{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2022:WV5RKWS3DYIMIZUPJXGF3ILIXD","short_pith_number":"pith:WV5RKWS3","canonical_record":{"source":{"id":"2206.13614","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by-sa/4.0/","primary_cat":"cs.CR","submitted_at":"2022-06-27T20:19:39Z","cross_cats_sorted":["cs.LG","cs.NI"],"title_canon_sha256":"5c6c972d14393d1018f7b999edb994fad498deb10311d2d7f73041148c195375","abstract_canon_sha256":"2de058e0a55402368402441492a523ec72b60e44e8c80ace29d117e5176ca556"},"schema_version":"1.0"},"canonical_sha256":"b57b155a5b1e10c4668f4dcc5da168b8d054f19d952474ef7506b30832753571","source":{"kind":"arxiv","id":"2206.13614","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2206.13614","created_at":"2026-07-05T04:35:23Z"},{"alias_kind":"arxiv_version","alias_value":"2206.13614v1","created_at":"2026-07-05T04:35:23Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2206.13614","created_at":"2026-07-05T04:35:23Z"},{"alias_kind":"pith_short_12","alias_value":"WV5RKWS3DYIM","created_at":"2026-07-05T04:35:23Z"},{"alias_kind":"pith_short_16","alias_value":"WV5RKWS3DYIMIZUP","created_at":"2026-07-05T04:35:23Z"},{"alias_kind":"pith_short_8","alias_value":"WV5RKWS3","created_at":"2026-07-05T04:35:23Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2022:WV5RKWS3DYIMIZUPJXGF3ILIXD","target":"record","payload":{"canonical_record":{"source":{"id":"2206.13614","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by-sa/4.0/","primary_cat":"cs.CR","submitted_at":"2022-06-27T20:19:39Z","cross_cats_sorted":["cs.LG","cs.NI"],"title_canon_sha256":"5c6c972d14393d1018f7b999edb994fad498deb10311d2d7f73041148c195375","abstract_canon_sha256":"2de058e0a55402368402441492a523ec72b60e44e8c80ace29d117e5176ca556"},"schema_version":"1.0"},"canonical_sha256":"b57b155a5b1e10c4668f4dcc5da168b8d054f19d952474ef7506b30832753571","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T04:35:23.212174Z","signature_b64":"Qmp2tav3oB5cdaa4cXrO5wj1yAxOEXJIT9OWT/GdVfPE/5lDpKZFxLlUHVcG4ILt2oT59oBscgtepEIy9R5qAw==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"b57b155a5b1e10c4668f4dcc5da168b8d054f19d952474ef7506b30832753571","last_reissued_at":"2026-07-05T04:35:23.211798Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T04:35:23.211798Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2206.13614","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T04:35:23Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"JbLNpeAqe7atC/pW139HEBg5xsD1uv4vA9DwXfJWN09vb4UtQR8WdkdoT6UsRGofwM7niQS9GOCS8CCAQPXHAw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-07-09T04:33:02.405231Z"},"content_sha256":"fe19e2b9c6e68ca0ccd80bd0f413bf92c77b93e24982d80f346f7c604a03e3ac","schema_version":"1.0","event_id":"sha256:fe19e2b9c6e68ca0ccd80bd0f413bf92c77b93e24982d80f346f7c604a03e3ac"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2022:WV5RKWS3DYIMIZUPJXGF3ILIXD","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Measuring and Clustering Network Attackers using Medium-Interaction Honeypots","license":"http://creativecommons.org/licenses/by-sa/4.0/","headline":"","cross_cats":["cs.LG","cs.NI"],"primary_cat":"cs.CR","authors_text":"Alex Liu, Daehyun Kyoung, Daniel Zhang, Zain Shamsi","submitted_at":"2022-06-27T20:19:39Z","abstract_excerpt":"Network honeypots are often used by information security teams to measure the threat landscape in order to secure their networks. With the advancement of honeypot development, today's medium-interaction honeypots provide a way for security teams and researchers to deploy these active defense tools that require little maintenance on a variety of protocols. In this work, we deploy such honeypots on five different protocols on the public Internet and study the intent and sophistication of the attacks we observe. We then use the information gained to develop a clustering approach that identifies c"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2206.13614","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2206.13614/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T04:35:23Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"KrjmYtRErpQVnTMBpzwCsJekZlrXSciyDLIwZFEWg3xPO2/BZ/PLCeos3BeyIA1NNJ/V8ADenysLTCZgtdvgBw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-07-09T04:33:02.405625Z"},"content_sha256":"58a333744d2455cc8ef9528c7db4518f5d4c5f63782b5357844cc2bf93706fda","schema_version":"1.0","event_id":"sha256:58a333744d2455cc8ef9528c7db4518f5d4c5f63782b5357844cc2bf93706fda"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/WV5RKWS3DYIMIZUPJXGF3ILIXD/bundle.json","state_url":"https://pith.science/pith/WV5RKWS3DYIMIZUPJXGF3ILIXD/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/WV5RKWS3DYIMIZUPJXGF3ILIXD/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-07-09T04:33:02Z","links":{"resolver":"https://pith.science/pith/WV5RKWS3DYIMIZUPJXGF3ILIXD","bundle":"https://pith.science/pith/WV5RKWS3DYIMIZUPJXGF3ILIXD/bundle.json","state":"https://pith.science/pith/WV5RKWS3DYIMIZUPJXGF3ILIXD/state.json","well_known_bundle":"https://pith.science/.well-known/pith/WV5RKWS3DYIMIZUPJXGF3ILIXD/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2022:WV5RKWS3DYIMIZUPJXGF3ILIXD","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"2de058e0a55402368402441492a523ec72b60e44e8c80ace29d117e5176ca556","cross_cats_sorted":["cs.LG","cs.NI"],"license":"http://creativecommons.org/licenses/by-sa/4.0/","primary_cat":"cs.CR","submitted_at":"2022-06-27T20:19:39Z","title_canon_sha256":"5c6c972d14393d1018f7b999edb994fad498deb10311d2d7f73041148c195375"},"schema_version":"1.0","source":{"id":"2206.13614","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2206.13614","created_at":"2026-07-05T04:35:23Z"},{"alias_kind":"arxiv_version","alias_value":"2206.13614v1","created_at":"2026-07-05T04:35:23Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2206.13614","created_at":"2026-07-05T04:35:23Z"},{"alias_kind":"pith_short_12","alias_value":"WV5RKWS3DYIM","created_at":"2026-07-05T04:35:23Z"},{"alias_kind":"pith_short_16","alias_value":"WV5RKWS3DYIMIZUP","created_at":"2026-07-05T04:35:23Z"},{"alias_kind":"pith_short_8","alias_value":"WV5RKWS3","created_at":"2026-07-05T04:35:23Z"}],"graph_snapshots":[{"event_id":"sha256:58a333744d2455cc8ef9528c7db4518f5d4c5f63782b5357844cc2bf93706fda","target":"graph","created_at":"2026-07-05T04:35:23Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2206.13614/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Network honeypots are often used by information security teams to measure the threat landscape in order to secure their networks. With the advancement of honeypot development, today's medium-interaction honeypots provide a way for security teams and researchers to deploy these active defense tools that require little maintenance on a variety of protocols. In this work, we deploy such honeypots on five different protocols on the public Internet and study the intent and sophistication of the attacks we observe. We then use the information gained to develop a clustering approach that identifies c","authors_text":"Alex Liu, Daehyun Kyoung, Daniel Zhang, Zain Shamsi","cross_cats":["cs.LG","cs.NI"],"headline":"","license":"http://creativecommons.org/licenses/by-sa/4.0/","primary_cat":"cs.CR","submitted_at":"2022-06-27T20:19:39Z","title":"Measuring and Clustering Network Attackers using Medium-Interaction Honeypots"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2206.13614","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:fe19e2b9c6e68ca0ccd80bd0f413bf92c77b93e24982d80f346f7c604a03e3ac","target":"record","created_at":"2026-07-05T04:35:23Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"2de058e0a55402368402441492a523ec72b60e44e8c80ace29d117e5176ca556","cross_cats_sorted":["cs.LG","cs.NI"],"license":"http://creativecommons.org/licenses/by-sa/4.0/","primary_cat":"cs.CR","submitted_at":"2022-06-27T20:19:39Z","title_canon_sha256":"5c6c972d14393d1018f7b999edb994fad498deb10311d2d7f73041148c195375"},"schema_version":"1.0","source":{"id":"2206.13614","kind":"arxiv","version":1}},"canonical_sha256":"b57b155a5b1e10c4668f4dcc5da168b8d054f19d952474ef7506b30832753571","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"b57b155a5b1e10c4668f4dcc5da168b8d054f19d952474ef7506b30832753571","first_computed_at":"2026-07-05T04:35:23.211798Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T04:35:23.211798Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"Qmp2tav3oB5cdaa4cXrO5wj1yAxOEXJIT9OWT/GdVfPE/5lDpKZFxLlUHVcG4ILt2oT59oBscgtepEIy9R5qAw==","signature_status":"signed_v1","signed_at":"2026-07-05T04:35:23.212174Z","signed_message":"canonical_sha256_bytes"},"source_id":"2206.13614","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:fe19e2b9c6e68ca0ccd80bd0f413bf92c77b93e24982d80f346f7c604a03e3ac","sha256:58a333744d2455cc8ef9528c7db4518f5d4c5f63782b5357844cc2bf93706fda"],"state_sha256":"3e18393e0265ffb93582d0bf84606a228b6cf6582bdf4cec569b10bb80437a08"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"dxz2RAd8bjJqb6d2p8yKwI4cNsc2cel4+KXrt7D+aURA82UDPXmZb/58wcHg/0w1v4oMmIEGDmUGgITF1nWtCw==","signed_message":"bundle_sha256_bytes","signed_at":"2026-07-09T04:33:02.407614Z","bundle_sha256":"5762c43274ad3a90a15afae01847d9078a134f221222a6f699bfb4c11eec3971"}}