{"as_of":"2026-08-09T03:19:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:53042e7a7c4d7d93550a0ee2a1aef50adcc02b8113e4ba5cc0602d70c364235c","coverage":[{"denominator":0,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":0,"source":"paper_references, paper_reference_links","source_observed_at":null,"state":"measured"},{"denominator":12,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":12,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-08T06:32:00.761636+00:00","state":"measured"},{"denominator":12,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":12,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-07T10:36:24.529868Z","state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":0,"source":"arxiv_reference","source_observed_at":"2026-07-04T00:59:19.781532Z","state":"measured"}],"external_citation_measurements":[],"inbound":[{"citation":{"cited_paper":{"arxiv_id":"2001.01525","last_updated":"2020-01-14T12:26:28Z","snapshot_observed_at":"2026-07-06T08:48:42.031197Z","submitted_at":"2020-01-06T12:42:51Z","title":"UNICORN: Runtime Provenance-Based Detector for Advanced Persistent Threats","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2001.01525","snapshot_observed_at":"2026-08-07T10:36:24.529868Z","title":"Unicorn: Runtime provenance-based detector for advanced persistent threats,","venue":null,"work_id":null,"year":2001},"citing_paper":{"arxiv_id":"2506.05001","last_updated":"2025-06-05T13:10:58Z","snapshot_observed_at":"2026-08-07T10:26:23.983059Z","submitted_at":"2025-06-05T13:10:58Z","title":"Attack Effect Model based Malicious Behavior Detection","version":1},"reference_index":19,"source":"pdf_text","source_observed_at":"2026-08-07T10:36:24.529868Z"},"links":{"cited_paper":"/paper/2001.01525","citing_paper":"/paper/2506.05001"},"observation_digest":"sha256:e1e199553ba0e56f53ea4c131e352a01ff24ad515da956759ac9adbd3e008c98","observation_id":"edd38a61-420c-4184-8aa8-98a7399bf680","resolution":{"observed_at":"2026-08-07T10:36:24.529868Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2001.01525","last_updated":"2020-01-14T12:26:28Z","snapshot_observed_at":"2026-07-06T08:48:42.031197Z","submitted_at":"2020-01-06T12:42:51Z","title":"UNICORN: Runtime Provenance-Based Detector for Advanced Persistent Threats","version":2},"cited_work":{"arxiv_id":"2001.01525","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2001.01525","snapshot_observed_at":"2026-07-04T00:59:19.781532Z","title":"Mickens, and Margo I","venue":null,"work_id":"7938ca23-5550-419f-860d-5d4f814f46e5","year":2001},"citing_paper":{"arxiv_id":"2506.06226","last_updated":"2026-04-20T11:25:09Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2025-06-06T16:41:17Z","title":"No Data? No Problem: Synthesizing Security Graphs for Better Intrusion Detection","version":3},"reference_index":21,"source":"pdf_text","source_observed_at":"2026-05-19T10:38:03.311357Z"},"links":{"cited_paper":"/paper/2001.01525","citing_paper":"/paper/2506.06226"},"observation_digest":"sha256:69a52521ec8d345947af4e0928627d0e2a1319a1bbdba0034f94b9f9ef22788f","observation_id":"4060b7be-2d21-41d2-84da-10ae75ec5c64","resolution":{"observed_at":"2026-05-19T10:42:15.299355Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2001.01525","last_updated":"2020-01-14T12:26:28Z","snapshot_observed_at":"2026-07-06T08:48:42.031197Z","submitted_at":"2020-01-06T12:42:51Z","title":"UNICORN: Runtime Provenance-Based Detector for Advanced Persistent Threats","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2001.01525","snapshot_observed_at":"2026-08-06T17:29:56.676292Z","title":"Unicorn: Runtime provenance-based detector for advanced persistent threats,","venue":null,"work_id":null,"year":2001},"citing_paper":{"arxiv_id":"2507.10873","last_updated":"2025-07-15T00:24:53Z","snapshot_observed_at":"2026-08-09T03:04:47.816610Z","submitted_at":"2025-07-15T00:24:53Z","title":"From Alerts to Intelligence: A Novel LLM-Aided Framework for Host-based Intrusion Detection","version":1},"reference_index":24,"source":"pdf_text","source_observed_at":"2026-08-06T17:29:56.676292Z"},"links":{"cited_paper":"/paper/2001.01525","citing_paper":"/paper/2507.10873"},"observation_digest":"sha256:5a0c3e98b26a61e00817c0441c1da22a58ba22144ede7b97a527432e47541658","observation_id":"74a3cc14-fef0-4b38-964a-d0098fadd308","resolution":{"observed_at":"2026-08-06T17:29:56.676292Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2001.01525","last_updated":"2020-01-14T12:26:28Z","snapshot_observed_at":"2026-07-06T08:48:42.031197Z","submitted_at":"2020-01-06T12:42:51Z","title":"UNICORN: Runtime Provenance-Based Detector for Advanced Persistent Threats","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2001.01525","snapshot_observed_at":"2026-08-05T12:48:07.322575Z","title":"Unicorn: Runtime provenance-based detector for advanced persistent threats","venue":null,"work_id":null,"year":2001},"citing_paper":{"arxiv_id":"2509.01271","last_updated":"2025-09-01T08:57:01Z","snapshot_observed_at":"2026-08-05T12:48:06.432672Z","submitted_at":"2025-09-01T08:57:01Z","title":"An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models","version":1},"reference_index":29,"source":"pdf_text","source_observed_at":"2026-08-05T12:48:07.322575Z"},"links":{"cited_paper":"/paper/2001.01525","citing_paper":"/paper/2509.01271"},"observation_digest":"sha256:fb51c89754c4abfa125ef50c1b721ccdbac73524a3e9948d56db07a591fce918","observation_id":"8601ab0e-4514-46d9-a344-f5b8501e39d3","resolution":{"observed_at":"2026-08-05T12:48:07.322575Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2001.01525","last_updated":"2020-01-14T12:26:28Z","snapshot_observed_at":"2026-07-06T08:48:42.031197Z","submitted_at":"2020-01-06T12:42:51Z","title":"UNICORN: Runtime Provenance-Based Detector for Advanced Persistent Threats","version":2},"cited_work":{"arxiv_id":"2001.01525","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2001.01525","snapshot_observed_at":"2026-07-04T00:59:19.781532Z","title":"Mickens, and Margo I","venue":null,"work_id":"7938ca23-5550-419f-860d-5d4f814f46e5","year":2001},"citing_paper":{"arxiv_id":"2512.12078","last_updated":"2026-05-06T22:08:35Z","snapshot_observed_at":"2026-07-06T22:38:54.914862Z","submitted_at":"2025-12-12T22:53:52Z","title":"The Procedural Semantics Gap in Structured CTI: A Measurement-Driven STIX Analysis for APT Emulation","version":3},"reference_index":18,"source":"pdf_text","source_observed_at":"2026-05-16T22:24:38.056657Z"},"links":{"cited_paper":"/paper/2001.01525","citing_paper":"/paper/2512.12078"},"observation_digest":"sha256:36a1e996215897035d95d3206bf88e442fd421095d11b08db322ce1ebb72b457","observation_id":"84dc3c01-1093-4721-9796-18519bb88836","resolution":{"observed_at":"2026-05-16T22:28:37.200734Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2001.01525","last_updated":"2020-01-14T12:26:28Z","snapshot_observed_at":"2026-07-06T08:48:42.031197Z","submitted_at":"2020-01-06T12:42:51Z","title":"UNICORN: Runtime Provenance-Based Detector for Advanced Persistent Threats","version":2},"cited_work":{"arxiv_id":"2001.01525","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2001.01525","snapshot_observed_at":"2026-07-04T00:59:19.781532Z","title":"Mickens, and Margo I","venue":null,"work_id":"7938ca23-5550-419f-860d-5d4f814f46e5","year":2001},"citing_paper":{"arxiv_id":"2605.07812","last_updated":"2026-05-08T14:45:36Z","snapshot_observed_at":"2026-07-29T13:50:37.849897Z","submitted_at":"2026-05-08T14:45:36Z","title":"GRASP -- Graph-Based Anomaly Detection Through Self-Supervised Classification","version":1},"reference_index":26,"source":"pdf_text","source_observed_at":"2026-05-11T03:04:10.145573Z"},"links":{"cited_paper":"/paper/2001.01525","citing_paper":"/paper/2605.07812"},"observation_digest":"sha256:a1672470e147bc248ca39243c688c74be4ca4af71bf8607757fe92106611a0be","observation_id":"24618e1e-0f9e-4588-9eda-d4876be45f3e","resolution":{"observed_at":"2026-05-11T03:05:53.284663Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2001.01525","last_updated":"2020-01-14T12:26:28Z","snapshot_observed_at":"2026-07-06T08:48:42.031197Z","submitted_at":"2020-01-06T12:42:51Z","title":"UNICORN: Runtime Provenance-Based Detector for Advanced Persistent Threats","version":2},"cited_work":{"arxiv_id":"2001.01525","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2001.01525","snapshot_observed_at":"2026-07-04T00:59:19.781532Z","title":"Mickens, and Margo I","venue":null,"work_id":"7938ca23-5550-419f-860d-5d4f814f46e5","year":2001},"citing_paper":{"arxiv_id":"2605.11619","last_updated":"2026-05-12T06:46:40Z","snapshot_observed_at":"2026-08-08T10:29:38.769952Z","submitted_at":"2026-05-12T06:46:40Z","title":"PhishSigma++: Malicious Email Detection with Typed Entity Relations","version":1},"reference_index":30,"source":"pdf_text","source_observed_at":"2026-05-13T01:23:19.511253Z"},"links":{"cited_paper":"/paper/2001.01525","citing_paper":"/paper/2605.11619"},"observation_digest":"sha256:a5f5d4fac48f41a52f3fbfafdabca09a8d7c77ecd7e9cfa019a03c75fb48d38d","observation_id":"6bfd83f7-b3fb-49e3-bba6-5a186fd1b41e","resolution":{"observed_at":"2026-05-13T01:27:02.609321Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2001.01525","last_updated":"2020-01-14T12:26:28Z","snapshot_observed_at":"2026-07-06T08:48:42.031197Z","submitted_at":"2020-01-06T12:42:51Z","title":"UNICORN: Runtime Provenance-Based Detector for Advanced Persistent Threats","version":2},"cited_work":{"arxiv_id":"2001.01525","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2001.01525","snapshot_observed_at":"2026-07-04T00:59:19.781532Z","title":"Mickens, and Margo I","venue":null,"work_id":"7938ca23-5550-419f-860d-5d4f814f46e5","year":2001},"citing_paper":{"arxiv_id":"2605.20896","last_updated":"2026-05-22T09:00:59Z","snapshot_observed_at":"2026-08-06T05:50:17.651876Z","submitted_at":"2026-05-20T08:37:06Z","title":"GenAI-Driven Threat Detection with Microsoft Security Copilot","version":1},"reference_index":18,"source":"pdf_text","source_observed_at":"2026-05-21T04:29:26.214649Z"},"links":{"cited_paper":"/paper/2001.01525","citing_paper":"/paper/2605.20896"},"observation_digest":"sha256:6e92b8627bdab4dd1ebc43e15d9f38482e8094e5e4bb391cd4f08d94643535a8","observation_id":"33583dff-4a4c-4a1f-a7f6-b45906539a4b","resolution":{"observed_at":"2026-05-21T04:29:34.242906Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2001.01525","last_updated":"2020-01-14T12:26:28Z","snapshot_observed_at":"2026-07-06T08:48:42.031197Z","submitted_at":"2020-01-06T12:42:51Z","title":"UNICORN: Runtime Provenance-Based Detector for Advanced Persistent Threats","version":2},"cited_work":{"arxiv_id":"2001.01525","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2001.01525","snapshot_observed_at":"2026-07-04T00:59:19.781532Z","title":"Mickens, and Margo I","venue":null,"work_id":"7938ca23-5550-419f-860d-5d4f814f46e5","year":2001},"citing_paper":{"arxiv_id":"2605.20896","last_updated":"2026-05-22T09:00:59Z","snapshot_observed_at":"2026-08-06T05:50:17.651876Z","submitted_at":"2026-05-20T08:37:06Z","title":"GenAI-Driven Threat Detection with Microsoft Security Copilot","version":2},"reference_index":18,"source":"pdf_text","source_observed_at":"2026-05-25T06:30:29.089349Z"},"links":{"cited_paper":"/paper/2001.01525","citing_paper":"/paper/2605.20896"},"observation_digest":"sha256:13969d41d6bd8675dde7e011deec32703591a37af8abaa64a3849971f9026367","observation_id":"510b4dd1-5ec9-4cea-bd29-ff356f11a1e4","resolution":{"observed_at":"2026-05-25T06:35:25.278129Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2001.01525","last_updated":"2020-01-14T12:26:28Z","snapshot_observed_at":"2026-07-06T08:48:42.031197Z","submitted_at":"2020-01-06T12:42:51Z","title":"UNICORN: Runtime Provenance-Based Detector for Advanced Persistent Threats","version":2},"cited_work":{"arxiv_id":"2001.01525","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2001.01525","snapshot_observed_at":"2026-07-04T00:59:19.781532Z","title":"Mickens, and Margo I","venue":null,"work_id":"7938ca23-5550-419f-860d-5d4f814f46e5","year":2001},"citing_paper":{"arxiv_id":"2605.29269","last_updated":"2026-05-28T02:38:12Z","snapshot_observed_at":"2026-08-02T07:29:42.622849Z","submitted_at":"2026-05-28T02:38:12Z","title":"HunterAgent: Neuro-Symbolic Attack Trace Reconstruction under Anti-Forensics","version":1},"reference_index":28,"source":"pdf_text","source_observed_at":"2026-06-29T07:05:10.560865Z"},"links":{"cited_paper":"/paper/2001.01525","citing_paper":"/paper/2605.29269"},"observation_digest":"sha256:e10a4201c8e73e260b64e06c140a027a7c0d3cf6e0a47f9b024f128420fba138","observation_id":"cf306283-de80-4687-8f8f-39d597e14cce","resolution":{"observed_at":"2026-06-29T07:13:17.137260Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2001.01525","last_updated":"2020-01-14T12:26:28Z","snapshot_observed_at":"2026-07-06T08:48:42.031197Z","submitted_at":"2020-01-06T12:42:51Z","title":"UNICORN: Runtime Provenance-Based Detector for Advanced Persistent Threats","version":2},"cited_work":{"arxiv_id":"2001.01525","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2001.01525","snapshot_observed_at":"2026-07-04T00:59:19.781532Z","title":"Mickens, and Margo I","venue":null,"work_id":"7938ca23-5550-419f-860d-5d4f814f46e5","year":2001},"citing_paper":{"arxiv_id":"2606.18651","last_updated":"2026-07-29T12:04:49Z","snapshot_observed_at":"2026-08-08T04:50:30.100293Z","submitted_at":"2026-06-17T03:35:43Z","title":"TGCM: Topic-Guided Consistency Modeling for One-Step Disentanglement of Interleaved APT Technique Sequences","version":1},"reference_index":27,"source":"pdf_text","source_observed_at":"2026-06-26T20:50:41.867631Z"},"links":{"cited_paper":"/paper/2001.01525","citing_paper":"/paper/2606.18651"},"observation_digest":"sha256:95f58d0c0a72ed7d6ddccc32b543e8fc83311e8dbd6025896a13309ba5d5e90d","observation_id":"659526d4-ea54-4e23-9791-ed5fe884e4f5","resolution":{"observed_at":"2026-07-04T00:59:19.783965Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2001.01525","last_updated":"2020-01-14T12:26:28Z","snapshot_observed_at":"2026-07-06T08:48:42.031197Z","submitted_at":"2020-01-06T12:42:51Z","title":"UNICORN: Runtime Provenance-Based Detector for Advanced Persistent Threats","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2001.01525","snapshot_observed_at":"2026-08-02T11:04:28.488701Z","title":"Unicorn: Runtime provenance-based detector for advanced persistent threats","venue":null,"work_id":null,"year":2001},"citing_paper":{"arxiv_id":"2606.18651","last_updated":"2026-07-29T12:04:49Z","snapshot_observed_at":"2026-08-08T04:50:30.100293Z","submitted_at":"2026-06-17T03:35:43Z","title":"TGCM: Topic-Guided Consistency Modeling for One-Step Disentanglement of Interleaved APT Technique Sequences","version":2},"reference_index":27,"source":"pdf_text","source_observed_at":"2026-08-02T11:04:28.488701Z"},"links":{"cited_paper":"/paper/2001.01525","citing_paper":"/paper/2606.18651"},"observation_digest":"sha256:82b3e8b4c8ecdf5de815160801ccecdeebe14a4492b54e875040c9f10b1fe57a","observation_id":"18b1bb7e-915e-4662-bd94-e5e51db2cc77","resolution":{"observed_at":"2026-08-02T11:04:28.488701Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}}],"links":{"evidence":"/evidence","html":"/paper/2001.01525/citation-record","integrity":"/paper/2001.01525/integrity","json":"/paper/2001.01525/citation-record.json","paper":"/paper/2001.01525"},"outbound":[],"paper":{"arxiv_id":"2001.01525","last_updated":"2020-01-14T12:26:28Z","latest_version":2,"primary_category":"cs.CR","snapshot_observed_at":"2026-07-06T08:48:42.031197Z","submitted_at":"2020-01-06T12:42:51Z","title":"UNICORN: Runtime Provenance-Based Detector for Advanced Persistent Threats"},"reference_resolution":{"displayed":0,"state_counts":{"malformed_identifier":0,"metadata_mismatch":0,"parse_uncertain":0,"unresolved":0,"verified_exact":0,"verified_fuzzy":0},"total_outbound_references":0},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"thesis":"As of 9 August 2026, this Paper Citation Record lists 0 of 0 outbound references and 12 inbound Pith citation observations for arXiv:2001.01525."}