{"record_type":"pith_number_record","schema_url":"https://pith.science/schemas/pith-number/v1.json","pith_number":"pith:2024:WZJ4IM6ENGKY7QWO6R2MM44F57","short_pith_number":"pith:WZJ4IM6E","schema_version":"1.0","canonical_sha256":"b653c433c469958fc2cef474c67385efefee6ff17c6d614a4a19ddf9add27e76","source":{"kind":"arxiv","id":"2405.02629","version":1},"attestation_state":"computed","paper":{"title":"SPARSE: Semantic Tracking and Path Analysis for Attack Investigation in Real-time","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":[],"primary_cat":"cs.CR","authors_text":"Chunlin Xiong, Jie Ying, Mingjun Ma, Mingqi Lv, Qixuan Yuan, Tiantian Zhu, Tieming Chen, Wenrui Cheng, Yan Chen","submitted_at":"2024-05-04T10:19:28Z","abstract_excerpt":"As the complexity and destructiveness of Advanced Persistent Threat (APT) increase, there is a growing tendency to identify a series of actions undertaken to achieve the attacker's target, called attack investigation. Currently, analysts construct the provenance graph to perform causality analysis on Point-Of-Interest (POI) event for capturing critical events (related to the attack). However, due to the vast size of the provenance graph and the rarity of critical events, existing attack investigation methods suffer from problems of high false positives, high overhead, and high latency. To this"},"verification_status":{"content_addressed":true,"pith_receipt":true,"author_attested":false,"weak_author_claims":0,"strong_author_claims":0,"externally_anchored":false,"storage_verified":false,"citation_signatures":0,"replication_records":0,"graph_snapshot":true,"references_resolved":false,"formal_links_present":false},"canonical_record":{"source":{"id":"2405.02629","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2024-05-04T10:19:28Z","cross_cats_sorted":[],"title_canon_sha256":"6e79b886c5434a390079d9fc4cabf03fc841cac3c63eaf1c8b8e88db5ec24666","abstract_canon_sha256":"e218d16ff5320f19b891e97c42b0121f70ea0b72d977960f1cb51b6e07d60924"},"schema_version":"1.0"},"receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T08:15:51.334724Z","signature_b64":"icZJgo5qZ0vFgRcxL2lc7RuD9342utveD+EYH5eS0oABCCgs8r/yT0kNM2yXvu50qfYfiyCcs6GQtFnr1bSzDQ==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"b653c433c469958fc2cef474c67385efefee6ff17c6d614a4a19ddf9add27e76","last_reissued_at":"2026-07-05T08:15:51.333880Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T08:15:51.333880Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"graph_snapshot":{"paper":{"title":"SPARSE: Semantic Tracking and Path Analysis for Attack Investigation in Real-time","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":[],"primary_cat":"cs.CR","authors_text":"Chunlin Xiong, Jie Ying, Mingjun Ma, Mingqi Lv, Qixuan Yuan, Tiantian Zhu, Tieming Chen, Wenrui Cheng, Yan Chen","submitted_at":"2024-05-04T10:19:28Z","abstract_excerpt":"As the complexity and destructiveness of Advanced Persistent Threat (APT) increase, there is a growing tendency to identify a series of actions undertaken to achieve the attacker's target, called attack investigation. Currently, analysts construct the provenance graph to perform causality analysis on Point-Of-Interest (POI) event for capturing critical events (related to the attack). However, due to the vast size of the provenance graph and the rarity of critical events, existing attack investigation methods suffer from problems of high false positives, high overhead, and high latency. To this"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2405.02629","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2405.02629/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"aliases":[{"alias_kind":"arxiv","alias_value":"2405.02629","created_at":"2026-07-05T08:15:51.334091+00:00"},{"alias_kind":"arxiv_version","alias_value":"2405.02629v1","created_at":"2026-07-05T08:15:51.334091+00:00"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2405.02629","created_at":"2026-07-05T08:15:51.334091+00:00"},{"alias_kind":"pith_short_12","alias_value":"WZJ4IM6ENGKY","created_at":"2026-07-05T08:15:51.334091+00:00"},{"alias_kind":"pith_short_16","alias_value":"WZJ4IM6ENGKY7QWO","created_at":"2026-07-05T08:15:51.334091+00:00"},{"alias_kind":"pith_short_8","alias_value":"WZJ4IM6E","created_at":"2026-07-05T08:15:51.334091+00:00"}],"events":[],"event_summary":{},"paper_claims":[],"inbound_citations":{"count":0,"internal_anchor_count":0,"sample":[]},"formal_canon":{"evidence_count":0,"sample":[],"anchors":[]},"links":{"html":"https://pith.science/pith/WZJ4IM6ENGKY7QWO6R2MM44F57","json":"https://pith.science/pith/WZJ4IM6ENGKY7QWO6R2MM44F57.json","graph_json":"https://pith.science/api/pith-number/WZJ4IM6ENGKY7QWO6R2MM44F57/graph.json","events_json":"https://pith.science/api/pith-number/WZJ4IM6ENGKY7QWO6R2MM44F57/events.json","paper":"https://pith.science/paper/WZJ4IM6E"},"agent_actions":{"view_html":"https://pith.science/pith/WZJ4IM6ENGKY7QWO6R2MM44F57","download_json":"https://pith.science/pith/WZJ4IM6ENGKY7QWO6R2MM44F57.json","view_paper":"https://pith.science/paper/WZJ4IM6E","resolve_alias":"https://pith.science/api/pith-number/resolve?arxiv=2405.02629&json=true","fetch_graph":"https://pith.science/api/pith-number/WZJ4IM6ENGKY7QWO6R2MM44F57/graph.json","fetch_events":"https://pith.science/api/pith-number/WZJ4IM6ENGKY7QWO6R2MM44F57/events.json","actions":{"anchor_timestamp":"https://pith.science/pith/WZJ4IM6ENGKY7QWO6R2MM44F57/action/timestamp_anchor","attest_storage":"https://pith.science/pith/WZJ4IM6ENGKY7QWO6R2MM44F57/action/storage_attestation","attest_author":"https://pith.science/pith/WZJ4IM6ENGKY7QWO6R2MM44F57/action/author_attestation","sign_citation":"https://pith.science/pith/WZJ4IM6ENGKY7QWO6R2MM44F57/action/citation_signature","submit_replication":"https://pith.science/pith/WZJ4IM6ENGKY7QWO6R2MM44F57/action/replication_record"}},"created_at":"2026-07-05T08:15:51.334091+00:00","updated_at":"2026-07-05T08:15:51.334091+00:00"}