{"record_type":"pith_number_record","schema_url":"https://pith.science/schemas/pith-number/v1.json","pith_number":"pith:2026:IEMA4UCOLDGOY5J2GODI7PVNMF","short_pith_number":"pith:IEMA4UCO","schema_version":"1.0","canonical_sha256":"41180e504e58ccec753a33868fbead6161d50fb4107f2a7464b7f38d82897756","source":{"kind":"arxiv","id":"2606.27966","version":1},"attestation_state":"computed","paper":{"title":"Decoys Cannot Go Everywhere: Mapping the Deception Surface in MITRE ATT&CK","license":"http://creativecommons.org/licenses/by-nc-sa/4.0/","headline":"","cross_cats":[],"primary_cat":"cs.CR","authors_text":"Carlos Catania, Harm Griffioen, Veronica Valeros, Viliam Lis\\'y","submitted_at":"2026-06-26T11:11:02Z","abstract_excerpt":"Cyber deception research often assumes that a decoy can be placed wherever there is attacker behavior. This work tests that assumption across MITRE ATT&CK v18.1. We introduce a four-criterion rubric for infrastructure deception and apply it to all 250 ATT&CK techniques. The rubric evaluates whether a defender-controlled decoy can be placed, whether an attacker is likely to interact with it, what intelligence that interaction can yield, and whether the interaction reliably indicates malice. The resulting deception surface is sparse: only 80 techniques (32%) admit a decoy the attacker could plau"},"verification_status":{"content_addressed":true,"pith_receipt":true,"author_attested":false,"weak_author_claims":0,"strong_author_claims":0,"externally_anchored":false,"storage_verified":false,"citation_signatures":0,"replication_records":0,"graph_snapshot":true,"references_resolved":false,"formal_links_present":false},"canonical_record":{"source":{"id":"2606.27966","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by-nc-sa/4.0/","primary_cat":"cs.CR","submitted_at":"2026-06-26T11:11:02Z","cross_cats_sorted":[],"title_canon_sha256":"4edef9d4f093eb9694b7b958a53b7b03f7b2bb82370b05c00edf63e68eaf9626","abstract_canon_sha256":"b9374912607741f7e730ed90dadabeebb679bdfe0e97d77772cfd60f2af33056"},"schema_version":"1.0"},"receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-06-29T01:14:54.046882Z","signature_b64":"fxhNtJzJdDjfFxJFANs71taZTg0RxVbpC+nKyfs3xSck32fR8IFZZFu88XFcVxVQKeoFo9MEiMEF2rzVkfvfBA==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"41180e504e58ccec753a33868fbead6161d50fb4107f2a7464b7f38d82897756","last_reissued_at":"2026-06-29T01:14:54.046440Z","signature_status":"signed_v1","first_computed_at":"2026-06-29T01:14:54.046440Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"graph_snapshot":{"paper":{"title":"Decoys Cannot Go Everywhere: Mapping the Deception Surface in MITRE ATT&CK","license":"http://creativecommons.org/licenses/by-nc-sa/4.0/","headline":"","cross_cats":[],"primary_cat":"cs.CR","authors_text":"Carlos Catania, Harm Griffioen, Veronica Valeros, Viliam Lis\\'y","submitted_at":"2026-06-26T11:11:02Z","abstract_excerpt":"Cyber deception research often assumes that a decoy can be placed wherever there is attacker behavior. This work tests that assumption across MITRE ATT&CK v18.1. We introduce a four-criterion rubric for infrastructure deception and apply it to all 250 ATT&CK techniques. The rubric evaluates whether a defender-controlled decoy can be placed, whether an attacker is likely to interact with it, what intelligence that interaction can yield, and whether the interaction reliably indicates malice. The resulting deception surface is sparse: only 80 techniques (32%) admit a decoy the attacker could plau"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2606.27966","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2606.27966/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"aliases":[{"alias_kind":"arxiv","alias_value":"2606.27966","created_at":"2026-06-29T01:14:54.046499+00:00"},{"alias_kind":"arxiv_version","alias_value":"2606.27966v1","created_at":"2026-06-29T01:14:54.046499+00:00"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2606.27966","created_at":"2026-06-29T01:14:54.046499+00:00"},{"alias_kind":"pith_short_12","alias_value":"IEMA4UCOLDGO","created_at":"2026-06-29T01:14:54.046499+00:00"},{"alias_kind":"pith_short_16","alias_value":"IEMA4UCOLDGOY5J2","created_at":"2026-06-29T01:14:54.046499+00:00"},{"alias_kind":"pith_short_8","alias_value":"IEMA4UCO","created_at":"2026-06-29T01:14:54.046499+00:00"}],"events":[],"event_summary":{},"paper_claims":[],"inbound_citations":{"count":0,"internal_anchor_count":0,"sample":[]},"formal_canon":{"evidence_count":0,"sample":[],"anchors":[]},"links":{"html":"https://pith.science/pith/IEMA4UCOLDGOY5J2GODI7PVNMF","json":"https://pith.science/pith/IEMA4UCOLDGOY5J2GODI7PVNMF.json","graph_json":"https://pith.science/api/pith-number/IEMA4UCOLDGOY5J2GODI7PVNMF/graph.json","events_json":"https://pith.science/api/pith-number/IEMA4UCOLDGOY5J2GODI7PVNMF/events.json","paper":"https://pith.science/paper/IEMA4UCO"},"agent_actions":{"view_html":"https://pith.science/pith/IEMA4UCOLDGOY5J2GODI7PVNMF","download_json":"https://pith.science/pith/IEMA4UCOLDGOY5J2GODI7PVNMF.json","view_paper":"https://pith.science/paper/IEMA4UCO","resolve_alias":"https://pith.science/api/pith-number/resolve?arxiv=2606.27966&json=true","fetch_graph":"https://pith.science/api/pith-number/IEMA4UCOLDGOY5J2GODI7PVNMF/graph.json","fetch_events":"https://pith.science/api/pith-number/IEMA4UCOLDGOY5J2GODI7PVNMF/events.json","actions":{"anchor_timestamp":"https://pith.science/pith/IEMA4UCOLDGOY5J2GODI7PVNMF/action/timestamp_anchor","attest_storage":"https://pith.science/pith/IEMA4UCOLDGOY5J2GODI7PVNMF/action/storage_attestation","attest_author":"https://pith.science/pith/IEMA4UCOLDGOY5J2GODI7PVNMF/action/author_attestation","sign_citation":"https://pith.science/pith/IEMA4UCOLDGOY5J2GODI7PVNMF/action/citation_signature","submit_replication":"https://pith.science/pith/IEMA4UCOLDGOY5J2GODI7PVNMF/action/replication_record"}},"created_at":"2026-06-29T01:14:54.046499+00:00","updated_at":"2026-06-29T01:14:54.046499+00:00"}