{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2019:WCPTXHZI4ETLWG4G3ASN6UJR4J","short_pith_number":"pith:WCPTXHZI","canonical_record":{"source":{"id":"1904.03584","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2019-04-07T05:20:02Z","cross_cats_sorted":["cs.LG"],"title_canon_sha256":"c9271dcc48cf996954f74fccc838d763913d54e2e108139786080a3d66b355ba","abstract_canon_sha256":"538a66439e6e4bea3bba6d8902102804afb801954627ee651e72ed53561c66f0"},"schema_version":"1.0"},"canonical_sha256":"b09f3b9f28e126bb1b86d824df5131e26b4ece2668f28bc79a7a19270a19ae52","source":{"kind":"arxiv","id":"1904.03584","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"1904.03584","created_at":"2026-05-17T23:49:12Z"},{"alias_kind":"arxiv_version","alias_value":"1904.03584v1","created_at":"2026-05-17T23:49:12Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.1904.03584","created_at":"2026-05-17T23:49:12Z"},{"alias_kind":"pith_short_12","alias_value":"WCPTXHZI4ETL","created_at":"2026-05-18T12:33:30Z"},{"alias_kind":"pith_short_16","alias_value":"WCPTXHZI4ETLWG4G","created_at":"2026-05-18T12:33:30Z"},{"alias_kind":"pith_short_8","alias_value":"WCPTXHZI","created_at":"2026-05-18T12:33:30Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2019:WCPTXHZI4ETLWG4G3ASN6UJR4J","target":"record","payload":{"canonical_record":{"source":{"id":"1904.03584","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2019-04-07T05:20:02Z","cross_cats_sorted":["cs.LG"],"title_canon_sha256":"c9271dcc48cf996954f74fccc838d763913d54e2e108139786080a3d66b355ba","abstract_canon_sha256":"538a66439e6e4bea3bba6d8902102804afb801954627ee651e72ed53561c66f0"},"schema_version":"1.0"},"canonical_sha256":"b09f3b9f28e126bb1b86d824df5131e26b4ece2668f28bc79a7a19270a19ae52","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-05-17T23:49:12.912446Z","signature_b64":"Kk5x7uc9ZLMWyNDqElPYTmp8TQKupz9wMTHBmMvG5LjrFmf1CsSTTj6Kv1DfcFXZfH3S+hT66Xu+l3RhhBOfDA==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"b09f3b9f28e126bb1b86d824df5131e26b4ece2668f28bc79a7a19270a19ae52","last_reissued_at":"2026-05-17T23:49:12.909737Z","signature_status":"signed_v1","first_computed_at":"2026-05-17T23:49:12.909737Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"1904.03584","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-05-17T23:49:12Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"E90SM1L4cI67GYaeYjf51n9Eo96aJI2hEmtEQtSVUgRrEblHeFQxXZ24ZRs38mFXqB3AZh+9NrAQJOAH4QXNDQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-06-02T02:18:25.654227Z"},"content_sha256":"ac1e0fd13f56abccdface5bf0458850594778c1205f2757f74bffe7924966aff","schema_version":"1.0","event_id":"sha256:ac1e0fd13f56abccdface5bf0458850594778c1205f2757f74bffe7924966aff"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2019:WCPTXHZI4ETLWG4G3ASN6UJR4J","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Reframing Threat Detection: Inside esINSIDER","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":["cs.LG"],"primary_cat":"cs.CR","authors_text":"Ashley Fidler, Dustin Hillard, Jason Kichen, M. Arthur Munson, Peiter Zatko","submitted_at":"2019-04-07T05:20:02Z","abstract_excerpt":"We describe the motivation and design for esINSIDER, an automated tool that detects potential persistent and insider threats in a network. esINSIDER aggregates clues from log data, over extended time periods, and proposes a small number of cases for human experts to review. The proposed cases package together related information so the analyst can see a bigger picture of what is happening, and their evidence includes internal network activity resembling reconnaissance and data collection.\n  The core ideas are to 1) detect fundamental campaign behaviors by following data movements over extended"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"1904.03584","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-05-17T23:49:12Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"UBA5ZXuqlVF7rfsuCDqu9nv+4F+TZCfdeJAqBbw5c+oCjCJQcNklUgCXgNxwDQ3r7Xi2DJAqA7FsDwJ1ErbSAw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-06-02T02:18:25.654582Z"},"content_sha256":"55675a1a72a2f1c61013ee9f43ed0caf363a2ce9ea1451099c0ebc63673270ad","schema_version":"1.0","event_id":"sha256:55675a1a72a2f1c61013ee9f43ed0caf363a2ce9ea1451099c0ebc63673270ad"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/WCPTXHZI4ETLWG4G3ASN6UJR4J/bundle.json","state_url":"https://pith.science/pith/WCPTXHZI4ETLWG4G3ASN6UJR4J/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/WCPTXHZI4ETLWG4G3ASN6UJR4J/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-06-02T02:18:25Z","links":{"resolver":"https://pith.science/pith/WCPTXHZI4ETLWG4G3ASN6UJR4J","bundle":"https://pith.science/pith/WCPTXHZI4ETLWG4G3ASN6UJR4J/bundle.json","state":"https://pith.science/pith/WCPTXHZI4ETLWG4G3ASN6UJR4J/state.json","well_known_bundle":"https://pith.science/.well-known/pith/WCPTXHZI4ETLWG4G3ASN6UJR4J/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2019:WCPTXHZI4ETLWG4G3ASN6UJR4J","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"538a66439e6e4bea3bba6d8902102804afb801954627ee651e72ed53561c66f0","cross_cats_sorted":["cs.LG"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2019-04-07T05:20:02Z","title_canon_sha256":"c9271dcc48cf996954f74fccc838d763913d54e2e108139786080a3d66b355ba"},"schema_version":"1.0","source":{"id":"1904.03584","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"1904.03584","created_at":"2026-05-17T23:49:12Z"},{"alias_kind":"arxiv_version","alias_value":"1904.03584v1","created_at":"2026-05-17T23:49:12Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.1904.03584","created_at":"2026-05-17T23:49:12Z"},{"alias_kind":"pith_short_12","alias_value":"WCPTXHZI4ETL","created_at":"2026-05-18T12:33:30Z"},{"alias_kind":"pith_short_16","alias_value":"WCPTXHZI4ETLWG4G","created_at":"2026-05-18T12:33:30Z"},{"alias_kind":"pith_short_8","alias_value":"WCPTXHZI","created_at":"2026-05-18T12:33:30Z"}],"graph_snapshots":[{"event_id":"sha256:55675a1a72a2f1c61013ee9f43ed0caf363a2ce9ea1451099c0ebc63673270ad","target":"graph","created_at":"2026-05-17T23:49:12Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"paper":{"abstract_excerpt":"We describe the motivation and design for esINSIDER, an automated tool that detects potential persistent and insider threats in a network. esINSIDER aggregates clues from log data, over extended time periods, and proposes a small number of cases for human experts to review. The proposed cases package together related information so the analyst can see a bigger picture of what is happening, and their evidence includes internal network activity resembling reconnaissance and data collection.\n  The core ideas are to 1) detect fundamental campaign behaviors by following data movements over extended","authors_text":"Ashley Fidler, Dustin Hillard, Jason Kichen, M. Arthur Munson, Peiter Zatko","cross_cats":["cs.LG"],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2019-04-07T05:20:02Z","title":"Reframing Threat Detection: Inside esINSIDER"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"1904.03584","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:ac1e0fd13f56abccdface5bf0458850594778c1205f2757f74bffe7924966aff","target":"record","created_at":"2026-05-17T23:49:12Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"538a66439e6e4bea3bba6d8902102804afb801954627ee651e72ed53561c66f0","cross_cats_sorted":["cs.LG"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2019-04-07T05:20:02Z","title_canon_sha256":"c9271dcc48cf996954f74fccc838d763913d54e2e108139786080a3d66b355ba"},"schema_version":"1.0","source":{"id":"1904.03584","kind":"arxiv","version":1}},"canonical_sha256":"b09f3b9f28e126bb1b86d824df5131e26b4ece2668f28bc79a7a19270a19ae52","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"b09f3b9f28e126bb1b86d824df5131e26b4ece2668f28bc79a7a19270a19ae52","first_computed_at":"2026-05-17T23:49:12.909737Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-05-17T23:49:12.909737Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"Kk5x7uc9ZLMWyNDqElPYTmp8TQKupz9wMTHBmMvG5LjrFmf1CsSTTj6Kv1DfcFXZfH3S+hT66Xu+l3RhhBOfDA==","signature_status":"signed_v1","signed_at":"2026-05-17T23:49:12.912446Z","signed_message":"canonical_sha256_bytes"},"source_id":"1904.03584","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:ac1e0fd13f56abccdface5bf0458850594778c1205f2757f74bffe7924966aff","sha256:55675a1a72a2f1c61013ee9f43ed0caf363a2ce9ea1451099c0ebc63673270ad"],"state_sha256":"c8da32da788d2bc84b5eef82f51334a49b2ee4fc2f29f47afb8f587a4078b469"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"1/U9KY5O8fwrK9jXnHg5kiLkgjBMLElHKQrSuXZPKWI6Px01h95PeI/42JtYYkCNtKnERdz4m+Fc5yLlKePrDg==","signed_message":"bundle_sha256_bytes","signed_at":"2026-06-02T02:18:25.656466Z","bundle_sha256":"5698bd9fb438773d74fa77ac0f0a96800432f2e950a086874520c34ab68d69e1"}}