{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2024:XHUD5P6I4IDEPBEUO5ABAND35E","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"3f4035f137c3128597054b51cce062c05bf6d3aca0c66ecfd084140a387d69c0","cross_cats_sorted":["cs.AI"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2024-08-12T11:33:45Z","title_canon_sha256":"4e4bb69f6f0df6ff74df988a7253fbb76f5fb8225e5ed248d81fe4dd5b48564b"},"schema_version":"1.0","source":{"id":"2408.08902","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2408.08902","created_at":"2026-07-05T08:56:25Z"},{"alias_kind":"arxiv_version","alias_value":"2408.08902v1","created_at":"2026-07-05T08:56:25Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2408.08902","created_at":"2026-07-05T08:56:25Z"},{"alias_kind":"pith_short_12","alias_value":"XHUD5P6I4IDE","created_at":"2026-07-05T08:56:25Z"},{"alias_kind":"pith_short_16","alias_value":"XHUD5P6I4IDEPBEU","created_at":"2026-07-05T08:56:25Z"},{"alias_kind":"pith_short_8","alias_value":"XHUD5P6I","created_at":"2026-07-05T08:56:25Z"}],"graph_snapshots":[{"event_id":"sha256:7a9451967eee5b42a26124bb6e2dd7e6340762f9a2157b389b58e29ee69b8652","target":"graph","created_at":"2026-07-05T08:56:25Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2408.08902/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Log-based insider threat detection (ITD) detects malicious user activities by auditing log entries. Recently, large language models (LLMs) with strong common sense knowledge have emerged in the domain of ITD. Nevertheless, diverse activity types and overlong log files pose a significant challenge for LLMs in directly discerning malicious ones within myriads of normal activities. Furthermore, the faithfulness hallucination issue from LLMs aggravates its application difficulty in ITD, as the generated conclusion may not align with user commands and activity context. In response to these challeng","authors_text":"Chengyu Song, Hongyu Kuang, Jianming Zheng, Jinzhi Liao, Linru Ma, Lin Yang","cross_cats":["cs.AI"],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2024-08-12T11:33:45Z","title":"Audit-LLM: Multi-Agent Collaboration for Log-based Insider Threat Detection"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2408.08902","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:7fdc67711b00ac8ca80003fc3ba03224ad16f294e5fde7d8c7e9289737f6a26d","target":"record","created_at":"2026-07-05T08:56:25Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"3f4035f137c3128597054b51cce062c05bf6d3aca0c66ecfd084140a387d69c0","cross_cats_sorted":["cs.AI"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2024-08-12T11:33:45Z","title_canon_sha256":"4e4bb69f6f0df6ff74df988a7253fbb76f5fb8225e5ed248d81fe4dd5b48564b"},"schema_version":"1.0","source":{"id":"2408.08902","kind":"arxiv","version":1}},"canonical_sha256":"b9e83ebfc8e206478494774010347be912e405a5e648b8bed095f42e3eee7b3e","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"b9e83ebfc8e206478494774010347be912e405a5e648b8bed095f42e3eee7b3e","first_computed_at":"2026-07-05T08:56:25.318619Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T08:56:25.318619Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"+OvSFp6HSOVdAJzGrTsYGEJE01eUEKg4G4aYQ4hJQEvNo1zCzqsefzhYXptGmQo0gCP8mvi5LLT3Zb9DdsNMBg==","signature_status":"signed_v1","signed_at":"2026-07-05T08:56:25.319160Z","signed_message":"canonical_sha256_bytes"},"source_id":"2408.08902","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:7fdc67711b00ac8ca80003fc3ba03224ad16f294e5fde7d8c7e9289737f6a26d","sha256:7a9451967eee5b42a26124bb6e2dd7e6340762f9a2157b389b58e29ee69b8652"],"state_sha256":"abc2ba9febf93c4a0df19534f5becc00707b9584eac4e895d13854bfd0acf7bc"}