{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2020:XWJXAQGSWZDEZ67FWXJ7NPQS7L","short_pith_number":"pith:XWJXAQGS","canonical_record":{"source":{"id":"2004.14322","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2020-04-29T16:45:14Z","cross_cats_sorted":["cs.LG"],"title_canon_sha256":"081fe065979ecc6d639c23b2f0bbad199ede5812cff662ec137440fede0b5096","abstract_canon_sha256":"aa1e22faf58af4ca2e7e9bcb7bbe6fc205917df6ec62ae80dccba0e34af1e526"},"schema_version":"1.0"},"canonical_sha256":"bd937040d2b6464cfbe5b5d3f6be12faf6745d358f6608706d4d9796f42f966f","source":{"kind":"arxiv","id":"2004.14322","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2004.14322","created_at":"2026-07-05T00:59:19Z"},{"alias_kind":"arxiv_version","alias_value":"2004.14322v1","created_at":"2026-07-05T00:59:19Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2004.14322","created_at":"2026-07-05T00:59:19Z"},{"alias_kind":"pith_short_12","alias_value":"XWJXAQGSWZDE","created_at":"2026-07-05T00:59:19Z"},{"alias_kind":"pith_short_16","alias_value":"XWJXAQGSWZDEZ67F","created_at":"2026-07-05T00:59:19Z"},{"alias_kind":"pith_short_8","alias_value":"XWJXAQGS","created_at":"2026-07-05T00:59:19Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2020:XWJXAQGSWZDEZ67FWXJ7NPQS7L","target":"record","payload":{"canonical_record":{"source":{"id":"2004.14322","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2020-04-29T16:45:14Z","cross_cats_sorted":["cs.LG"],"title_canon_sha256":"081fe065979ecc6d639c23b2f0bbad199ede5812cff662ec137440fede0b5096","abstract_canon_sha256":"aa1e22faf58af4ca2e7e9bcb7bbe6fc205917df6ec62ae80dccba0e34af1e526"},"schema_version":"1.0"},"canonical_sha256":"bd937040d2b6464cfbe5b5d3f6be12faf6745d358f6608706d4d9796f42f966f","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T00:59:19.520724Z","signature_b64":"UwyNoH/3LIgfMj0WLBXAKkCc5EgQn4rB/x8xnLc7we7mpiFMgYKAOPNuT33wxpwaitoKtY1r8DFvCAUVnaQTAQ==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"bd937040d2b6464cfbe5b5d3f6be12faf6745d358f6608706d4d9796f42f966f","last_reissued_at":"2026-07-05T00:59:19.520310Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T00:59:19.520310Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2004.14322","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T00:59:19Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"vnV1bOG170nfBPeuJZCNmBUHjzv5H1k+X2TGyc93G/sTZAsrU83MsXwFqazSG7W5RE6EK1J6GLG/i5imdmSyDQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-10T16:00:55.038010Z"},"content_sha256":"1e297706b34fe21357785e3e4306a44301b6a789fdae4be8b22c79272e34a462","schema_version":"1.0","event_id":"sha256:1e297706b34fe21357785e3e4306a44301b6a789fdae4be8b22c79272e34a462"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2020:XWJXAQGSWZDEZ67FWXJ7NPQS7L","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Automated Retrieval of ATT&CK Tactics and Techniques for Cyber Threat Reports","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":["cs.LG"],"primary_cat":"cs.CR","authors_text":"Andreas Peter, Christin Seifert, Marco Caselli, Valentine Legoy","submitted_at":"2020-04-29T16:45:14Z","abstract_excerpt":"Over the last years, threat intelligence sharing has steadily grown, leading cybersecurity professionals to access increasingly larger amounts of heterogeneous data. Among those, cyber attacks' Tactics, Techniques and Procedures (TTPs) have proven to be particularly valuable to characterize threat actors' behaviors and, thus, improve defensive countermeasures. Unfortunately, this information is often hidden within human-readable textual reports and must be extracted manually. In this paper, we evaluate several classification approaches to automatically retrieve TTPs from unstructured text. To "},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2004.14322","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2004.14322/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T00:59:19Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"O3qIeH/qJUO6F2vQFm7oEvf0GOiHcr/LJPkbV/LmODDVz25hgqUsHfXTnB43ZPM+zxRjsqxIUjzKyp5JvMkICA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-10T16:00:55.038897Z"},"content_sha256":"aa3ba8d52abfac85313a2d4f497efdc06d82cbf90cbcbbbdf5f5bccc3eef36b6","schema_version":"1.0","event_id":"sha256:aa3ba8d52abfac85313a2d4f497efdc06d82cbf90cbcbbbdf5f5bccc3eef36b6"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/XWJXAQGSWZDEZ67FWXJ7NPQS7L/bundle.json","state_url":"https://pith.science/pith/XWJXAQGSWZDEZ67FWXJ7NPQS7L/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/XWJXAQGSWZDEZ67FWXJ7NPQS7L/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-10T16:00:55Z","links":{"resolver":"https://pith.science/pith/XWJXAQGSWZDEZ67FWXJ7NPQS7L","bundle":"https://pith.science/pith/XWJXAQGSWZDEZ67FWXJ7NPQS7L/bundle.json","state":"https://pith.science/pith/XWJXAQGSWZDEZ67FWXJ7NPQS7L/state.json","well_known_bundle":"https://pith.science/.well-known/pith/XWJXAQGSWZDEZ67FWXJ7NPQS7L/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2020:XWJXAQGSWZDEZ67FWXJ7NPQS7L","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"aa1e22faf58af4ca2e7e9bcb7bbe6fc205917df6ec62ae80dccba0e34af1e526","cross_cats_sorted":["cs.LG"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2020-04-29T16:45:14Z","title_canon_sha256":"081fe065979ecc6d639c23b2f0bbad199ede5812cff662ec137440fede0b5096"},"schema_version":"1.0","source":{"id":"2004.14322","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2004.14322","created_at":"2026-07-05T00:59:19Z"},{"alias_kind":"arxiv_version","alias_value":"2004.14322v1","created_at":"2026-07-05T00:59:19Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2004.14322","created_at":"2026-07-05T00:59:19Z"},{"alias_kind":"pith_short_12","alias_value":"XWJXAQGSWZDE","created_at":"2026-07-05T00:59:19Z"},{"alias_kind":"pith_short_16","alias_value":"XWJXAQGSWZDEZ67F","created_at":"2026-07-05T00:59:19Z"},{"alias_kind":"pith_short_8","alias_value":"XWJXAQGS","created_at":"2026-07-05T00:59:19Z"}],"graph_snapshots":[{"event_id":"sha256:aa3ba8d52abfac85313a2d4f497efdc06d82cbf90cbcbbbdf5f5bccc3eef36b6","target":"graph","created_at":"2026-07-05T00:59:19Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2004.14322/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Over the last years, threat intelligence sharing has steadily grown, leading cybersecurity professionals to access increasingly larger amounts of heterogeneous data. Among those, cyber attacks' Tactics, Techniques and Procedures (TTPs) have proven to be particularly valuable to characterize threat actors' behaviors and, thus, improve defensive countermeasures. Unfortunately, this information is often hidden within human-readable textual reports and must be extracted manually. In this paper, we evaluate several classification approaches to automatically retrieve TTPs from unstructured text. To ","authors_text":"Andreas Peter, Christin Seifert, Marco Caselli, Valentine Legoy","cross_cats":["cs.LG"],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2020-04-29T16:45:14Z","title":"Automated Retrieval of ATT&CK Tactics and Techniques for Cyber Threat Reports"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2004.14322","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:1e297706b34fe21357785e3e4306a44301b6a789fdae4be8b22c79272e34a462","target":"record","created_at":"2026-07-05T00:59:19Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"aa1e22faf58af4ca2e7e9bcb7bbe6fc205917df6ec62ae80dccba0e34af1e526","cross_cats_sorted":["cs.LG"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2020-04-29T16:45:14Z","title_canon_sha256":"081fe065979ecc6d639c23b2f0bbad199ede5812cff662ec137440fede0b5096"},"schema_version":"1.0","source":{"id":"2004.14322","kind":"arxiv","version":1}},"canonical_sha256":"bd937040d2b6464cfbe5b5d3f6be12faf6745d358f6608706d4d9796f42f966f","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"bd937040d2b6464cfbe5b5d3f6be12faf6745d358f6608706d4d9796f42f966f","first_computed_at":"2026-07-05T00:59:19.520310Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T00:59:19.520310Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"UwyNoH/3LIgfMj0WLBXAKkCc5EgQn4rB/x8xnLc7we7mpiFMgYKAOPNuT33wxpwaitoKtY1r8DFvCAUVnaQTAQ==","signature_status":"signed_v1","signed_at":"2026-07-05T00:59:19.520724Z","signed_message":"canonical_sha256_bytes"},"source_id":"2004.14322","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:1e297706b34fe21357785e3e4306a44301b6a789fdae4be8b22c79272e34a462","sha256:aa3ba8d52abfac85313a2d4f497efdc06d82cbf90cbcbbbdf5f5bccc3eef36b6"],"state_sha256":"ab1290fb549885391aa23c5bd0bbe661fa4686c98663ce385109ff6bdee9e839"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"ZfW4el4NBijGPr4UgQaYdn4UUeJDVNcY5xVC0R/6wGqKLZ/5NdXwPUDbPkQF5XBW3KQcJsxUReDXK3lGRauTDQ==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-10T16:00:55.111153Z","bundle_sha256":"dfe11cdda8c8b22a915825eaaf3904151fa3e501b574a578401d616df1871e56"}}