{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2019:KBUATDLZK2P76TGDWLH77JKFMG","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"53c47ae80ab1e385f2637f0a0fb8fc3891f4f3fc684455afd0d9e512eb9215f6","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2019-09-30T18:56:03Z","title_canon_sha256":"91b735d8920a04b0095842a5c9d67f1cc9a7bae38dea8fdf6586c1bf50e4f7df"},"schema_version":"1.0","source":{"id":"1910.00056","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"1910.00056","created_at":"2026-07-05T00:08:41Z"},{"alias_kind":"arxiv_version","alias_value":"1910.00056v1","created_at":"2026-07-05T00:08:41Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.1910.00056","created_at":"2026-07-05T00:08:41Z"},{"alias_kind":"pith_short_12","alias_value":"KBUATDLZK2P7","created_at":"2026-07-05T00:08:41Z"},{"alias_kind":"pith_short_16","alias_value":"KBUATDLZK2P76TGD","created_at":"2026-07-05T00:08:41Z"},{"alias_kind":"pith_short_8","alias_value":"KBUATDLZ","created_at":"2026-07-05T00:08:41Z"}],"graph_snapshots":[{"event_id":"sha256:b1bc36d713feb23311ff46c5e2d394010272022e826b8b9d66190402c124aec8","target":"graph","created_at":"2026-07-05T00:08:41Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/1910.00056/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Cyber threat intelligence (CTI) is being used to search for indicators of attacks that might have compromised an enterprise network for a long time without being discovered. To have a more effective analysis, CTI open standards have incorporated descriptive relationships showing how the indicators or observables are related to each other. However, these relationships are either completely overlooked in information gathering or not used for threat hunting. In this paper, we propose a system, called POIROT, which uses these correlations to uncover the steps of a successful attack campaign. We us","authors_text":"Birhanu Eshete, Rigel Gjomemo, Sadegh M. Milajerdi, V.N. Venkatakrishnan","cross_cats":[],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2019-09-30T18:56:03Z","title":"POIROT: Aligning Attack Behavior with Kernel Audit Records for Cyber Threat Hunting"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"1910.00056","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:29b05420c7e96745331c94ff81ee686eed2104fb4110d5e1b4a0bc1c4fd9eb92","target":"record","created_at":"2026-07-05T00:08:41Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"53c47ae80ab1e385f2637f0a0fb8fc3891f4f3fc684455afd0d9e512eb9215f6","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2019-09-30T18:56:03Z","title_canon_sha256":"91b735d8920a04b0095842a5c9d67f1cc9a7bae38dea8fdf6586c1bf50e4f7df"},"schema_version":"1.0","source":{"id":"1910.00056","kind":"arxiv","version":1}},"canonical_sha256":"5068098d79569fff4cc3b2cfffa54561ab33ad4e9ebc79782680e0a30fdb9aa7","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"5068098d79569fff4cc3b2cfffa54561ab33ad4e9ebc79782680e0a30fdb9aa7","first_computed_at":"2026-07-05T00:08:41.935341Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T00:08:41.935341Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"xzAWjZyJLRMP5NJOTLFj8n1o+ld+X4/+KK1Kp8eqxKSVOCQplRpiNOsK9S60CevJBHN29kKORgAor/e+zEvcDw==","signature_status":"signed_v1","signed_at":"2026-07-05T00:08:41.935741Z","signed_message":"canonical_sha256_bytes"},"source_id":"1910.00056","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:29b05420c7e96745331c94ff81ee686eed2104fb4110d5e1b4a0bc1c4fd9eb92","sha256:b1bc36d713feb23311ff46c5e2d394010272022e826b8b9d66190402c124aec8"],"state_sha256":"b5f50d99dc48a353e991a6ea317c54692136d1f7ab84ed8f048682e2dc9edd69"}