{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2024:WZJ4IM6ENGKY7QWO6R2MM44F57","short_pith_number":"pith:WZJ4IM6E","canonical_record":{"source":{"id":"2405.02629","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2024-05-04T10:19:28Z","cross_cats_sorted":[],"title_canon_sha256":"6e79b886c5434a390079d9fc4cabf03fc841cac3c63eaf1c8b8e88db5ec24666","abstract_canon_sha256":"e218d16ff5320f19b891e97c42b0121f70ea0b72d977960f1cb51b6e07d60924"},"schema_version":"1.0"},"canonical_sha256":"b653c433c469958fc2cef474c67385efefee6ff17c6d614a4a19ddf9add27e76","source":{"kind":"arxiv","id":"2405.02629","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2405.02629","created_at":"2026-07-05T08:15:51Z"},{"alias_kind":"arxiv_version","alias_value":"2405.02629v1","created_at":"2026-07-05T08:15:51Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2405.02629","created_at":"2026-07-05T08:15:51Z"},{"alias_kind":"pith_short_12","alias_value":"WZJ4IM6ENGKY","created_at":"2026-07-05T08:15:51Z"},{"alias_kind":"pith_short_16","alias_value":"WZJ4IM6ENGKY7QWO","created_at":"2026-07-05T08:15:51Z"},{"alias_kind":"pith_short_8","alias_value":"WZJ4IM6E","created_at":"2026-07-05T08:15:51Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2024:WZJ4IM6ENGKY7QWO6R2MM44F57","target":"record","payload":{"canonical_record":{"source":{"id":"2405.02629","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2024-05-04T10:19:28Z","cross_cats_sorted":[],"title_canon_sha256":"6e79b886c5434a390079d9fc4cabf03fc841cac3c63eaf1c8b8e88db5ec24666","abstract_canon_sha256":"e218d16ff5320f19b891e97c42b0121f70ea0b72d977960f1cb51b6e07d60924"},"schema_version":"1.0"},"canonical_sha256":"b653c433c469958fc2cef474c67385efefee6ff17c6d614a4a19ddf9add27e76","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T08:15:51.334724Z","signature_b64":"icZJgo5qZ0vFgRcxL2lc7RuD9342utveD+EYH5eS0oABCCgs8r/yT0kNM2yXvu50qfYfiyCcs6GQtFnr1bSzDQ==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"b653c433c469958fc2cef474c67385efefee6ff17c6d614a4a19ddf9add27e76","last_reissued_at":"2026-07-05T08:15:51.333880Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T08:15:51.333880Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2405.02629","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T08:15:51Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"J5IPeT3ChBC1XMCTsiytH7kk37nWURTfS7zcrNK1JTmIYZzkSWBMmSGfOqL7Si/X64P8hbwTRWQG0Dx+ZIuFBA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-15T05:22:52.470224Z"},"content_sha256":"52ac7fe4781392a93b4a00e9fe7c0a2524c464deefd3f397cfabeb0f513d73d0","schema_version":"1.0","event_id":"sha256:52ac7fe4781392a93b4a00e9fe7c0a2524c464deefd3f397cfabeb0f513d73d0"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2024:WZJ4IM6ENGKY7QWO6R2MM44F57","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"SPARSE: Semantic Tracking and Path Analysis for Attack Investigation in Real-time","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":[],"primary_cat":"cs.CR","authors_text":"Chunlin Xiong, Jie Ying, Mingjun Ma, Mingqi Lv, Qixuan Yuan, Tiantian Zhu, Tieming Chen, Wenrui Cheng, Yan Chen","submitted_at":"2024-05-04T10:19:28Z","abstract_excerpt":"As the complexity and destructiveness of Advanced Persistent Threat (APT) increase, there is a growing tendency to identify a series of actions undertaken to achieve the attacker's target, called attack investigation. Currently, analysts construct the provenance graph to perform causality analysis on Point-Of-Interest (POI) event for capturing critical events (related to the attack). However, due to the vast size of the provenance graph and the rarity of critical events, existing attack investigation methods suffer from problems of high false positives, high overhead, and high latency. To this"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2405.02629","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2405.02629/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T08:15:51Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"PPMl8mDBiiLLB5/5MvDNg34MjpxQAulaqc8R8uabYe3bCn5R4MVGgYCeY42gfSwROwzvPm28iVq2RI3dhgmzDg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-15T05:22:52.470736Z"},"content_sha256":"25ea84bce141d68862d6bb57aece91b462de2daff0e446f8044d7f2c459bfb2a","schema_version":"1.0","event_id":"sha256:25ea84bce141d68862d6bb57aece91b462de2daff0e446f8044d7f2c459bfb2a"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/WZJ4IM6ENGKY7QWO6R2MM44F57/bundle.json","state_url":"https://pith.science/pith/WZJ4IM6ENGKY7QWO6R2MM44F57/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/WZJ4IM6ENGKY7QWO6R2MM44F57/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-15T05:22:52Z","links":{"resolver":"https://pith.science/pith/WZJ4IM6ENGKY7QWO6R2MM44F57","bundle":"https://pith.science/pith/WZJ4IM6ENGKY7QWO6R2MM44F57/bundle.json","state":"https://pith.science/pith/WZJ4IM6ENGKY7QWO6R2MM44F57/state.json","well_known_bundle":"https://pith.science/.well-known/pith/WZJ4IM6ENGKY7QWO6R2MM44F57/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2024:WZJ4IM6ENGKY7QWO6R2MM44F57","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"e218d16ff5320f19b891e97c42b0121f70ea0b72d977960f1cb51b6e07d60924","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2024-05-04T10:19:28Z","title_canon_sha256":"6e79b886c5434a390079d9fc4cabf03fc841cac3c63eaf1c8b8e88db5ec24666"},"schema_version":"1.0","source":{"id":"2405.02629","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2405.02629","created_at":"2026-07-05T08:15:51Z"},{"alias_kind":"arxiv_version","alias_value":"2405.02629v1","created_at":"2026-07-05T08:15:51Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2405.02629","created_at":"2026-07-05T08:15:51Z"},{"alias_kind":"pith_short_12","alias_value":"WZJ4IM6ENGKY","created_at":"2026-07-05T08:15:51Z"},{"alias_kind":"pith_short_16","alias_value":"WZJ4IM6ENGKY7QWO","created_at":"2026-07-05T08:15:51Z"},{"alias_kind":"pith_short_8","alias_value":"WZJ4IM6E","created_at":"2026-07-05T08:15:51Z"}],"graph_snapshots":[{"event_id":"sha256:25ea84bce141d68862d6bb57aece91b462de2daff0e446f8044d7f2c459bfb2a","target":"graph","created_at":"2026-07-05T08:15:51Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2405.02629/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"As the complexity and destructiveness of Advanced Persistent Threat (APT) increase, there is a growing tendency to identify a series of actions undertaken to achieve the attacker's target, called attack investigation. Currently, analysts construct the provenance graph to perform causality analysis on Point-Of-Interest (POI) event for capturing critical events (related to the attack). However, due to the vast size of the provenance graph and the rarity of critical events, existing attack investigation methods suffer from problems of high false positives, high overhead, and high latency. To this","authors_text":"Chunlin Xiong, Jie Ying, Mingjun Ma, Mingqi Lv, Qixuan Yuan, Tiantian Zhu, Tieming Chen, Wenrui Cheng, Yan Chen","cross_cats":[],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2024-05-04T10:19:28Z","title":"SPARSE: Semantic Tracking and Path Analysis for Attack Investigation in Real-time"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2405.02629","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:52ac7fe4781392a93b4a00e9fe7c0a2524c464deefd3f397cfabeb0f513d73d0","target":"record","created_at":"2026-07-05T08:15:51Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"e218d16ff5320f19b891e97c42b0121f70ea0b72d977960f1cb51b6e07d60924","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2024-05-04T10:19:28Z","title_canon_sha256":"6e79b886c5434a390079d9fc4cabf03fc841cac3c63eaf1c8b8e88db5ec24666"},"schema_version":"1.0","source":{"id":"2405.02629","kind":"arxiv","version":1}},"canonical_sha256":"b653c433c469958fc2cef474c67385efefee6ff17c6d614a4a19ddf9add27e76","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"b653c433c469958fc2cef474c67385efefee6ff17c6d614a4a19ddf9add27e76","first_computed_at":"2026-07-05T08:15:51.333880Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T08:15:51.333880Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"icZJgo5qZ0vFgRcxL2lc7RuD9342utveD+EYH5eS0oABCCgs8r/yT0kNM2yXvu50qfYfiyCcs6GQtFnr1bSzDQ==","signature_status":"signed_v1","signed_at":"2026-07-05T08:15:51.334724Z","signed_message":"canonical_sha256_bytes"},"source_id":"2405.02629","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:52ac7fe4781392a93b4a00e9fe7c0a2524c464deefd3f397cfabeb0f513d73d0","sha256:25ea84bce141d68862d6bb57aece91b462de2daff0e446f8044d7f2c459bfb2a"],"state_sha256":"536c471b51e7f32aa5c0323b663cfb24b08750a6bca30b3d527b951ef730a312"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"4roe8p3SFRzDajXLIfetDPRSN+3D/jZDR7GPeQLYC2pgOD8s1gRFCeAA0kVxlPXuP+rQLzZv03K8fWkbUVKODQ==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-15T05:22:52.474590Z","bundle_sha256":"8468604b5872667b87a8c53481cee04fa7320fad825b5cc54f7d8fa751d02fbf"}}