{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2019:ODR6WWAZGHGJZXLBCFA6WGFC2C","short_pith_number":"pith:ODR6WWAZ","canonical_record":{"source":{"id":"1903.06661","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.LG","submitted_at":"2019-03-15T16:58:34Z","cross_cats_sorted":["stat.ML"],"title_canon_sha256":"cb8a1bbd32ddc6cb847b5e37a1ce8313c3ad1e9c9e390ab8ca8c0da9830b5d0b","abstract_canon_sha256":"6650908b42d7dc31ee78dbc5df3c1b61d1180419554c058bf319dff4eb609d45"},"schema_version":"1.0"},"canonical_sha256":"70e3eb581931cc9cdd611141eb18a2d098170c8d47866f0645941cf1da5602aa","source":{"kind":"arxiv","id":"1903.06661","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"1903.06661","created_at":"2026-05-17T23:51:10Z"},{"alias_kind":"arxiv_version","alias_value":"1903.06661v1","created_at":"2026-05-17T23:51:10Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.1903.06661","created_at":"2026-05-17T23:51:10Z"},{"alias_kind":"pith_short_12","alias_value":"ODR6WWAZGHGJ","created_at":"2026-05-18T12:33:24Z"},{"alias_kind":"pith_short_16","alias_value":"ODR6WWAZGHGJZXLB","created_at":"2026-05-18T12:33:24Z"},{"alias_kind":"pith_short_8","alias_value":"ODR6WWAZ","created_at":"2026-05-18T12:33:24Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2019:ODR6WWAZGHGJZXLBCFA6WGFC2C","target":"record","payload":{"canonical_record":{"source":{"id":"1903.06661","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.LG","submitted_at":"2019-03-15T16:58:34Z","cross_cats_sorted":["stat.ML"],"title_canon_sha256":"cb8a1bbd32ddc6cb847b5e37a1ce8313c3ad1e9c9e390ab8ca8c0da9830b5d0b","abstract_canon_sha256":"6650908b42d7dc31ee78dbc5df3c1b61d1180419554c058bf319dff4eb609d45"},"schema_version":"1.0"},"canonical_sha256":"70e3eb581931cc9cdd611141eb18a2d098170c8d47866f0645941cf1da5602aa","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-05-17T23:51:10.176928Z","signature_b64":"uGrJm5KK1tTaNY/1+3m37HlEzCsql8JkzHWF9EDyhgq0IgAksBLntM5DD/tU8vPHNPQha+GXE0tUrRaz4nTgAg==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"70e3eb581931cc9cdd611141eb18a2d098170c8d47866f0645941cf1da5602aa","last_reissued_at":"2026-05-17T23:51:10.176367Z","signature_status":"signed_v1","first_computed_at":"2026-05-17T23:51:10.176367Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"1903.06661","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-05-17T23:51:10Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"F5Hd34Y/zf+4lLgZ31ft57z+OrVBK/EpNcieY319wHMzmqiIodXLvV5Jriqqe7nnuHMLNDtHGJZQPWu5vJgQCQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-06-24T00:19:18.749704Z"},"content_sha256":"a6e34666bad063d1278274658b5db2c3c1c019eb6705d9452da741dec2ac726e","schema_version":"1.0","event_id":"sha256:a6e34666bad063d1278274658b5db2c3c1c019eb6705d9452da741dec2ac726e"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2019:ODR6WWAZGHGJZXLBCFA6WGFC2C","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"GEE: A Gradient-based Explainable Variational Autoencoder for Network Anomaly Detection","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":["stat.ML"],"primary_cat":"cs.LG","authors_text":"Dinil Mon Divakaran, Kar Wai Lim, Kian Hsiang Low, Mun Choon Chan, Quoc Phong Nguyen","submitted_at":"2019-03-15T16:58:34Z","abstract_excerpt":"This paper looks into the problem of detecting network anomalies by analyzing NetFlow records. While many previous works have used statistical models and machine learning techniques in a supervised way, such solutions have the limitations that they require large amount of labeled data for training and are unlikely to detect zero-day attacks. Existing anomaly detection solutions also do not provide an easy way to explain or identify attacks in the anomalous traffic. To address these limitations, we develop and present GEE, a framework for detecting and explaining anomalies in network traffic. G"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"1903.06661","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-05-17T23:51:10Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"YlsMH8MbMe5BZa1fFJLXauBDa5ta+M+vyaMRsvRAZEEiFMG+eh/rI3wQFKmyEyHKKYP4z7vTyKIyEwuD0fZZAg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-06-24T00:19:18.750060Z"},"content_sha256":"a3bf5e5346a29220df7deb2cc239cbff78ff8fc5b53c1e824c570cbe46998527","schema_version":"1.0","event_id":"sha256:a3bf5e5346a29220df7deb2cc239cbff78ff8fc5b53c1e824c570cbe46998527"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/ODR6WWAZGHGJZXLBCFA6WGFC2C/bundle.json","state_url":"https://pith.science/pith/ODR6WWAZGHGJZXLBCFA6WGFC2C/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/ODR6WWAZGHGJZXLBCFA6WGFC2C/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-06-24T00:19:18Z","links":{"resolver":"https://pith.science/pith/ODR6WWAZGHGJZXLBCFA6WGFC2C","bundle":"https://pith.science/pith/ODR6WWAZGHGJZXLBCFA6WGFC2C/bundle.json","state":"https://pith.science/pith/ODR6WWAZGHGJZXLBCFA6WGFC2C/state.json","well_known_bundle":"https://pith.science/.well-known/pith/ODR6WWAZGHGJZXLBCFA6WGFC2C/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2019:ODR6WWAZGHGJZXLBCFA6WGFC2C","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"6650908b42d7dc31ee78dbc5df3c1b61d1180419554c058bf319dff4eb609d45","cross_cats_sorted":["stat.ML"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.LG","submitted_at":"2019-03-15T16:58:34Z","title_canon_sha256":"cb8a1bbd32ddc6cb847b5e37a1ce8313c3ad1e9c9e390ab8ca8c0da9830b5d0b"},"schema_version":"1.0","source":{"id":"1903.06661","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"1903.06661","created_at":"2026-05-17T23:51:10Z"},{"alias_kind":"arxiv_version","alias_value":"1903.06661v1","created_at":"2026-05-17T23:51:10Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.1903.06661","created_at":"2026-05-17T23:51:10Z"},{"alias_kind":"pith_short_12","alias_value":"ODR6WWAZGHGJ","created_at":"2026-05-18T12:33:24Z"},{"alias_kind":"pith_short_16","alias_value":"ODR6WWAZGHGJZXLB","created_at":"2026-05-18T12:33:24Z"},{"alias_kind":"pith_short_8","alias_value":"ODR6WWAZ","created_at":"2026-05-18T12:33:24Z"}],"graph_snapshots":[{"event_id":"sha256:a3bf5e5346a29220df7deb2cc239cbff78ff8fc5b53c1e824c570cbe46998527","target":"graph","created_at":"2026-05-17T23:51:10Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"paper":{"abstract_excerpt":"This paper looks into the problem of detecting network anomalies by analyzing NetFlow records. While many previous works have used statistical models and machine learning techniques in a supervised way, such solutions have the limitations that they require large amount of labeled data for training and are unlikely to detect zero-day attacks. Existing anomaly detection solutions also do not provide an easy way to explain or identify attacks in the anomalous traffic. To address these limitations, we develop and present GEE, a framework for detecting and explaining anomalies in network traffic. G","authors_text":"Dinil Mon Divakaran, Kar Wai Lim, Kian Hsiang Low, Mun Choon Chan, Quoc Phong Nguyen","cross_cats":["stat.ML"],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.LG","submitted_at":"2019-03-15T16:58:34Z","title":"GEE: A Gradient-based Explainable Variational Autoencoder for Network Anomaly Detection"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"1903.06661","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:a6e34666bad063d1278274658b5db2c3c1c019eb6705d9452da741dec2ac726e","target":"record","created_at":"2026-05-17T23:51:10Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"6650908b42d7dc31ee78dbc5df3c1b61d1180419554c058bf319dff4eb609d45","cross_cats_sorted":["stat.ML"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.LG","submitted_at":"2019-03-15T16:58:34Z","title_canon_sha256":"cb8a1bbd32ddc6cb847b5e37a1ce8313c3ad1e9c9e390ab8ca8c0da9830b5d0b"},"schema_version":"1.0","source":{"id":"1903.06661","kind":"arxiv","version":1}},"canonical_sha256":"70e3eb581931cc9cdd611141eb18a2d098170c8d47866f0645941cf1da5602aa","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"70e3eb581931cc9cdd611141eb18a2d098170c8d47866f0645941cf1da5602aa","first_computed_at":"2026-05-17T23:51:10.176367Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-05-17T23:51:10.176367Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"uGrJm5KK1tTaNY/1+3m37HlEzCsql8JkzHWF9EDyhgq0IgAksBLntM5DD/tU8vPHNPQha+GXE0tUrRaz4nTgAg==","signature_status":"signed_v1","signed_at":"2026-05-17T23:51:10.176928Z","signed_message":"canonical_sha256_bytes"},"source_id":"1903.06661","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:a6e34666bad063d1278274658b5db2c3c1c019eb6705d9452da741dec2ac726e","sha256:a3bf5e5346a29220df7deb2cc239cbff78ff8fc5b53c1e824c570cbe46998527"],"state_sha256":"dfa634a907eb3e856ee80c24d7d7510352416c1643690fd5a7f3dc15011b737f"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"PP1BVj4AFfB/xb/iLAemqVk6wefl+TTkL79Hj+mn9TAUQJ0Ka+Bw/FhoGKHoC6LmP3Z07DzG5FcUfKI6OyYmDA==","signed_message":"bundle_sha256_bytes","signed_at":"2026-06-24T00:19:18.752083Z","bundle_sha256":"762eb04eea142950af2804db807db569e5fb35d3411b7f5397b05bcb4f7e0552"}}