{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2026:YRBDVRRQ6ATLXGBXWY3HIEBWU7","short_pith_number":"pith:YRBDVRRQ","canonical_record":{"source":{"id":"2607.20832","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.LG","submitted_at":"2026-07-23T01:38:25Z","cross_cats_sorted":["cs.AI","cs.CL","cs.CR"],"title_canon_sha256":"34e791253f47ecff64e497946056fb2ae9e3d7381463f8a9ff01ae6ca6ef4d5a","abstract_canon_sha256":"cfa84377474804b7b3c5a9369a8bc11ee7b6853a3710b6879b4fa76bce37a28c"},"schema_version":"1.0"},"canonical_sha256":"c4423ac630f026bb9837b636741036a7e1743129ef48bd2622131144e449ec1a","source":{"kind":"arxiv","id":"2607.20832","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2607.20832","created_at":"2026-07-24T00:23:37Z"},{"alias_kind":"arxiv_version","alias_value":"2607.20832v1","created_at":"2026-07-24T00:23:37Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2607.20832","created_at":"2026-07-24T00:23:37Z"},{"alias_kind":"pith_short_12","alias_value":"YRBDVRRQ6ATL","created_at":"2026-07-24T00:23:37Z"},{"alias_kind":"pith_short_16","alias_value":"YRBDVRRQ6ATLXGBX","created_at":"2026-07-24T00:23:37Z"},{"alias_kind":"pith_short_8","alias_value":"YRBDVRRQ","created_at":"2026-07-24T00:23:37Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2026:YRBDVRRQ6ATLXGBXWY3HIEBWU7","target":"record","payload":{"canonical_record":{"source":{"id":"2607.20832","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.LG","submitted_at":"2026-07-23T01:38:25Z","cross_cats_sorted":["cs.AI","cs.CL","cs.CR"],"title_canon_sha256":"34e791253f47ecff64e497946056fb2ae9e3d7381463f8a9ff01ae6ca6ef4d5a","abstract_canon_sha256":"cfa84377474804b7b3c5a9369a8bc11ee7b6853a3710b6879b4fa76bce37a28c"},"schema_version":"1.0"},"canonical_sha256":"c4423ac630f026bb9837b636741036a7e1743129ef48bd2622131144e449ec1a","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-24T00:23:37.026749Z","signature_b64":"LRQpGAS/FQrcQ/eg8pgQnrMrIsMqBTu1d1jFMPv4f6Zc8bhyTHzN8RmpgXocJN+IJtWhtLE7/7O0rgrqbml3Cg==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"c4423ac630f026bb9837b636741036a7e1743129ef48bd2622131144e449ec1a","last_reissued_at":"2026-07-24T00:23:37.025877Z","signature_status":"signed_v1","first_computed_at":"2026-07-24T00:23:37.025877Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2607.20832","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-24T00:23:37Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"T6qbarJNaiefcLdWyYzk0tbhGIpkwsMvbne+fIhD6F9Ub9RMmcatVjOuHaPIxHXs0lQbWHFjgkPR9PWWzLa1CA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-06T16:37:21.816635Z"},"content_sha256":"cc78e0e5100bacc3c974024b67886681ee92dc400cd78f5914d07b7f2df4c0fe","schema_version":"1.0","event_id":"sha256:cc78e0e5100bacc3c974024b67886681ee92dc400cd78f5914d07b7f2df4c0fe"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2026:YRBDVRRQ6ATLXGBXWY3HIEBWU7","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Beyond Heavy Log Curation: Perplexity-Based APT Detection via Unsupervised, Context-Augmented Language Models","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":["cs.AI","cs.CL","cs.CR"],"primary_cat":"cs.LG","authors_text":"Jing Liu, Kei Suzuki, Shoya Otsu, Toshiaki Koike-Akino, Ye Wang","submitted_at":"2026-07-23T01:38:25Z","abstract_excerpt":"Advanced Persistent Threats (APTs) remain difficult to detect because only a small fraction of events in large-scale logs are attack-related, and investigation is expensive and hard to scale. Prior machine-learning approaches can reduce analyst workload, but they often rely on heavily curated training data and sophisticated preprocessing pipelines. Building and maintaining such pipelines require substantial domain expertise and engineering cost. Motivated by insights from a study of a strong APT detection baseline, we propose CAPTAIN (Context-Augmented Perplexity-based Threat Activity log dete"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2607.20832","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2607.20832/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-24T00:23:37Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"Cleh4uHO1ZaA7R3OioeYnCJMe9vuXBPRrfNwFgLo4f6GE2lf2WHeWTsbO0zoxkmJ4UPKWlwktrSzmNGwuCovBw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-06T16:37:21.817568Z"},"content_sha256":"6e251bc89bc911dc7815a887f5ac67c6615849aee556fd1ce57afde5f9843f02","schema_version":"1.0","event_id":"sha256:6e251bc89bc911dc7815a887f5ac67c6615849aee556fd1ce57afde5f9843f02"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/YRBDVRRQ6ATLXGBXWY3HIEBWU7/bundle.json","state_url":"https://pith.science/pith/YRBDVRRQ6ATLXGBXWY3HIEBWU7/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/YRBDVRRQ6ATLXGBXWY3HIEBWU7/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-06T16:37:21Z","links":{"resolver":"https://pith.science/pith/YRBDVRRQ6ATLXGBXWY3HIEBWU7","bundle":"https://pith.science/pith/YRBDVRRQ6ATLXGBXWY3HIEBWU7/bundle.json","state":"https://pith.science/pith/YRBDVRRQ6ATLXGBXWY3HIEBWU7/state.json","well_known_bundle":"https://pith.science/.well-known/pith/YRBDVRRQ6ATLXGBXWY3HIEBWU7/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2026:YRBDVRRQ6ATLXGBXWY3HIEBWU7","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"cfa84377474804b7b3c5a9369a8bc11ee7b6853a3710b6879b4fa76bce37a28c","cross_cats_sorted":["cs.AI","cs.CL","cs.CR"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.LG","submitted_at":"2026-07-23T01:38:25Z","title_canon_sha256":"34e791253f47ecff64e497946056fb2ae9e3d7381463f8a9ff01ae6ca6ef4d5a"},"schema_version":"1.0","source":{"id":"2607.20832","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2607.20832","created_at":"2026-07-24T00:23:37Z"},{"alias_kind":"arxiv_version","alias_value":"2607.20832v1","created_at":"2026-07-24T00:23:37Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2607.20832","created_at":"2026-07-24T00:23:37Z"},{"alias_kind":"pith_short_12","alias_value":"YRBDVRRQ6ATL","created_at":"2026-07-24T00:23:37Z"},{"alias_kind":"pith_short_16","alias_value":"YRBDVRRQ6ATLXGBX","created_at":"2026-07-24T00:23:37Z"},{"alias_kind":"pith_short_8","alias_value":"YRBDVRRQ","created_at":"2026-07-24T00:23:37Z"}],"graph_snapshots":[{"event_id":"sha256:6e251bc89bc911dc7815a887f5ac67c6615849aee556fd1ce57afde5f9843f02","target":"graph","created_at":"2026-07-24T00:23:37Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2607.20832/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Advanced Persistent Threats (APTs) remain difficult to detect because only a small fraction of events in large-scale logs are attack-related, and investigation is expensive and hard to scale. Prior machine-learning approaches can reduce analyst workload, but they often rely on heavily curated training data and sophisticated preprocessing pipelines. Building and maintaining such pipelines require substantial domain expertise and engineering cost. Motivated by insights from a study of a strong APT detection baseline, we propose CAPTAIN (Context-Augmented Perplexity-based Threat Activity log dete","authors_text":"Jing Liu, Kei Suzuki, Shoya Otsu, Toshiaki Koike-Akino, Ye Wang","cross_cats":["cs.AI","cs.CL","cs.CR"],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.LG","submitted_at":"2026-07-23T01:38:25Z","title":"Beyond Heavy Log Curation: Perplexity-Based APT Detection via Unsupervised, Context-Augmented Language Models"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2607.20832","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:cc78e0e5100bacc3c974024b67886681ee92dc400cd78f5914d07b7f2df4c0fe","target":"record","created_at":"2026-07-24T00:23:37Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"cfa84377474804b7b3c5a9369a8bc11ee7b6853a3710b6879b4fa76bce37a28c","cross_cats_sorted":["cs.AI","cs.CL","cs.CR"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.LG","submitted_at":"2026-07-23T01:38:25Z","title_canon_sha256":"34e791253f47ecff64e497946056fb2ae9e3d7381463f8a9ff01ae6ca6ef4d5a"},"schema_version":"1.0","source":{"id":"2607.20832","kind":"arxiv","version":1}},"canonical_sha256":"c4423ac630f026bb9837b636741036a7e1743129ef48bd2622131144e449ec1a","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"c4423ac630f026bb9837b636741036a7e1743129ef48bd2622131144e449ec1a","first_computed_at":"2026-07-24T00:23:37.025877Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-24T00:23:37.025877Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"LRQpGAS/FQrcQ/eg8pgQnrMrIsMqBTu1d1jFMPv4f6Zc8bhyTHzN8RmpgXocJN+IJtWhtLE7/7O0rgrqbml3Cg==","signature_status":"signed_v1","signed_at":"2026-07-24T00:23:37.026749Z","signed_message":"canonical_sha256_bytes"},"source_id":"2607.20832","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:cc78e0e5100bacc3c974024b67886681ee92dc400cd78f5914d07b7f2df4c0fe","sha256:6e251bc89bc911dc7815a887f5ac67c6615849aee556fd1ce57afde5f9843f02"],"state_sha256":"56202597f0f182b4912dba448cfe54d553223d3c52e0c9cb1b9afdeb5af32f3b"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"+TejefPDdpsdmi67DDx4p8fugVh70raj/qG1GhXF+tQRTTzZD02bKbUxbvpKLldYEWOsvZd8tg2TWbqYJyvxCw==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-06T16:37:21.825649Z","bundle_sha256":"2fe4cec244c1b6482dd6c3311dfe69204519713bf0e2934dc71ea0e1a202cf3f"}}