{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2026:ZDX4EQNLD6VNSTU5MO3KX3XN5F","short_pith_number":"pith:ZDX4EQNL","canonical_record":{"source":{"id":"2608.19938","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2026-08-20T11:54:56Z","cross_cats_sorted":["cs.LG"],"title_canon_sha256":"3e335d75eaf627a613f2586f617e014383f2e0e6b307e45113f438b4d5fb7b39","abstract_canon_sha256":"e5e4b59d1ac9fce7047c1a70602ff2e643584e03a902c7060e99ed2084405520"},"schema_version":"1.0"},"canonical_sha256":"c8efc241ab1faad94e9d63b6abeeede97610ece4ec3219d5eb4c527d86722e04","source":{"kind":"arxiv","id":"2608.19938","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2608.19938","created_at":"2026-08-21T01:20:36Z"},{"alias_kind":"arxiv_version","alias_value":"2608.19938v1","created_at":"2026-08-21T01:20:36Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2608.19938","created_at":"2026-08-21T01:20:36Z"},{"alias_kind":"pith_short_12","alias_value":"ZDX4EQNLD6VN","created_at":"2026-08-21T01:20:36Z"},{"alias_kind":"pith_short_16","alias_value":"ZDX4EQNLD6VNSTU5","created_at":"2026-08-21T01:20:36Z"},{"alias_kind":"pith_short_8","alias_value":"ZDX4EQNL","created_at":"2026-08-21T01:20:36Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2026:ZDX4EQNLD6VNSTU5MO3KX3XN5F","target":"record","payload":{"canonical_record":{"source":{"id":"2608.19938","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2026-08-20T11:54:56Z","cross_cats_sorted":["cs.LG"],"title_canon_sha256":"3e335d75eaf627a613f2586f617e014383f2e0e6b307e45113f438b4d5fb7b39","abstract_canon_sha256":"e5e4b59d1ac9fce7047c1a70602ff2e643584e03a902c7060e99ed2084405520"},"schema_version":"1.0"},"canonical_sha256":"c8efc241ab1faad94e9d63b6abeeede97610ece4ec3219d5eb4c527d86722e04","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-08-21T01:20:36.460058Z","signature_b64":"m3NDXfdsbPjrjZH1SBdXONGxGHNXc19g5HZ57m+pEovbZ2/yXoFK8t7rRBgreYEuw8AZ4cPb+DwtreNU8TXuBw==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"c8efc241ab1faad94e9d63b6abeeede97610ece4ec3219d5eb4c527d86722e04","last_reissued_at":"2026-08-21T01:20:36.458239Z","signature_status":"signed_v1","first_computed_at":"2026-08-21T01:20:36.458239Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2608.19938","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-08-21T01:20:36Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"JzwONiAeeb8YOcVHfWDRQIkM0YCxWEVWULbX5hw3ZdLVeLeO8UfipKo/6EMhNDv221ru86Jv2Cc4KZQidvokAg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-23T03:24:04.500844Z"},"content_sha256":"04480c7405b09df37cb2cae10d0b9bb08117a10a5c84be75286f456451c042e3","schema_version":"1.0","event_id":"sha256:04480c7405b09df37cb2cae10d0b9bb08117a10a5c84be75286f456451c042e3"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2026:ZDX4EQNLD6VNSTU5MO3KX3XN5F","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"From Noise to Signal: Improving Security Log Anomaly Detection Using LLMs with Endpoint-Specific Logs","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":["cs.LG"],"primary_cat":"cs.CR","authors_text":"Christopher Henshaw, Gour Karmakar","submitted_at":"2026-08-20T11:54:56Z","abstract_excerpt":"Existing approaches to anomalous behaviour log detection, such as Wazuh rely primarily on predefined detection rules, while statistical anomaly detection approaches such as OpenSearch identify deviations from previously observed behavioural patterns. Recent research has investigated LLMs for log anomaly detection because of their ability to interpret semantic and contextual information. However, LLM-based approaches can be affected by prompt construction, noisy log data, and reliance on generic datasets that may lack endpoint-specific authentication behaviours. To address these limitations, th"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2608.19938","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2608.19938/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-08-21T01:20:36Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"H0m/eDx+7Ji50jVmq15HHjA2o3j52ggN5bmUSox4LlanKR03cjAvKH4wMlzTNQevMUc9KMT0OF4Pdn3+2ePCCQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-23T03:24:04.501344Z"},"content_sha256":"d692acf9bcd83d8a51831bdcc0e9f47d1d667473208362950654b8d87f3e1c72","schema_version":"1.0","event_id":"sha256:d692acf9bcd83d8a51831bdcc0e9f47d1d667473208362950654b8d87f3e1c72"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/ZDX4EQNLD6VNSTU5MO3KX3XN5F/bundle.json","state_url":"https://pith.science/pith/ZDX4EQNLD6VNSTU5MO3KX3XN5F/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/ZDX4EQNLD6VNSTU5MO3KX3XN5F/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-23T03:24:04Z","links":{"resolver":"https://pith.science/pith/ZDX4EQNLD6VNSTU5MO3KX3XN5F","bundle":"https://pith.science/pith/ZDX4EQNLD6VNSTU5MO3KX3XN5F/bundle.json","state":"https://pith.science/pith/ZDX4EQNLD6VNSTU5MO3KX3XN5F/state.json","well_known_bundle":"https://pith.science/.well-known/pith/ZDX4EQNLD6VNSTU5MO3KX3XN5F/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2026:ZDX4EQNLD6VNSTU5MO3KX3XN5F","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"e5e4b59d1ac9fce7047c1a70602ff2e643584e03a902c7060e99ed2084405520","cross_cats_sorted":["cs.LG"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2026-08-20T11:54:56Z","title_canon_sha256":"3e335d75eaf627a613f2586f617e014383f2e0e6b307e45113f438b4d5fb7b39"},"schema_version":"1.0","source":{"id":"2608.19938","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2608.19938","created_at":"2026-08-21T01:20:36Z"},{"alias_kind":"arxiv_version","alias_value":"2608.19938v1","created_at":"2026-08-21T01:20:36Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2608.19938","created_at":"2026-08-21T01:20:36Z"},{"alias_kind":"pith_short_12","alias_value":"ZDX4EQNLD6VN","created_at":"2026-08-21T01:20:36Z"},{"alias_kind":"pith_short_16","alias_value":"ZDX4EQNLD6VNSTU5","created_at":"2026-08-21T01:20:36Z"},{"alias_kind":"pith_short_8","alias_value":"ZDX4EQNL","created_at":"2026-08-21T01:20:36Z"}],"graph_snapshots":[{"event_id":"sha256:d692acf9bcd83d8a51831bdcc0e9f47d1d667473208362950654b8d87f3e1c72","target":"graph","created_at":"2026-08-21T01:20:36Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2608.19938/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Existing approaches to anomalous behaviour log detection, such as Wazuh rely primarily on predefined detection rules, while statistical anomaly detection approaches such as OpenSearch identify deviations from previously observed behavioural patterns. Recent research has investigated LLMs for log anomaly detection because of their ability to interpret semantic and contextual information. However, LLM-based approaches can be affected by prompt construction, noisy log data, and reliance on generic datasets that may lack endpoint-specific authentication behaviours. To address these limitations, th","authors_text":"Christopher Henshaw, Gour Karmakar","cross_cats":["cs.LG"],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2026-08-20T11:54:56Z","title":"From Noise to Signal: Improving Security Log Anomaly Detection Using LLMs with Endpoint-Specific Logs"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2608.19938","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:04480c7405b09df37cb2cae10d0b9bb08117a10a5c84be75286f456451c042e3","target":"record","created_at":"2026-08-21T01:20:36Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"e5e4b59d1ac9fce7047c1a70602ff2e643584e03a902c7060e99ed2084405520","cross_cats_sorted":["cs.LG"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2026-08-20T11:54:56Z","title_canon_sha256":"3e335d75eaf627a613f2586f617e014383f2e0e6b307e45113f438b4d5fb7b39"},"schema_version":"1.0","source":{"id":"2608.19938","kind":"arxiv","version":1}},"canonical_sha256":"c8efc241ab1faad94e9d63b6abeeede97610ece4ec3219d5eb4c527d86722e04","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"c8efc241ab1faad94e9d63b6abeeede97610ece4ec3219d5eb4c527d86722e04","first_computed_at":"2026-08-21T01:20:36.458239Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-08-21T01:20:36.458239Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"m3NDXfdsbPjrjZH1SBdXONGxGHNXc19g5HZ57m+pEovbZ2/yXoFK8t7rRBgreYEuw8AZ4cPb+DwtreNU8TXuBw==","signature_status":"signed_v1","signed_at":"2026-08-21T01:20:36.460058Z","signed_message":"canonical_sha256_bytes"},"source_id":"2608.19938","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:04480c7405b09df37cb2cae10d0b9bb08117a10a5c84be75286f456451c042e3","sha256:d692acf9bcd83d8a51831bdcc0e9f47d1d667473208362950654b8d87f3e1c72"],"state_sha256":"35da2a09017f889b253509f7ee9cc7beecd005572f1851fc79a2bfc7dbf115ef"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"r/0RZmc6OuBuIbJDz9g646O4z6HtXhosY4QzW5N1KMQD+zNqPP+FvpdY5A000JNi6Tm9BauZ1dbayaF519FvBA==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-23T03:24:04.505078Z","bundle_sha256":"3fa823bb0c75437841fd6785d91559b032e529362f90bbeb3f3f831134e4ac69"}}