256:e829b2769319a3144474a75f6f15734d40e76839495df5f2e00bb029557b770d"],"state_sha256":"90530f7b0e046bfb47e9c3d9f48ad2fda8ba200b29efa0d5a206ad8666f9dd3e"}