{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2026:HCCIJCICVYJCJVJNL6AKMCUEPG","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"e36d82e835e8206226056c0202ba55ab1b305cbc9b2ce387e09ba4b2143cfab9","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2026-05-28T02:38:12Z","title_canon_sha256":"7e29097e6606490cfdd6ea770d16feab9b023ca2cd53ec459a1dc622336c9232"},"schema_version":"1.0","source":{"id":"2605.29269","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2605.29269","created_at":"2026-05-29T01:05:28Z"},{"alias_kind":"arxiv_version","alias_value":"2605.29269v1","created_at":"2026-05-29T01:05:28Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2605.29269","created_at":"2026-05-29T01:05:28Z"},{"alias_kind":"pith_short_12","alias_value":"HCCIJCICVYJC","created_at":"2026-05-29T01:05:28Z"},{"alias_kind":"pith_short_16","alias_value":"HCCIJCICVYJCJVJN","created_at":"2026-05-29T01:05:28Z"},{"alias_kind":"pith_short_8","alias_value":"HCCIJCIC","created_at":"2026-05-29T01:05:28Z"}],"graph_snapshots":[{"event_id":"sha256:0ec0bb8c3511bc2a9536e940c819343a1196fe080758b4ef657538dc9a26b8c8","target":"graph","created_at":"2026-05-29T01:05:28Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2605.29269/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Modern alert-triage systems reduce SOC burden by filtering false positives, but flagging a high-risk alert is only the start of incident response. Threat hunting requires reconstructing causal attack chains across heterogeneous, partially corrupted logs. Against APTs using anti-forensics (parent-PID spoofing, log wiping, fileless execution), provenance graphs split into disjoint subgraphs and fail. Unconstrained LLM agents fabricate causal links violating OS physics, producing fluent but forensically inadmissible narratives. We propose HunterAgent, a neuro-symbolic framework that reframes trac","authors_text":"Bailing Wang, Guangze Zhao, Hongri Liu, Weilin Gai, Yongzheng Zhang, Yuliang Wei","cross_cats":[],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2026-05-28T02:38:12Z","title":"HunterAgent: Neuro-Symbolic Attack Trace Reconstruction under Anti-Forensics"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2605.29269","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:a43e9341fd94a34b825b7395285346cdc6c5bc5f0e96b3a77b5b68f2f85e35e2","target":"record","created_at":"2026-05-29T01:05:28Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"e36d82e835e8206226056c0202ba55ab1b305cbc9b2ce387e09ba4b2143cfab9","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2026-05-28T02:38:12Z","title_canon_sha256":"7e29097e6606490cfdd6ea770d16feab9b023ca2cd53ec459a1dc622336c9232"},"schema_version":"1.0","source":{"id":"2605.29269","kind":"arxiv","version":1}},"canonical_sha256":"3884848902ae1224d52d5f80a60a847980ae42d70dd4abbc2ded527785491835","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"3884848902ae1224d52d5f80a60a847980ae42d70dd4abbc2ded527785491835","first_computed_at":"2026-05-29T01:05:28.230248Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-05-29T01:05:28.230248Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"jFkqtEXflDBxZTo6aq/GQNu089LpHdKordnGCsIgIydHmSwcBunQq/O+V30l5OFGqbJoux/8pdvDuRFNneDlAw==","signature_status":"signed_v1","signed_at":"2026-05-29T01:05:28.231343Z","signed_message":"canonical_sha256_bytes"},"source_id":"2605.29269","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:a43e9341fd94a34b825b7395285346cdc6c5bc5f0e96b3a77b5b68f2f85e35e2","sha256:0ec0bb8c3511bc2a9536e940c819343a1196fe080758b4ef657538dc9a26b8c8"],"state_sha256":"b6e81404de6ae69198ca1e01e1ae87366edfc30a3ac76b63c3a01422e03c1b83"}