{"as_of":"2026-08-10T04:39:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:03d12b04c5e01dab2b5f7683b6d54b1059b1fe2afd1fd23e722658d004cfd1bd","coverage":[{"denominator":60,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":60,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-06T00:12:45.339878Z","state":"measured"},{"denominator":60,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":60,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-09T06:31:02.800959+00:00","state":"measured"},{"denominator":0,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":0,"source":"paper_references, paper_reference_links","source_observed_at":null,"state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":0,"source":"cited_works","source_observed_at":null,"state":"measured"}],"external_citation_measurements":[],"inbound":[],"links":{"evidence":"/evidence","html":"/paper/2608.01454/citation-record","integrity":"/paper/2608.01454/integrity","json":"/paper/2608.01454/citation-record.json","paper":"/paper/2608.01454"},"outbound":[{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:12:52.614089Z","title":"Provenance-based in- trusion detection systems: A survey,","venue":null,"work_id":"fe3a3e86-f68d-4abf-b76b-5d64e079e5d4","year":2022},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":1,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:41.160900Z"},"links":{"citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:13d1ea0ce9c2b9503d3982bd8db3d34a6c2f3aaec315bbee6e203ccd200c941e","observation_id":"1b2534e7-e672-48d6-89e0-39727d96d701","resolution":{"observed_at":"2026-08-06T00:12:52.691610Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:12:52.427097Z","title":"Are we there yet? an industrial viewpoint on provenance-based endpoint detection and response tools,","venue":null,"work_id":"25226f12-5268-441c-a860-ece9a5e79ef6","year":2023},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":2,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:41.252207Z"},"links":{"citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:003714f9c7d3d21d5fed93b8438f204eb67076e0465980317d7fc7a76f5e0a48","observation_id":"98c97d73-1d67-43dd-b241-c19105a18bb5","resolution":{"observed_at":"2026-08-06T00:12:52.490430Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:12:52.237803Z","title":"SLEUTH: Real-time attack scenario reconstruction from COTS audit data,","venue":null,"work_id":"1fe2c4b1-292a-405c-9a7b-c72441a8df97","year":2017},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":3,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:41.315830Z"},"links":{"citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:82065c5a3a49232f609b845fa551a98b9204eb1d43276c9be925760a33c6c1f1","observation_id":"014bc13f-f0b5-4875-9526-f2dd8b852303","resolution":{"observed_at":"2026-08-06T00:12:52.345366Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:12:52.094625Z","title":"HOLMES: Real-time APT detection through correlation of suspicious information flows,","venue":null,"work_id":"268d5594-45f0-43d5-b4df-79b59a4ab234","year":2019},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":4,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:41.358735Z"},"links":{"citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:1714ce86501d4c2cf2f6b153a2f89807a4b853a84c7aff22ddd13656dd3a4e32","observation_id":"081d34ce-49d4-4d64-8413-551b679cffc5","resolution":{"observed_at":"2026-08-06T00:12:52.152844Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:12:51.925083Z","title":"Graph neural networks for intrusion detection: A survey,","venue":null,"work_id":"9ca8812d-4355-436b-bab8-e82d5a859292","year":2023},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":5,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:41.460075Z"},"links":{"citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:368561a47c33ab3541ad95b94e1bb7728b8dc46f4a613964f04e444b67c0eac4","observation_id":"b311dc26-245c-4469-84bb-8fb834565b0e","resolution":{"observed_at":"2026-08-06T00:12:52.012334Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:12:51.786118Z","title":"KAIROS: Practical intrusion detection and investigation using whole- system provenance,","venue":null,"work_id":"ec10673a-98ff-403d-b5f3-9b449c73276f","year":2024},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":6,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:41.529829Z"},"links":{"citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:cd705b6790459fb3cd0aea3b3a8b042c864953be31d89da7d64def5664ebe6a7","observation_id":"28c913c6-7489-46f3-9d79-8b430dbdfe45","resolution":{"observed_at":"2026-08-06T00:12:51.852889Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:12:51.643932Z","title":"THREATRACE: Detecting and tracing host-based threats in node level through provenance graph learning,","venue":null,"work_id":"134a38d5-beaf-4b91-9699-799558e2bb7f","year":2022},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":7,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:41.589431Z"},"links":{"citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:b9a3aabd47d1fbafb9bbb0cc47db796da67b1e86e667a21d574d7ed88c3a7bd7","observation_id":"57564db8-8b78-48af-9613-782fb9a0d7de","resolution":{"observed_at":"2026-08-06T00:12:51.729272Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"6731.37461","doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:12:45.852426Z","title":"On the reproducibility of provenance-based intrusion detection that uses deep learning,","venue":null,"work_id":"15b11678-4e12-4975-95ef-fc23a806588a","year":2025},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":8,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:41.622204Z"},"links":{"citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:fc783d941c05b5f23b8caec241891e2c63847c01e08a6c39c40dbba9e66be6b1","observation_id":"bfc4c7c5-d544-4ff6-886c-3f5ffdf1643f","resolution":{"observed_at":"2026-08-06T00:12:45.932569Z","resolver_source":"raw_fallback","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:12:51.489808Z","title":"Sometimes simpler is better: A comprehensive analysis of state-of-the-art provenance-based intrusion detection systems,","venue":null,"work_id":"54d1ec86-a77a-4d31-80a5-8e8d11138cbe","year":2025},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":9,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:41.683413Z"},"links":{"citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:ce97c5ebfb9f5d4d3712b348866d1eb17ee854cf33d70ddbafc1a977c412ced8","observation_id":"d583f4ce-ffed-4405-87ed-a29a8c0955f7","resolution":{"observed_at":"2026-08-06T00:12:51.557232Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:12:51.322586Z","title":"What we talk about when we talk about logs: Understanding the effects of dataset quality on endpoint threat detection research,","venue":null,"work_id":"60c26be4-f33a-4bf3-9412-513c22e665d5","year":2025},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:41.768339Z"},"links":{"citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:a3e2b42953653c1838c5bd59558062d73c80e85d158826012377c80a46c2f87e","observation_id":"ffa7a138-40ae-4934-b34d-aae264bdb4fe","resolution":{"observed_at":"2026-08-06T00:12:51.395012Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:12:41.816860Z","title":"On the forensic validity of approximated audit logs,","venue":null,"work_id":null,"year":2020},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":11,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:41.816860Z"},"links":{"citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:04edeac3fc2f4847dd9d2c8040f96d903b5e230c98a7f68313beff5aa9a5382d","observation_id":"68a231a9-cf9c-4a5c-840e-8881cf72fbdb","resolution":{"observed_at":"2026-08-06T00:12:41.816860Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:12:41.908831Z","title":"Shortcut learning in deep neural networks,","venue":null,"work_id":null,"year":2020},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":12,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:41.908831Z"},"links":{"citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:66b1f1c50caf5d097a65c81697312f13ee184d5b5af508d27b7f4d9766ba410a","observation_id":"31df0c72-4f68-4d0e-b267-369010e1d746","resolution":{"observed_at":"2026-08-06T00:12:41.908831Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:12:51.137691Z","title":"ORTHRUS: Achieving high quality of attribution in provenance-based intrusion detection systems,","venue":null,"work_id":"fd615367-34d0-4b47-8987-540e4b831bea","year":2025},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":13,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:41.962118Z"},"links":{"citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:669a3b4a5d13d471ab910340b34ccad0b0810533bceef2863a4fab431eeb8c41","observation_id":"398fe4c0-2b44-4991-aafe-276d73b4720e","resolution":{"observed_at":"2026-08-06T00:12:51.201616Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:12:50.984976Z","title":"NoDoze: Combatting threat alert fatigue with automated provenance triage,","venue":null,"work_id":"0c27ac31-6a9c-4adb-8521-1e0368b5f760","year":2019},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":14,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:42.018467Z"},"links":{"citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:3ec06f0573f31367975972722646de05f76ee8283b2b8e59d54018d5f729e9f0","observation_id":"a66f594c-388c-4de3-9a74-e21cd1251432","resolution":{"observed_at":"2026-08-06T00:12:51.060852Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:12:50.850771Z","title":"Back-Propagating system dependency impact for attack investigation,","venue":null,"work_id":"126739e6-122e-486b-9e41-9a2fdd4e3e8c","year":2022},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":15,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:42.150437Z"},"links":{"citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:76dd67e0913ff96fd02cbf4f056df4527c8895af18f9d8f50eae8e86de9e129a","observation_id":"19e194f4-3f25-4c0e-88c3-7a1c44a28dbe","resolution":{"observed_at":"2026-08-06T00:12:50.921794Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:12:50.709825Z","title":"NODLINK: An online system for fine-grained apt attack detection and investigation,","venue":null,"work_id":"00cf2584-78f3-4b1b-bed7-9ae03ca6aa59","year":2024},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":16,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:42.190903Z"},"links":{"citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:44ae20108a4e89cae6143e11657902664365a1c0ad29a5d18edea8751d34deaf","observation_id":"309684a1-d780-40a6-ac80-03f61b054ede","resolution":{"observed_at":"2026-08-06T00:12:50.783299Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:12:42.219769Z","title":"Dos and don’ts of machine learning in computer security,","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":17,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:42.219769Z"},"links":{"citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:61e0472825b6f72f39e06f4b96674387e00e5ace31111d7cc6d93c356f43264c","observation_id":"fa5112cd-33b8-4f85-88ea-0ce5ab7a2755","resolution":{"observed_at":"2026-08-06T00:12:42.219769Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:12:50.531719Z","title":"Transparent computing engagement 3 data release,","venue":null,"work_id":"4c235646-1801-416a-92c1-e1c2e5877b12","year":2018},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":18,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:42.261558Z"},"links":{"citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:f33ae1843d953d785eb4444b3156d8e323e33f68a182b6ea5cf4d12d2c33bd4b","observation_id":"b6e70a15-8dca-4536-bc71-b82b5e68ea24","resolution":{"observed_at":"2026-08-06T00:12:50.587011Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:12:50.376960Z","title":"REAPr: Recovery every attack process,","venue":null,"work_id":"1e8418e6-1020-4b2c-95af-b1c46b2fbf60","year":2023},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":19,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:42.344739Z"},"links":{"citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:761cf564d13aa551e4e89663258919c5f441259d5c5432a943b19607b55414b9","observation_id":"384d63fe-4220-43c8-b976-5998713fafec","resolution":{"observed_at":"2026-08-06T00:12:50.474000Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2401.01341","last_updated":"2023-10-03T16:46:54Z","snapshot_observed_at":"2026-08-07T09:30:25.048465Z","submitted_at":"2023-10-03T16:46:54Z","title":"ATLASv2: ATLAS Attack Engagements, Version 2","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2401.01341","snapshot_observed_at":"2026-08-06T00:12:42.400804Z","title":"ATLASv2: Atlas attack engagements, version 2,","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":20,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:42.400804Z"},"links":{"cited_paper":"/paper/2401.01341","citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:18d3f31e8de9c1e43439e5bd715ffe82bea2e096bb8f602422a2e35a60620f10","observation_id":"8082b64b-40cc-4ee0-a338-61ed37012353","resolution":{"observed_at":"2026-08-06T00:12:42.400804Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:12:50.175798Z","title":"How to effectively trace provenance on windows endpoint detection & response telemetry,","venue":null,"work_id":"66fece34-0465-45f3-9d74-971d4444e42d","year":2026},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":21,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:42.458312Z"},"links":{"citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:8d967338088f54e7fec7ee9c6cf68aadbc97a4a2c126230803c07d59663f4f97","observation_id":"ba49a220-ad07-4dbd-89e8-7423264bf2a5","resolution":{"observed_at":"2026-08-06T00:12:50.244315Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:12:49.983330Z","title":"SPADE: Support for provenance auditing in distributed environments,","venue":null,"work_id":"0d470a3d-dced-46d4-b967-95d9f4ea8802","year":2012},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":22,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:42.557089Z"},"links":{"citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:8cb7b877f933e2851b62e3c9e9f2d114796b60e8d158fa63f963727f6131fca6","observation_id":"4d9d56f6-bbcf-4e75-a50d-342b5b4e04e7","resolution":{"observed_at":"2026-08-06T00:12:50.075333Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:12:49.810376Z","title":"Practical whole-system provenance capture,","venue":null,"work_id":"04c41fb5-2eab-4613-bc8d-46929a2411d8","year":2017},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":23,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:42.606910Z"},"links":{"citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:5670aed1fc53822d5a336d5ee8d9b6224b6cbac262f3594eb950a8e77ed900ad","observation_id":"078e3ad3-9a76-42cc-ba7f-27878d15cde8","resolution":{"observed_at":"2026-08-06T00:12:49.887090Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:12:42.724756Z","title":"Trustworthy Whole- System provenance for the linux kernel,","venue":null,"work_id":null,"year":2015},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":24,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:42.724756Z"},"links":{"citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:2deeaded37eaf59e9d91607dc1ce2752387c7298a1ed2a59b2b7ca8df927fa15","observation_id":"1c389a06-d7c4-4039-9d82-197e15daa6d7","resolution":{"observed_at":"2026-08-06T00:12:42.724756Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:12:49.617207Z","title":"Loggc: garbage collecting audit log,","venue":null,"work_id":"894feef2-a68e-4a97-8bf2-3c5607919c92","year":2013},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":25,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:42.830699Z"},"links":{"citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:94125a95ea6a6a9d8df7c6e0ef6c09376b5f112f52f967feaa54372fc0d80d25","observation_id":"6e5af8c3-4017-4041-8be1-eafd7dc0a266","resolution":{"observed_at":"2026-08-06T00:12:49.714635Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:12:49.433928Z","title":"High accuracy attack provenance via binary-based execution partition,","venue":null,"work_id":"f45dc5d1-5db9-4f71-adb4-3a15a8217517","year":2013},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":26,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:42.895706Z"},"links":{"citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:2982847b8b34648a1973867cdc09503b383532afc81daeaeaebc63551147d01f","observation_id":"5a2182e3-c245-4834-8eef-f96bde56f6a8","resolution":{"observed_at":"2026-08-06T00:12:49.523997Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:12:42.961980Z","title":"High fidelity data reduction for big data security dependency analyses,","venue":null,"work_id":null,"year":2016},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":27,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:42.961980Z"},"links":{"citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:2a7c69b242ba7721c47f5172d12c314bfb46f89b0753b44e5f051152d283aaba","observation_id":"49df516c-23f0-4e9d-b3c9-c95197c068d2","resolution":{"observed_at":"2026-08-06T00:12:42.961980Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:12:49.298128Z","title":"Towards a timely causality analysis for enterprise security,","venue":null,"work_id":"d09641ad-63d6-4645-8e83-7113fe9bb1cb","year":2018},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":28,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:43.011954Z"},"links":{"citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:7c7d0779a0216c60d977ef6c464393a230afa92091c31cd0f547d1844a7b34e7","observation_id":"fa2f49b0-76b1-45e6-804e-a6b1c0886d99","resolution":{"observed_at":"2026-08-06T00:12:49.364034Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:12:49.204623Z","title":"W ATSON: Abstracting behaviors from audit logs via aggregation of contextual semantics,","venue":null,"work_id":"745fa1da-2b0f-4198-9e3a-226b808021db","year":2021},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":29,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:43.109348Z"},"links":{"citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:c86737241a967b9b96858b7bacdad09b3eab55a614d871827346098c6cc80abd","observation_id":"8864fcf1-f417-4aea-ba39-fce16ae2497d","resolution":{"observed_at":"2026-08-06T00:12:49.247072Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:12:49.090091Z","title":"DeepLog: Anomaly detection and diagnosis from system logs through deep learning,","venue":null,"work_id":"8edcd61a-c4a2-404f-8e15-5849210a4518","year":2017},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":30,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:43.162226Z"},"links":{"citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:f17fdbc2af365a1db4c24fb8e721041a2f8ed659e3e5f23c05b86a9bcc4925da","observation_id":"2c8da824-15bc-41a8-8fdd-d3e75db6057b","resolution":{"observed_at":"2026-08-06T00:12:49.138030Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:12:43.236308Z","title":"Logbert: Log anomaly detection via bert,","venue":null,"work_id":null,"year":2021},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":31,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:43.236308Z"},"links":{"citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:55b661e03cb72d4ea5d427b4af07b3ac873a14794a9c45ac670a018e976a2d52","observation_id":"ca22fd31-f60c-4a52-8ee3-b7daa313a44d","resolution":{"observed_at":"2026-08-06T00:12:43.236308Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:12:48.981432Z","title":"Unicorn: Runtime provenance-based detector for advanced persistent threats,","venue":null,"work_id":"ee3c3b66-2c22-4b7f-876f-a550ce4c37ce","year":2020},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":32,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:43.288466Z"},"links":{"citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:b6d4181432093000bab948de000090d50b7790beb6be31c0d11e13602f158b49","observation_id":"817068f6-d3c9-4b24-9c84-8fbf1f897b22","resolution":{"observed_at":"2026-08-06T00:12:49.022650Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:12:48.841423Z","title":"You are what you do: Hunting stealthy malware via data provenance analysis,","venue":null,"work_id":"f4110aae-2439-48f6-8223-0774a5638408","year":2020},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":33,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:43.353304Z"},"links":{"citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:3e082d85ed02d4a6f8e268fcde1854eba761429ce2dc7613bf995c3b2ac8b1d8","observation_id":"cbb42c45-b1e5-4c75-969d-bb37a4bf647e","resolution":{"observed_at":"2026-08-06T00:12:48.902383Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:12:48.638614Z","title":"MAGIC: Detecting advanced persistent threats via masked graph representation learning,","venue":null,"work_id":"e145fe4f-843f-4f58-966c-e959d4f61a2b","year":2024},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":34,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:43.450297Z"},"links":{"citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:7de7021da33458a1b5160f22fd6f98a65c6631b9f9018eeba96572d02e76fbe8","observation_id":"c347928f-6746-4ebb-8f42-dcb10f5e98e9","resolution":{"observed_at":"2026-08-06T00:12:48.736900Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:12:48.440299Z","title":"Flash: A comprehensive approach to intrusion detection via provenance graph representation learning,","venue":null,"work_id":"6a7dd7bb-9860-450a-a75e-79d70c0611cf","year":2024},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":35,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:43.548591Z"},"links":{"citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:39f22c6046775d6a9f1545413f0bd4803508f773e21f63ef7e230db9423cd103","observation_id":"d9de7929-3d37-499f-ad09-65429f726d7e","resolution":{"observed_at":"2026-08-06T00:12:48.530584Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:12:48.240691Z","title":"R-caid: Embedding root cause analysis within provenance-based intrusion detection,","venue":null,"work_id":"d2c1748e-b5ba-4dc2-b0f9-6dd285d91028","year":2024},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":36,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:43.623182Z"},"links":{"citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:f58418b2ae647b9cd7e77959122b5bd8f065ab034a7d1ab313fefb544fdd3b13","observation_id":"518464f2-9bf4-4cc5-950e-8ad3fe6978be","resolution":{"observed_at":"2026-08-06T00:12:48.328184Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:12:43.689445Z","title":"The relationship between precision-recall and roc curves,","venue":null,"work_id":null,"year":2006},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":37,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:43.689445Z"},"links":{"citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:39849f3e6e8121830a70993ea03c2612041b244da7e7bce705fea2c11dde9b19","observation_id":"a660ef32-ceeb-4133-962d-4f96970811de","resolution":{"observed_at":"2026-08-06T00:12:43.689445Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:12:48.018932Z","title":"The precision-recall plot is more informa- tive than the ROC plot when evaluating binary classifiers on imbalanced datasets,","venue":null,"work_id":"699c972a-9b2f-4f24-b098-979fac9ffbf3","year":2015},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":38,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:43.756642Z"},"links":{"citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:308f79f7940fda82a503a25628c45f3529f25736a4ade03e745d00fa30920c32","observation_id":"878e8b01-7f42-4ddd-9746-a07b099e58fa","resolution":{"observed_at":"2026-08-06T00:12:48.133903Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:12:47.791467Z","title":"The advantages of the Matthews correlation coefficient (MCC) over F1 score and accuracy in binary classification evaluation,","venue":null,"work_id":"08017bf3-9dbf-4675-98f9-d674e22cb5fe","year":2020},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":39,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:43.841500Z"},"links":{"citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:36f20de2991ce0c0be3562490d95001d18a7ac8dc1b5889a7409eea50ce02799","observation_id":"eac5dabe-bbc9-43b9-a83b-f70be375ea83","resolution":{"observed_at":"2026-08-06T00:12:47.912820Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:12:47.556498Z","title":"TESSERACT: Eliminating experimental bias in malware classification across space and time (extended version),","venue":null,"work_id":"5b13f47d-b5e2-4291-b640-00a983790262","year":null},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":40,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:43.943587Z"},"links":{"citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:138c16f92d4a9cbc16bcdb1d9ec5c7d4e4a863441615cf8793ba107649b16fcf","observation_id":"9c6f43c3-6e4c-471b-8fb4-4836901aa0cf","resolution":{"observed_at":"2026-08-06T00:12:47.671281Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:12:47.434775Z","title":"SoK: Pragmatic assessment of machine learning for network intrusion detection,","venue":null,"work_id":"221bf46c-8a24-47fa-9482-6022337c8777","year":2023},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":41,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:44.070227Z"},"links":{"citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:396ccd2191c507ccbd28d9b35ab96791e4db9bc293eb19daffe53cc1835f5224","observation_id":"5fcbca1c-a2d7-4a27-8582-b33706da386b","resolution":{"observed_at":"2026-08-06T00:12:47.488415Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:12:47.337472Z","title":"Reporting score distributions makes a difference: Performance study of lstm-networks for sequence tagging,","venue":null,"work_id":"1a5f0316-28a7-4c89-a75f-e82ad5c354ae","year":2017},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":42,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:44.145158Z"},"links":{"citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:7c81736f5c2d0ce4bf2a4dd4b68fd875f070822890602433372e7a72680c6fca","observation_id":"ce8503cc-bd4d-4196-8fc8-cda7aa5c144a","resolution":{"observed_at":"2026-08-06T00:12:47.372132Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:12:47.210366Z","title":"Accounting for variance in machine learning benchmarks,","venue":null,"work_id":"61341dd0-c736-4b95-88e6-3864776882d8","year":2021},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":43,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:44.217483Z"},"links":{"citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:3b59688a70bddc805c2a631b82de157fbeb0d59b3f03329ceaf745edf6c1917f","observation_id":"d797dbc1-fe65-44e4-aa57-8ae18cb42e19","resolution":{"observed_at":"2026-08-06T00:12:47.271093Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:12:47.087736Z","title":"ATLAS: A sequence-based learning approach for attack investigation,","venue":null,"work_id":"a2536e0a-ac99-421f-8ff5-108f42de697d","year":2021},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":44,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:44.322975Z"},"links":{"citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:943a37cdfddf1f008d0e89f115f20a3f7f2cca2ee5294a43a3ad7c9b383712f6","observation_id":"30d1f2f5-e5b3-407c-b2ac-3aa28af46cf6","resolution":{"observed_at":"2026-08-06T00:12:47.122348Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:12:46.978729Z","title":"A new hope for darpa optc,","venue":null,"work_id":"426b55a9-54e2-4bbe-ace5-5621efd3606a","year":2025},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":45,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:44.400531Z"},"links":{"citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:1b7b65034930dc72373cabf6c6c04317dfa5fe1b0c06fe2742096b56addc0ff7","observation_id":"a5724c73-9983-40bb-bfb8-77df8c70a2d6","resolution":{"observed_at":"2026-08-06T00:12:47.023073Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:12:44.459624Z","title":"A mathematical theory of communication,","venue":null,"work_id":null,"year":1948},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":46,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:44.459624Z"},"links":{"citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:c2c27aae66c66c9e2eba1d9eeb007ca968f9b4ba4bf248fbb6b6210a57554899","observation_id":"cdae3c81-148e-4413-adc2-213d4c701500","resolution":{"observed_at":"2026-08-06T00:12:44.459624Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:12:46.841014Z","title":"Survivalism: Systematic analysis of Windows malware living- off-the-land,","venue":null,"work_id":"b78dda5a-4fd6-486b-8d40-737917fa403f","year":2021},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":47,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:44.518711Z"},"links":{"citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:72082045f6b86a860190a0614b7f99bebfe1fe0069ab07ec637c252e7daf66c8","observation_id":"d41d2e39-d3ca-40b5-b797-9f851fe0009a","resolution":{"observed_at":"2026-08-06T00:12:46.913789Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:12:46.678187Z","title":"Self-supervised learning of graph representations for network intrusion detection,","venue":null,"work_id":"20d6e862-a6d3-4704-8124-4ff382053715","year":2025},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":48,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:44.600615Z"},"links":{"citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:a1ebf9af47e1942f60537f15bdf0ba247ecc5fe73d78093364027f2102881cfe","observation_id":"cc61a368-ea8c-416f-a613-4d0a5e386c39","resolution":{"observed_at":"2026-08-06T00:12:46.747486Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:12:46.537324Z","title":"E- GraphSAGE: A graph neural network based intrusion detection system for IoT,","venue":null,"work_id":"f45f96e7-3c07-4d2f-b2d7-381aa26592dc","year":2022},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":49,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:44.687439Z"},"links":{"citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:d5bbe136eb15e3ca2bee7377b78bf954f36288f8eb1f2ba2b351af0545dce4e7","observation_id":"7fab8737-07e1-4e1b-a694-82727c9141be","resolution":{"observed_at":"2026-08-06T00:12:46.594080Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:12:44.758185Z","title":"Attention is all you need,","venue":null,"work_id":null,"year":2017},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":50,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:44.758185Z"},"links":{"citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:dd1a7a4bf12b47cad4834b7ea2094a7b105aa7d486b2309c8611529d7c8042ae","observation_id":"39fae256-bedb-426e-b059-148129e59ebb","resolution":{"observed_at":"2026-08-06T00:12:44.758185Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"1301.3781","last_updated":"2013-09-07T00:30:40Z","snapshot_observed_at":"2026-07-06T03:04:11.148340Z","submitted_at":"2013-01-16T18:24:43Z","title":"Efficient Estimation of Word Representations in Vector Space","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"1301.3781","snapshot_observed_at":"2026-08-06T00:12:44.815942Z","title":"Efficient estimation of word representations in vector space,","venue":null,"work_id":null,"year":2013},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":51,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:44.815942Z"},"links":{"cited_paper":"/paper/1301.3781","citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:ce2aa444d642f2c0eb3303995e091e5f42bf69cf39ac43060dc4c4dc9e9781fd","observation_id":"465093ae-7a6d-4c2c-b48b-4b7642618196","resolution":{"observed_at":"2026-08-06T00:12:44.815942Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:12:46.408511Z","title":"PIDSMaker: An ml framework for building provenance- based intrusion detection systems,","venue":null,"work_id":"2b1e51d5-bd9e-48e4-ae45-0e1a716b9d05","year":2025},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":52,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:44.878240Z"},"links":{"citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:529bd603429ad0936fd6a6623d712e27d50d8f32d929ed88c3f2d73703694b18","observation_id":"517f5e5f-8ea7-44f5-b810-f0a53eca5e9e","resolution":{"observed_at":"2026-08-06T00:12:46.454123Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:12:46.299069Z","title":"MAGIC: Official implementation,","venue":null,"work_id":"7484ac6b-09d8-4d30-b960-5706a4ab39e5","year":2024},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":53,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:44.938287Z"},"links":{"citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:622947084f257e5315e7b5076141833a421dc9820e6922dea5778e0ca3cd3f5f","observation_id":"c6ff909b-ad66-4dd9-b3f1-1b4b23daa5d2","resolution":{"observed_at":"2026-08-06T00:12:46.340069Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:12:44.998573Z","title":"PyTorch: An imperative style, high-performance deep learning library,","venue":null,"work_id":null,"year":2019},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":54,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:44.998573Z"},"links":{"citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:545e93f553e7e84c840a9c7d69415f4be9b914d0104d776143853a075785dd6a","observation_id":"c5d7783f-995e-4c65-94fc-d4a6b16c7930","resolution":{"observed_at":"2026-08-06T00:12:44.998573Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"1903.02428","last_updated":"2019-04-25T10:06:09Z","snapshot_observed_at":"2026-08-02T18:54:43.326912Z","submitted_at":"2019-03-06T14:50:02Z","title":"Fast Graph Representation Learning with PyTorch Geometric","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"1903.02428","snapshot_observed_at":"2026-08-06T00:12:45.066398Z","title":"Fast graph representation learning with PyTorch Geometric,","venue":null,"work_id":null,"year":2019},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":55,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:45.066398Z"},"links":{"cited_paper":"/paper/1903.02428","citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:e695e20298d445d50619f80bced9a546657c1d1a6997051ed26340f09bb8d2c0","observation_id":"7acf3fce-6595-4174-b44a-f44838b9ed54","resolution":{"observed_at":"2026-08-06T00:12:45.066398Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:12:45.133827Z","title":"Decoupled weight decay regularization,","venue":null,"work_id":null,"year":2019},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":56,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:45.133827Z"},"links":{"citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:f8aef5a22209e3d59d858351c3658a88056854b10e4a4a24c1dc7f63c9be0f40","observation_id":"e0fe0935-6403-45dc-b53e-2e69506286a3","resolution":{"observed_at":"2026-08-06T00:12:45.133827Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:12:46.137883Z","title":"Datasheets for datasets,","venue":null,"work_id":"20a09dae-ac64-4432-9ae2-76641969307a","year":2021},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":57,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:45.212720Z"},"links":{"citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:a43cbc29c04415a5df34331850d01b234df58c17bbc39a91a9a56be081e35b75","observation_id":"e814970b-1a85-4f59-ad7e-52324320c762","resolution":{"observed_at":"2026-08-06T00:12:46.207367Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:12:46.028090Z","title":"The Menlo Report: Ethical principles guiding information and communication technology research,","venue":null,"work_id":"b6beb565-8f98-4ed8-960b-9e1ebb7cea72","year":2012},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":58,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:45.286712Z"},"links":{"citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:9471b68dd4ce7976c4fede51c828d655277afcbcfe1bf91a21d5f0ba5fd19c22","observation_id":"7712aa8d-b2a5-43fc-af26-6b98f82b9b88","resolution":{"observed_at":"2026-08-06T00:12:46.080576Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:12:45.339878Z","title":"Fast memory-efficient anomaly detection in streaming heterogeneous graphs,","venue":null,"work_id":null,"year":2016},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":59,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:45.339878Z"},"links":{"citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:185eb0440a8b7aa1d2d8497d22c8450795475c1278d8e7ddb52686826452fa22","observation_id":"c8fc40f3-198a-4837-82cd-d7d1048d2491","resolution":{"observed_at":"2026-08-06T00:12:45.339878Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2402.01359","last_updated":"2025-04-09T12:32:21Z","snapshot_observed_at":"2026-07-06T17:24:16.787573Z","submitted_at":"2024-02-02T12:27:32Z","title":"TESSERACT: Eliminating Experimental Bias in Malware Classification across Space and Time (Extended Version)","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.01359","snapshot_observed_at":"2026-08-06T00:12:44.013859Z","title":"Available: https://arxiv.org/abs/2402.01359","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","version":1},"reference_index":2025,"source":"pdf_text","source_observed_at":"2026-08-06T00:12:44.013859Z"},"links":{"cited_paper":"/paper/2402.01359","citing_paper":"/paper/2608.01454"},"observation_digest":"sha256:c9284b05932a2973da2ef11a03855d48ef4319cd360a5bf3b30ae47bfb7c42c6","observation_id":"682bef6d-5863-4aa0-bdcd-db50a4b18a78","resolution":{"observed_at":"2026-08-06T00:12:44.013859Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}}],"paper":{"arxiv_id":"2608.01454","last_updated":"2026-08-02T19:27:49Z","latest_version":1,"primary_category":"cs.CR","snapshot_observed_at":"2026-08-06T23:26:36.033300Z","submitted_at":"2026-08-02T19:27:49Z","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection"},"reference_resolution":{"displayed":60,"state_counts":{"malformed_identifier":0,"metadata_mismatch":1,"parse_uncertain":0,"unresolved":16,"verified_exact":0,"verified_fuzzy":43},"total_outbound_references":60},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"thesis":"As of 10 August 2026, this Paper Citation Record lists 60 of 60 outbound references and 0 inbound Pith citation observations for arXiv:2608.01454."}