{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2025:U2RQ6T5ZDPBLD46KBDGZXTTYAH","short_pith_number":"pith:U2RQ6T5Z","canonical_record":{"source":{"id":"2505.19973","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by-nc-sa/4.0/","primary_cat":"cs.CR","submitted_at":"2025-05-26T13:35:37Z","cross_cats_sorted":["cs.AI"],"title_canon_sha256":"a09ac988ec25f811585d6d922cf8d9549a909cc000b9495b9fbc0cab68f61d02","abstract_canon_sha256":"cf7aabd577fc2d42031b989cfd9ada6b3597d8f65550f27f255b9a3300ea7b47"},"schema_version":"1.0"},"canonical_sha256":"a6a30f4fb91bc2b1f3ca08cd9bce7801e282cbab114ca773d4c5dc308f3534c1","source":{"kind":"arxiv","id":"2505.19973","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2505.19973","created_at":"2026-07-05T11:09:50Z"},{"alias_kind":"arxiv_version","alias_value":"2505.19973v1","created_at":"2026-07-05T11:09:50Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2505.19973","created_at":"2026-07-05T11:09:50Z"},{"alias_kind":"pith_short_12","alias_value":"U2RQ6T5ZDPBL","created_at":"2026-07-05T11:09:50Z"},{"alias_kind":"pith_short_16","alias_value":"U2RQ6T5ZDPBLD46K","created_at":"2026-07-05T11:09:50Z"},{"alias_kind":"pith_short_8","alias_value":"U2RQ6T5Z","created_at":"2026-07-05T11:09:50Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2025:U2RQ6T5ZDPBLD46KBDGZXTTYAH","target":"record","payload":{"canonical_record":{"source":{"id":"2505.19973","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by-nc-sa/4.0/","primary_cat":"cs.CR","submitted_at":"2025-05-26T13:35:37Z","cross_cats_sorted":["cs.AI"],"title_canon_sha256":"a09ac988ec25f811585d6d922cf8d9549a909cc000b9495b9fbc0cab68f61d02","abstract_canon_sha256":"cf7aabd577fc2d42031b989cfd9ada6b3597d8f65550f27f255b9a3300ea7b47"},"schema_version":"1.0"},"canonical_sha256":"a6a30f4fb91bc2b1f3ca08cd9bce7801e282cbab114ca773d4c5dc308f3534c1","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T11:09:50.746512Z","signature_b64":"M0RSlhLrnoaZikW2S3DfviYsb2DZUGiKkRanv4Y7tmeXkq9HpjhMRWWqMXCSJ7peE6EZVjnpgxct2fXOXHUbBg==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"a6a30f4fb91bc2b1f3ca08cd9bce7801e282cbab114ca773d4c5dc308f3534c1","last_reissued_at":"2026-07-05T11:09:50.746018Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T11:09:50.746018Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2505.19973","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T11:09:50Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"PQDXcbekK1pteHBWNS/RtIMCGLjzWwa86MZbMBC1GhUTYmmVkg1iIYacvX7utkM79Cyn9wiAyuQ6UN9knzJbBA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-23T08:29:07.733135Z"},"content_sha256":"d06f19ad7a91deff6d62fe37c01ea6d20f96d900b9e1b1735334209f394a0129","schema_version":"1.0","event_id":"sha256:d06f19ad7a91deff6d62fe37c01ea6d20f96d900b9e1b1735334209f394a0129"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2025:U2RQ6T5ZDPBLD46KBDGZXTTYAH","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"DFIR-Metric: A Benchmark Dataset for Evaluating Large Language Models in Digital Forensics and Incident Response","license":"http://creativecommons.org/licenses/by-nc-sa/4.0/","headline":"","cross_cats":["cs.AI"],"primary_cat":"cs.CR","authors_text":"Aaesha Aldahmani, Bilel Cherif, Norbert Tihanyi, Richard A. Dubniczky, Saeed Alshehhi, Tamas Bisztray","submitted_at":"2025-05-26T13:35:37Z","abstract_excerpt":"Digital Forensics and Incident Response (DFIR) involves analyzing digital evidence to support legal investigations. Large Language Models (LLMs) offer new opportunities in DFIR tasks such as log analysis and memory forensics, but their susceptibility to errors and hallucinations raises concerns in high-stakes contexts. Despite growing interest, there is no comprehensive benchmark to evaluate LLMs across both theoretical and practical DFIR domains. To address this gap, we present DFIR-Metric, a benchmark with three components: (1) Knowledge Assessment: a set of 700 expert-reviewed multiple-choi"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2505.19973","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2505.19973/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T11:09:50Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"Ta4kf5WLb2nQ8MZXbMeAueOJA4GzQpEtjhlXwyTClrLiuPP9EKcnaUVhV5yE+AbxqzlOFYpC1iWE6BRmO7XYCQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-23T08:29:07.733671Z"},"content_sha256":"5db472594b57262b419b9f71fadd004226cf382357b6987eee9dc9da4692c6fd","schema_version":"1.0","event_id":"sha256:5db472594b57262b419b9f71fadd004226cf382357b6987eee9dc9da4692c6fd"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/U2RQ6T5ZDPBLD46KBDGZXTTYAH/bundle.json","state_url":"https://pith.science/pith/U2RQ6T5ZDPBLD46KBDGZXTTYAH/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/U2RQ6T5ZDPBLD46KBDGZXTTYAH/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-23T08:29:07Z","links":{"resolver":"https://pith.science/pith/U2RQ6T5ZDPBLD46KBDGZXTTYAH","bundle":"https://pith.science/pith/U2RQ6T5ZDPBLD46KBDGZXTTYAH/bundle.json","state":"https://pith.science/pith/U2RQ6T5ZDPBLD46KBDGZXTTYAH/state.json","well_known_bundle":"https://pith.science/.well-known/pith/U2RQ6T5ZDPBLD46KBDGZXTTYAH/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2025:U2RQ6T5ZDPBLD46KBDGZXTTYAH","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"cf7aabd577fc2d42031b989cfd9ada6b3597d8f65550f27f255b9a3300ea7b47","cross_cats_sorted":["cs.AI"],"license":"http://creativecommons.org/licenses/by-nc-sa/4.0/","primary_cat":"cs.CR","submitted_at":"2025-05-26T13:35:37Z","title_canon_sha256":"a09ac988ec25f811585d6d922cf8d9549a909cc000b9495b9fbc0cab68f61d02"},"schema_version":"1.0","source":{"id":"2505.19973","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2505.19973","created_at":"2026-07-05T11:09:50Z"},{"alias_kind":"arxiv_version","alias_value":"2505.19973v1","created_at":"2026-07-05T11:09:50Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2505.19973","created_at":"2026-07-05T11:09:50Z"},{"alias_kind":"pith_short_12","alias_value":"U2RQ6T5ZDPBL","created_at":"2026-07-05T11:09:50Z"},{"alias_kind":"pith_short_16","alias_value":"U2RQ6T5ZDPBLD46K","created_at":"2026-07-05T11:09:50Z"},{"alias_kind":"pith_short_8","alias_value":"U2RQ6T5Z","created_at":"2026-07-05T11:09:50Z"}],"graph_snapshots":[{"event_id":"sha256:5db472594b57262b419b9f71fadd004226cf382357b6987eee9dc9da4692c6fd","target":"graph","created_at":"2026-07-05T11:09:50Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2505.19973/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Digital Forensics and Incident Response (DFIR) involves analyzing digital evidence to support legal investigations. Large Language Models (LLMs) offer new opportunities in DFIR tasks such as log analysis and memory forensics, but their susceptibility to errors and hallucinations raises concerns in high-stakes contexts. Despite growing interest, there is no comprehensive benchmark to evaluate LLMs across both theoretical and practical DFIR domains. To address this gap, we present DFIR-Metric, a benchmark with three components: (1) Knowledge Assessment: a set of 700 expert-reviewed multiple-choi","authors_text":"Aaesha Aldahmani, Bilel Cherif, Norbert Tihanyi, Richard A. Dubniczky, Saeed Alshehhi, Tamas Bisztray","cross_cats":["cs.AI"],"headline":"","license":"http://creativecommons.org/licenses/by-nc-sa/4.0/","primary_cat":"cs.CR","submitted_at":"2025-05-26T13:35:37Z","title":"DFIR-Metric: A Benchmark Dataset for Evaluating Large Language Models in Digital Forensics and Incident Response"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2505.19973","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:d06f19ad7a91deff6d62fe37c01ea6d20f96d900b9e1b1735334209f394a0129","target":"record","created_at":"2026-07-05T11:09:50Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"cf7aabd577fc2d42031b989cfd9ada6b3597d8f65550f27f255b9a3300ea7b47","cross_cats_sorted":["cs.AI"],"license":"http://creativecommons.org/licenses/by-nc-sa/4.0/","primary_cat":"cs.CR","submitted_at":"2025-05-26T13:35:37Z","title_canon_sha256":"a09ac988ec25f811585d6d922cf8d9549a909cc000b9495b9fbc0cab68f61d02"},"schema_version":"1.0","source":{"id":"2505.19973","kind":"arxiv","version":1}},"canonical_sha256":"a6a30f4fb91bc2b1f3ca08cd9bce7801e282cbab114ca773d4c5dc308f3534c1","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"a6a30f4fb91bc2b1f3ca08cd9bce7801e282cbab114ca773d4c5dc308f3534c1","first_computed_at":"2026-07-05T11:09:50.746018Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T11:09:50.746018Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"M0RSlhLrnoaZikW2S3DfviYsb2DZUGiKkRanv4Y7tmeXkq9HpjhMRWWqMXCSJ7peE6EZVjnpgxct2fXOXHUbBg==","signature_status":"signed_v1","signed_at":"2026-07-05T11:09:50.746512Z","signed_message":"canonical_sha256_bytes"},"source_id":"2505.19973","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:d06f19ad7a91deff6d62fe37c01ea6d20f96d900b9e1b1735334209f394a0129","sha256:5db472594b57262b419b9f71fadd004226cf382357b6987eee9dc9da4692c6fd"],"state_sha256":"40cd64858c488472fdc8068c8ecc4a12568353fc1403b6508e00d2a49828d3ca"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"qtapq7dQFDF3vOZzLphnF56ETpLaGOEZ08t3rxuL2z/cY+/sDzH3vg7Fj6SZvy3UPpwzNIvUPl7YwcXTJmFEBw==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-23T08:29:07.738217Z","bundle_sha256":"7d72cc744934c4087871140db6d5f12e56f447951bca37c656dbaf97db3e2542"}}