{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2026:HCCIJCICVYJCJVJNL6AKMCUEPG","short_pith_number":"pith:HCCIJCIC","canonical_record":{"source":{"id":"2605.29269","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2026-05-28T02:38:12Z","cross_cats_sorted":[],"title_canon_sha256":"7e29097e6606490cfdd6ea770d16feab9b023ca2cd53ec459a1dc622336c9232","abstract_canon_sha256":"e36d82e835e8206226056c0202ba55ab1b305cbc9b2ce387e09ba4b2143cfab9"},"schema_version":"1.0"},"canonical_sha256":"3884848902ae1224d52d5f80a60a847980ae42d70dd4abbc2ded527785491835","source":{"kind":"arxiv","id":"2605.29269","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2605.29269","created_at":"2026-05-29T01:05:28Z"},{"alias_kind":"arxiv_version","alias_value":"2605.29269v1","created_at":"2026-05-29T01:05:28Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2605.29269","created_at":"2026-05-29T01:05:28Z"},{"alias_kind":"pith_short_12","alias_value":"HCCIJCICVYJC","created_at":"2026-05-29T01:05:28Z"},{"alias_kind":"pith_short_16","alias_value":"HCCIJCICVYJCJVJN","created_at":"2026-05-29T01:05:28Z"},{"alias_kind":"pith_short_8","alias_value":"HCCIJCIC","created_at":"2026-05-29T01:05:28Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2026:HCCIJCICVYJCJVJNL6AKMCUEPG","target":"record","payload":{"canonical_record":{"source":{"id":"2605.29269","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2026-05-28T02:38:12Z","cross_cats_sorted":[],"title_canon_sha256":"7e29097e6606490cfdd6ea770d16feab9b023ca2cd53ec459a1dc622336c9232","abstract_canon_sha256":"e36d82e835e8206226056c0202ba55ab1b305cbc9b2ce387e09ba4b2143cfab9"},"schema_version":"1.0"},"canonical_sha256":"3884848902ae1224d52d5f80a60a847980ae42d70dd4abbc2ded527785491835","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-05-29T01:05:28.231343Z","signature_b64":"jFkqtEXflDBxZTo6aq/GQNu089LpHdKordnGCsIgIydHmSwcBunQq/O+V30l5OFGqbJoux/8pdvDuRFNneDlAw==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"3884848902ae1224d52d5f80a60a847980ae42d70dd4abbc2ded527785491835","last_reissued_at":"2026-05-29T01:05:28.230248Z","signature_status":"signed_v1","first_computed_at":"2026-05-29T01:05:28.230248Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2605.29269","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-05-29T01:05:28Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"46nZnq/6VgXIMJRvQKUXKtp+hKTUJxQb8FDoV5RkQfHs3HyTBli4EpELK0FL0YV76MIzMlLNxUw+6TR1qS7TCw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-06-25T10:11:28.536134Z"},"content_sha256":"a43e9341fd94a34b825b7395285346cdc6c5bc5f0e96b3a77b5b68f2f85e35e2","schema_version":"1.0","event_id":"sha256:a43e9341fd94a34b825b7395285346cdc6c5bc5f0e96b3a77b5b68f2f85e35e2"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2026:HCCIJCICVYJCJVJNL6AKMCUEPG","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"HunterAgent: Neuro-Symbolic Attack Trace Reconstruction under Anti-Forensics","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":[],"primary_cat":"cs.CR","authors_text":"Bailing Wang, Guangze Zhao, Hongri Liu, Weilin Gai, Yongzheng Zhang, Yuliang Wei","submitted_at":"2026-05-28T02:38:12Z","abstract_excerpt":"Modern alert-triage systems reduce SOC burden by filtering false positives, but flagging a high-risk alert is only the start of incident response. Threat hunting requires reconstructing causal attack chains across heterogeneous, partially corrupted logs. Against APTs using anti-forensics (parent-PID spoofing, log wiping, fileless execution), provenance graphs split into disjoint subgraphs and fail. Unconstrained LLM agents fabricate causal links violating OS physics, producing fluent but forensically inadmissible narratives. We propose HunterAgent, a neuro-symbolic framework that reframes trac"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2605.29269","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2605.29269/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-05-29T01:05:28Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"0gOR3wXeBAmyN2e3QDjWGUcKhVZvHW3eClAwO3nUWH+Loe5u3p7JrI3qv9CJJrzotCdAaoNBFuWVteJhgOhgBQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-06-25T10:11:28.536521Z"},"content_sha256":"0ec0bb8c3511bc2a9536e940c819343a1196fe080758b4ef657538dc9a26b8c8","schema_version":"1.0","event_id":"sha256:0ec0bb8c3511bc2a9536e940c819343a1196fe080758b4ef657538dc9a26b8c8"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/HCCIJCICVYJCJVJNL6AKMCUEPG/bundle.json","state_url":"https://pith.science/pith/HCCIJCICVYJCJVJNL6AKMCUEPG/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/HCCIJCICVYJCJVJNL6AKMCUEPG/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-06-25T10:11:28Z","links":{"resolver":"https://pith.science/pith/HCCIJCICVYJCJVJNL6AKMCUEPG","bundle":"https://pith.science/pith/HCCIJCICVYJCJVJNL6AKMCUEPG/bundle.json","state":"https://pith.science/pith/HCCIJCICVYJCJVJNL6AKMCUEPG/state.json","well_known_bundle":"https://pith.science/.well-known/pith/HCCIJCICVYJCJVJNL6AKMCUEPG/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2026:HCCIJCICVYJCJVJNL6AKMCUEPG","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"e36d82e835e8206226056c0202ba55ab1b305cbc9b2ce387e09ba4b2143cfab9","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2026-05-28T02:38:12Z","title_canon_sha256":"7e29097e6606490cfdd6ea770d16feab9b023ca2cd53ec459a1dc622336c9232"},"schema_version":"1.0","source":{"id":"2605.29269","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2605.29269","created_at":"2026-05-29T01:05:28Z"},{"alias_kind":"arxiv_version","alias_value":"2605.29269v1","created_at":"2026-05-29T01:05:28Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2605.29269","created_at":"2026-05-29T01:05:28Z"},{"alias_kind":"pith_short_12","alias_value":"HCCIJCICVYJC","created_at":"2026-05-29T01:05:28Z"},{"alias_kind":"pith_short_16","alias_value":"HCCIJCICVYJCJVJN","created_at":"2026-05-29T01:05:28Z"},{"alias_kind":"pith_short_8","alias_value":"HCCIJCIC","created_at":"2026-05-29T01:05:28Z"}],"graph_snapshots":[{"event_id":"sha256:0ec0bb8c3511bc2a9536e940c819343a1196fe080758b4ef657538dc9a26b8c8","target":"graph","created_at":"2026-05-29T01:05:28Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2605.29269/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Modern alert-triage systems reduce SOC burden by filtering false positives, but flagging a high-risk alert is only the start of incident response. Threat hunting requires reconstructing causal attack chains across heterogeneous, partially corrupted logs. Against APTs using anti-forensics (parent-PID spoofing, log wiping, fileless execution), provenance graphs split into disjoint subgraphs and fail. Unconstrained LLM agents fabricate causal links violating OS physics, producing fluent but forensically inadmissible narratives. We propose HunterAgent, a neuro-symbolic framework that reframes trac","authors_text":"Bailing Wang, Guangze Zhao, Hongri Liu, Weilin Gai, Yongzheng Zhang, Yuliang Wei","cross_cats":[],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2026-05-28T02:38:12Z","title":"HunterAgent: Neuro-Symbolic Attack Trace Reconstruction under Anti-Forensics"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2605.29269","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:a43e9341fd94a34b825b7395285346cdc6c5bc5f0e96b3a77b5b68f2f85e35e2","target":"record","created_at":"2026-05-29T01:05:28Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"e36d82e835e8206226056c0202ba55ab1b305cbc9b2ce387e09ba4b2143cfab9","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2026-05-28T02:38:12Z","title_canon_sha256":"7e29097e6606490cfdd6ea770d16feab9b023ca2cd53ec459a1dc622336c9232"},"schema_version":"1.0","source":{"id":"2605.29269","kind":"arxiv","version":1}},"canonical_sha256":"3884848902ae1224d52d5f80a60a847980ae42d70dd4abbc2ded527785491835","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"3884848902ae1224d52d5f80a60a847980ae42d70dd4abbc2ded527785491835","first_computed_at":"2026-05-29T01:05:28.230248Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-05-29T01:05:28.230248Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"jFkqtEXflDBxZTo6aq/GQNu089LpHdKordnGCsIgIydHmSwcBunQq/O+V30l5OFGqbJoux/8pdvDuRFNneDlAw==","signature_status":"signed_v1","signed_at":"2026-05-29T01:05:28.231343Z","signed_message":"canonical_sha256_bytes"},"source_id":"2605.29269","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:a43e9341fd94a34b825b7395285346cdc6c5bc5f0e96b3a77b5b68f2f85e35e2","sha256:0ec0bb8c3511bc2a9536e940c819343a1196fe080758b4ef657538dc9a26b8c8"],"state_sha256":"b6e81404de6ae69198ca1e01e1ae87366edfc30a3ac76b63c3a01422e03c1b83"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"+ntO3GFuHRTOydl5Oznnk7KyZxFbb7aNc3EK7w1kNhK1uXXa53c7WGIuTvyBIbe2hNILSUuUzVw/6nmmv55vAg==","signed_message":"bundle_sha256_bytes","signed_at":"2026-06-25T10:11:28.538536Z","bundle_sha256":"d06408096fcb892afc03531ab474cbbd0d31327487bab11beb935bb608413230"}}