{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2024:D545K4TC3VXCSJU3XLHM3XIE5O","short_pith_number":"pith:D545K4TC","canonical_record":{"source":{"id":"2409.16400","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2024-09-24T18:59:27Z","cross_cats_sorted":[],"title_canon_sha256":"aba2c96945dbf0dbae9d72dd8c04ce1dcd5d081c00a3b677ddf8262c3a66ac89","abstract_canon_sha256":"1c99e8f3e43d75436f9113dda306af0afc69fa6ea0f16528d8ec3733af0d4d61"},"schema_version":"1.0"},"canonical_sha256":"1f79d57262dd6e29269bbacecddd04eba03c31467bfb3de209f1791562330e95","source":{"kind":"arxiv","id":"2409.16400","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2409.16400","created_at":"2026-07-05T09:11:33Z"},{"alias_kind":"arxiv_version","alias_value":"2409.16400v1","created_at":"2026-07-05T09:11:33Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2409.16400","created_at":"2026-07-05T09:11:33Z"},{"alias_kind":"pith_short_12","alias_value":"D545K4TC3VXC","created_at":"2026-07-05T09:11:33Z"},{"alias_kind":"pith_short_16","alias_value":"D545K4TC3VXCSJU3","created_at":"2026-07-05T09:11:33Z"},{"alias_kind":"pith_short_8","alias_value":"D545K4TC","created_at":"2026-07-05T09:11:33Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2024:D545K4TC3VXCSJU3XLHM3XIE5O","target":"record","payload":{"canonical_record":{"source":{"id":"2409.16400","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2024-09-24T18:59:27Z","cross_cats_sorted":[],"title_canon_sha256":"aba2c96945dbf0dbae9d72dd8c04ce1dcd5d081c00a3b677ddf8262c3a66ac89","abstract_canon_sha256":"1c99e8f3e43d75436f9113dda306af0afc69fa6ea0f16528d8ec3733af0d4d61"},"schema_version":"1.0"},"canonical_sha256":"1f79d57262dd6e29269bbacecddd04eba03c31467bfb3de209f1791562330e95","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T09:11:33.085809Z","signature_b64":"uVVKdoMlXJe4moZQ4MEHpYwyPw6SyB6fvFV0ZsrfZdziaGfpI9XfwLS6hUSmf6XOZNdHM51SCRAofzyPWmk8AA==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"1f79d57262dd6e29269bbacecddd04eba03c31467bfb3de209f1791562330e95","last_reissued_at":"2026-07-05T09:11:33.085401Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T09:11:33.085401Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2409.16400","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T09:11:33Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"KmmWe9YoiTIJdyjTE2ac5FddycZUqd+wgV2q8vckvBS3whut9eSjHYKtbUA0LBSg/qRWnAN9D/G84bLi1JfsAA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-16T14:50:25.150775Z"},"content_sha256":"95332d67d3fdcdbe0ccf26178034355ceae3e3e3d5c7901a73c7c6e9ff756562","schema_version":"1.0","event_id":"sha256:95332d67d3fdcdbe0ccf26178034355ceae3e3e3d5c7901a73c7c6e9ff756562"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2024:D545K4TC3VXCSJU3XLHM3XIE5O","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Chasing the Shadows: TTPs in Action to Attribute Advanced Persistent Threats","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":[],"primary_cat":"cs.CR","authors_text":"Bikash Saha, Nanda Rani, Sandeep Kumar Shukla, Vikas Maurya","submitted_at":"2024-09-24T18:59:27Z","abstract_excerpt":"The current state of Advanced Persistent Threats (APT) attribution primarily relies on time-consuming manual processes. These include mapping incident artifacts onto threat attribution frameworks and employing expert reasoning to uncover the most likely responsible APT groups. This research aims to assist the threat analyst in the attribution process by presenting an attribution method named CAPTAIN (Comprehensive Advanced Persistent Threat AttrIbutioN). This novel APT attribution approach leverages the Tactics, Techniques, and Procedures (TTPs) employed by various APT groups in past attacks. "},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2409.16400","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2409.16400/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T09:11:33Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"vb8eMjlXxD1e8hq0oJlH0xbCwuv6fDnDtchW4TfdlmghcNzuiOvFzr0OlWFDFHzQ4xdfOdYPeuD4pdvZ7nowBQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-16T14:50:25.151735Z"},"content_sha256":"7cb22525f046593550de5b4aaa9ec8f3feb85827d69d200df076c7630808e4dc","schema_version":"1.0","event_id":"sha256:7cb22525f046593550de5b4aaa9ec8f3feb85827d69d200df076c7630808e4dc"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/D545K4TC3VXCSJU3XLHM3XIE5O/bundle.json","state_url":"https://pith.science/pith/D545K4TC3VXCSJU3XLHM3XIE5O/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/D545K4TC3VXCSJU3XLHM3XIE5O/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-16T14:50:25Z","links":{"resolver":"https://pith.science/pith/D545K4TC3VXCSJU3XLHM3XIE5O","bundle":"https://pith.science/pith/D545K4TC3VXCSJU3XLHM3XIE5O/bundle.json","state":"https://pith.science/pith/D545K4TC3VXCSJU3XLHM3XIE5O/state.json","well_known_bundle":"https://pith.science/.well-known/pith/D545K4TC3VXCSJU3XLHM3XIE5O/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2024:D545K4TC3VXCSJU3XLHM3XIE5O","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"1c99e8f3e43d75436f9113dda306af0afc69fa6ea0f16528d8ec3733af0d4d61","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2024-09-24T18:59:27Z","title_canon_sha256":"aba2c96945dbf0dbae9d72dd8c04ce1dcd5d081c00a3b677ddf8262c3a66ac89"},"schema_version":"1.0","source":{"id":"2409.16400","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2409.16400","created_at":"2026-07-05T09:11:33Z"},{"alias_kind":"arxiv_version","alias_value":"2409.16400v1","created_at":"2026-07-05T09:11:33Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2409.16400","created_at":"2026-07-05T09:11:33Z"},{"alias_kind":"pith_short_12","alias_value":"D545K4TC3VXC","created_at":"2026-07-05T09:11:33Z"},{"alias_kind":"pith_short_16","alias_value":"D545K4TC3VXCSJU3","created_at":"2026-07-05T09:11:33Z"},{"alias_kind":"pith_short_8","alias_value":"D545K4TC","created_at":"2026-07-05T09:11:33Z"}],"graph_snapshots":[{"event_id":"sha256:7cb22525f046593550de5b4aaa9ec8f3feb85827d69d200df076c7630808e4dc","target":"graph","created_at":"2026-07-05T09:11:33Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2409.16400/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"The current state of Advanced Persistent Threats (APT) attribution primarily relies on time-consuming manual processes. These include mapping incident artifacts onto threat attribution frameworks and employing expert reasoning to uncover the most likely responsible APT groups. This research aims to assist the threat analyst in the attribution process by presenting an attribution method named CAPTAIN (Comprehensive Advanced Persistent Threat AttrIbutioN). This novel APT attribution approach leverages the Tactics, Techniques, and Procedures (TTPs) employed by various APT groups in past attacks. ","authors_text":"Bikash Saha, Nanda Rani, Sandeep Kumar Shukla, Vikas Maurya","cross_cats":[],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2024-09-24T18:59:27Z","title":"Chasing the Shadows: TTPs in Action to Attribute Advanced Persistent Threats"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2409.16400","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:95332d67d3fdcdbe0ccf26178034355ceae3e3e3d5c7901a73c7c6e9ff756562","target":"record","created_at":"2026-07-05T09:11:33Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"1c99e8f3e43d75436f9113dda306af0afc69fa6ea0f16528d8ec3733af0d4d61","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2024-09-24T18:59:27Z","title_canon_sha256":"aba2c96945dbf0dbae9d72dd8c04ce1dcd5d081c00a3b677ddf8262c3a66ac89"},"schema_version":"1.0","source":{"id":"2409.16400","kind":"arxiv","version":1}},"canonical_sha256":"1f79d57262dd6e29269bbacecddd04eba03c31467bfb3de209f1791562330e95","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"1f79d57262dd6e29269bbacecddd04eba03c31467bfb3de209f1791562330e95","first_computed_at":"2026-07-05T09:11:33.085401Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T09:11:33.085401Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"uVVKdoMlXJe4moZQ4MEHpYwyPw6SyB6fvFV0ZsrfZdziaGfpI9XfwLS6hUSmf6XOZNdHM51SCRAofzyPWmk8AA==","signature_status":"signed_v1","signed_at":"2026-07-05T09:11:33.085809Z","signed_message":"canonical_sha256_bytes"},"source_id":"2409.16400","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:95332d67d3fdcdbe0ccf26178034355ceae3e3e3d5c7901a73c7c6e9ff756562","sha256:7cb22525f046593550de5b4aaa9ec8f3feb85827d69d200df076c7630808e4dc"],"state_sha256":"168d6b88c51233f5acc160d5b5c32cba7146812cb156be357089a42d34c9f790"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"Nu5q9GF4BFqakqxM/Sd/+STF/nDMJ1HdUcwUUqwJvhCOpVVDjONSiCMrJYVNufD7HYt5km8RbLH1FEL+TG3SBg==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-16T14:50:25.158131Z","bundle_sha256":"ecda57c66024e0b293c2db307b4fee279ae3377a9d32f376d49f46078b80f935"}}