{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2017:VJPUZHYQYBZHAO6FENPDTNMELT","short_pith_number":"pith:VJPUZHYQ","canonical_record":{"source":{"id":"1711.02824","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/publicdomain/zero/1.0/","primary_cat":"cs.CR","submitted_at":"2017-11-08T04:26:50Z","cross_cats_sorted":[],"title_canon_sha256":"9914e0df7796ef5aa72308ebd74361cba91852526f71f8d2b3f73f1c814d4b28","abstract_canon_sha256":"11221b0964a19da80182ca99a3b17de87e98afc7e2d1e31a60437282a1aa26c5"},"schema_version":"1.0"},"canonical_sha256":"aa5f4c9f10c072703bc5235e39b5845cc50e290d4063f376c5cd08a40cdccb2a","source":{"kind":"arxiv","id":"1711.02824","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"1711.02824","created_at":"2026-05-18T00:31:01Z"},{"alias_kind":"arxiv_version","alias_value":"1711.02824v1","created_at":"2026-05-18T00:31:01Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.1711.02824","created_at":"2026-05-18T00:31:01Z"},{"alias_kind":"pith_short_12","alias_value":"VJPUZHYQYBZH","created_at":"2026-05-18T12:31:49Z"},{"alias_kind":"pith_short_16","alias_value":"VJPUZHYQYBZHAO6F","created_at":"2026-05-18T12:31:49Z"},{"alias_kind":"pith_short_8","alias_value":"VJPUZHYQ","created_at":"2026-05-18T12:31:49Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2017:VJPUZHYQYBZHAO6FENPDTNMELT","target":"record","payload":{"canonical_record":{"source":{"id":"1711.02824","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/publicdomain/zero/1.0/","primary_cat":"cs.CR","submitted_at":"2017-11-08T04:26:50Z","cross_cats_sorted":[],"title_canon_sha256":"9914e0df7796ef5aa72308ebd74361cba91852526f71f8d2b3f73f1c814d4b28","abstract_canon_sha256":"11221b0964a19da80182ca99a3b17de87e98afc7e2d1e31a60437282a1aa26c5"},"schema_version":"1.0"},"canonical_sha256":"aa5f4c9f10c072703bc5235e39b5845cc50e290d4063f376c5cd08a40cdccb2a","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-05-18T00:31:01.631018Z","signature_b64":"3aDNsChkaVodFJjlFlwBVq2NsyOW8OIUA5zdU4uLxvgmPWLKKnP8Tjl7UwP9DPasejI1ufThXfj8KHQGaXvwAw==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"aa5f4c9f10c072703bc5235e39b5845cc50e290d4063f376c5cd08a40cdccb2a","last_reissued_at":"2026-05-18T00:31:01.630233Z","signature_status":"signed_v1","first_computed_at":"2026-05-18T00:31:01.630233Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"1711.02824","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-05-18T00:31:01Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"hOupb6qD0xTU26pSt0dUciShxBn6/AqEpdS6sudeLCLHRkZj+tQKlYeBIYMPjc5ECoOU8pBpC42R2o5QOzX6Bw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-06-08T06:11:28.011528Z"},"content_sha256":"fcf4a707d36ebc38cf57599f84f7905b0a6c5ab2ccd28f41e2d7f7e2eca33485","schema_version":"1.0","event_id":"sha256:fcf4a707d36ebc38cf57599f84f7905b0a6c5ab2ccd28f41e2d7f7e2eca33485"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2017:VJPUZHYQYBZHAO6FENPDTNMELT","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"RCNF: Real-time Collaborative Network Forensic Scheme for Evidence Analysis","license":"http://creativecommons.org/publicdomain/zero/1.0/","headline":"","cross_cats":[],"primary_cat":"cs.CR","authors_text":"Jill Slay, Nour Moustafa","submitted_at":"2017-11-08T04:26:50Z","abstract_excerpt":"Network forensic techniques help in tracking different types of cyber attack by monitoring and inspecting network traffic. However, with the high speed and large sizes of current networks, and the sophisticated philosophy of attackers, in particular mimicking normal behaviour and/or erasing traces to avoid detection, investigating such crimes demands intelligent network forensic techniques. This paper suggests a real-time collaborative network Forensic scheme (RCNF) that can monitor and investigate cyber intrusions. The scheme includes three components of capturing and storing network data, se"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"1711.02824","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-05-18T00:31:01Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"5MDiTFfREP3zAZ79NWccmc0LvQmGpJuQJ6lqTw9RbPdalwcRU5/jAkh6hfOVg/JQ9BZAiVE+41WzFrMbnRVAAg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-06-08T06:11:28.012197Z"},"content_sha256":"677a79ed69be0a0b6db45d3ee184d19bca0a34c88c0b58996794b51fd9b6a4ef","schema_version":"1.0","event_id":"sha256:677a79ed69be0a0b6db45d3ee184d19bca0a34c88c0b58996794b51fd9b6a4ef"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/VJPUZHYQYBZHAO6FENPDTNMELT/bundle.json","state_url":"https://pith.science/pith/VJPUZHYQYBZHAO6FENPDTNMELT/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/VJPUZHYQYBZHAO6FENPDTNMELT/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-06-08T06:11:28Z","links":{"resolver":"https://pith.science/pith/VJPUZHYQYBZHAO6FENPDTNMELT","bundle":"https://pith.science/pith/VJPUZHYQYBZHAO6FENPDTNMELT/bundle.json","state":"https://pith.science/pith/VJPUZHYQYBZHAO6FENPDTNMELT/state.json","well_known_bundle":"https://pith.science/.well-known/pith/VJPUZHYQYBZHAO6FENPDTNMELT/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2017:VJPUZHYQYBZHAO6FENPDTNMELT","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"11221b0964a19da80182ca99a3b17de87e98afc7e2d1e31a60437282a1aa26c5","cross_cats_sorted":[],"license":"http://creativecommons.org/publicdomain/zero/1.0/","primary_cat":"cs.CR","submitted_at":"2017-11-08T04:26:50Z","title_canon_sha256":"9914e0df7796ef5aa72308ebd74361cba91852526f71f8d2b3f73f1c814d4b28"},"schema_version":"1.0","source":{"id":"1711.02824","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"1711.02824","created_at":"2026-05-18T00:31:01Z"},{"alias_kind":"arxiv_version","alias_value":"1711.02824v1","created_at":"2026-05-18T00:31:01Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.1711.02824","created_at":"2026-05-18T00:31:01Z"},{"alias_kind":"pith_short_12","alias_value":"VJPUZHYQYBZH","created_at":"2026-05-18T12:31:49Z"},{"alias_kind":"pith_short_16","alias_value":"VJPUZHYQYBZHAO6F","created_at":"2026-05-18T12:31:49Z"},{"alias_kind":"pith_short_8","alias_value":"VJPUZHYQ","created_at":"2026-05-18T12:31:49Z"}],"graph_snapshots":[{"event_id":"sha256:677a79ed69be0a0b6db45d3ee184d19bca0a34c88c0b58996794b51fd9b6a4ef","target":"graph","created_at":"2026-05-18T00:31:01Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"paper":{"abstract_excerpt":"Network forensic techniques help in tracking different types of cyber attack by monitoring and inspecting network traffic. However, with the high speed and large sizes of current networks, and the sophisticated philosophy of attackers, in particular mimicking normal behaviour and/or erasing traces to avoid detection, investigating such crimes demands intelligent network forensic techniques. This paper suggests a real-time collaborative network Forensic scheme (RCNF) that can monitor and investigate cyber intrusions. The scheme includes three components of capturing and storing network data, se","authors_text":"Jill Slay, Nour Moustafa","cross_cats":[],"headline":"","license":"http://creativecommons.org/publicdomain/zero/1.0/","primary_cat":"cs.CR","submitted_at":"2017-11-08T04:26:50Z","title":"RCNF: Real-time Collaborative Network Forensic Scheme for Evidence Analysis"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"1711.02824","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:fcf4a707d36ebc38cf57599f84f7905b0a6c5ab2ccd28f41e2d7f7e2eca33485","target":"record","created_at":"2026-05-18T00:31:01Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"11221b0964a19da80182ca99a3b17de87e98afc7e2d1e31a60437282a1aa26c5","cross_cats_sorted":[],"license":"http://creativecommons.org/publicdomain/zero/1.0/","primary_cat":"cs.CR","submitted_at":"2017-11-08T04:26:50Z","title_canon_sha256":"9914e0df7796ef5aa72308ebd74361cba91852526f71f8d2b3f73f1c814d4b28"},"schema_version":"1.0","source":{"id":"1711.02824","kind":"arxiv","version":1}},"canonical_sha256":"aa5f4c9f10c072703bc5235e39b5845cc50e290d4063f376c5cd08a40cdccb2a","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"aa5f4c9f10c072703bc5235e39b5845cc50e290d4063f376c5cd08a40cdccb2a","first_computed_at":"2026-05-18T00:31:01.630233Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-05-18T00:31:01.630233Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"3aDNsChkaVodFJjlFlwBVq2NsyOW8OIUA5zdU4uLxvgmPWLKKnP8Tjl7UwP9DPasejI1ufThXfj8KHQGaXvwAw==","signature_status":"signed_v1","signed_at":"2026-05-18T00:31:01.631018Z","signed_message":"canonical_sha256_bytes"},"source_id":"1711.02824","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:fcf4a707d36ebc38cf57599f84f7905b0a6c5ab2ccd28f41e2d7f7e2eca33485","sha256:677a79ed69be0a0b6db45d3ee184d19bca0a34c88c0b58996794b51fd9b6a4ef"],"state_sha256":"e8cb054f1b47aa7dd1713f65a19e0e1044d093ab1a649853531546f85a4c104f"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"84T2eZKGqrgGoJHydqgJGYINeN4y9nP/3bcCvYn1qcB0UwYe/MDRtTL/uqHchUZz6ZoKjZig18XUFNDNelfMBA==","signed_message":"bundle_sha256_bytes","signed_at":"2026-06-08T06:11:28.016043Z","bundle_sha256":"7a620d5daa5ade7f43c71f871e2c5a81a836b5a093112b43028dacca3a3cc2b8"}}