Pith Number

pith:WB2BPMDF

pith:2023:WB2BPMDFYAJFJEZBJUHZ26DF5A

not attested not anchored not stored refs pending

Detection of Anomalous Network Nodes via Hierarchical Prediction and Extreme Value Theory

Asha Rao, Conrad Sanderson, Hideya Ochiai, Mahdi Abolghasemi, Sevvandi Kandanaarachchi

A two-stage method using hierarchical time series prediction of ARP calls followed by extreme value theory flags anomalous network nodes while cutting false positives.

arxiv:2304.13941 v3 · 2023-04-27 · cs.CR

Open paper page JSON Open Graph Bundle Merged state Verified badge What is a Pith Number?

Add to your LaTeX paper

\usepackage{pith}
\pithnumber{WB2BPMDFYAJFJEZBJUHZ26DF5A}

Prints a linked badge after your title and injects PDF metadata. Compiles on arXiv. Learn more · Embed verified badge

Record completeness

1 Bitcoin timestamp

2 Internet Archive

3 Author claim open · sign in to claim

4 Citations open

5 Replications open

✓ Portable graph bundle live · download bundle · merged state

The bundle contains the canonical record plus signed events. A mirror can host it anywhere and recompute the same current state with the deterministic merge algorithm.

Claims

C1strongest claim

Empirical evaluations on a real-life dataset containing over 10M ARP calls from 362 nodes show that the proposed method results in considerably reduced number of false positives, addressing the problem of alert fatigue commonly reported by security professionals.

C2weakest assumption

That the residuals from the hierarchical time series predictions of ARP behavior follow heavy-tailed distributions for which Extreme Value Theory provides a reliable threshold to separate normal variation from anomalous behavior.

C3one line summary

Hierarchical time series prediction of ARP calls combined with Extreme Value Theory identifies anomalous nodes while substantially lowering false positive rates on a real dataset of over 10 million calls.

Receipt and verification

First computed	2026-05-26T02:03:44.390000Z
Builder	pith-number-builder-2026-05-17-v1
Signature	Pith Ed25519 (`pith-v1-2026-05`) · public key
Schema	pith-number/v1.0

Canonical hash

b07417b065c0125493214d0f9d7865e8166b2c49581a8eb60920207cee134aa4

Aliases

arxiv: 2304.13941 · arxiv_version: 2304.13941v3 · doi: 10.48550/arxiv.2304.13941 · pith_short_12: WB2BPMDFYAJF · pith_short_16: WB2BPMDFYAJFJEZB · pith_short_8: WB2BPMDF

Agent API

Resolver JSON Graph JSON Events JSON Schema Signing key

Verify this Pith Number yourself

curl -sH 'Accept: application/ld+json' https://pith.science/pith/WB2BPMDFYAJFJEZBJUHZ26DF5A \
  | jq -c '.canonical_record' \
  | python3 -c "import sys,json,hashlib; b=json.dumps(json.loads(sys.stdin.read()), sort_keys=True, separators=(',',':'), ensure_ascii=False).encode(); print(hashlib.sha256(b).hexdigest())"
# expect: b07417b065c0125493214d0f9d7865e8166b2c49581a8eb60920207cee134aa4

Canonical record JSON

{
  "metadata": {
    "abstract_canon_sha256": "25834a3a4c29e17db70be54647aee3b8098ea2dbcfcb9d8d57457d7e1a66117e",
    "cross_cats_sorted": [],
    "license": "http://arxiv.org/licenses/nonexclusive-distrib/1.0/",
    "primary_cat": "cs.CR",
    "submitted_at": "2023-04-27T03:19:26Z",
    "title_canon_sha256": "8f442d6bde68b66c7791b2014ddce01af56c9b53f34d954b685e73f443b23e3c"
  },
  "schema_version": "1.0",
  "source": {
    "id": "2304.13941",
    "kind": "arxiv",
    "version": 3
  }
}