{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2026:2LR5GM5KZI23MKP6Y7MOQMGW3U","short_pith_number":"pith:2LR5GM5K","canonical_record":{"source":{"id":"2606.05945","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2026-06-04T09:46:25Z","cross_cats_sorted":[],"title_canon_sha256":"a82477db25a39caa3647cbf971f53fcbe6048cb9cbd4cd4e259c52abd4fe0e7e","abstract_canon_sha256":"9b8123f6eb1e1db918ed4c3a2b315195ee198d33983b104c1d5a34d0fa29368e"},"schema_version":"1.0"},"canonical_sha256":"d2e3d333aaca35b629fec7d8e830d6dd3acd096a178ce7958acfb911ae63ebd5","source":{"kind":"arxiv","id":"2606.05945","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2606.05945","created_at":"2026-06-05T01:15:28Z"},{"alias_kind":"arxiv_version","alias_value":"2606.05945v1","created_at":"2026-06-05T01:15:28Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2606.05945","created_at":"2026-06-05T01:15:28Z"},{"alias_kind":"pith_short_12","alias_value":"2LR5GM5KZI23","created_at":"2026-06-05T01:15:28Z"},{"alias_kind":"pith_short_16","alias_value":"2LR5GM5KZI23MKP6","created_at":"2026-06-05T01:15:28Z"},{"alias_kind":"pith_short_8","alias_value":"2LR5GM5K","created_at":"2026-06-05T01:15:28Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2026:2LR5GM5KZI23MKP6Y7MOQMGW3U","target":"record","payload":{"canonical_record":{"source":{"id":"2606.05945","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2026-06-04T09:46:25Z","cross_cats_sorted":[],"title_canon_sha256":"a82477db25a39caa3647cbf971f53fcbe6048cb9cbd4cd4e259c52abd4fe0e7e","abstract_canon_sha256":"9b8123f6eb1e1db918ed4c3a2b315195ee198d33983b104c1d5a34d0fa29368e"},"schema_version":"1.0"},"canonical_sha256":"d2e3d333aaca35b629fec7d8e830d6dd3acd096a178ce7958acfb911ae63ebd5","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-06-05T01:15:28.417051Z","signature_b64":"CYYjAFNYs6lSgyYKoohiAGa452qpgJc9b4fXUykhOH3uIMuPahcC46+ItIOzkAk2hb749EA1da2Z2s4MmGgdAg==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"d2e3d333aaca35b629fec7d8e830d6dd3acd096a178ce7958acfb911ae63ebd5","last_reissued_at":"2026-06-05T01:15:28.416562Z","signature_status":"signed_v1","first_computed_at":"2026-06-05T01:15:28.416562Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2606.05945","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-06-05T01:15:28Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"Ajqo4t3SFjsWpuKzIXU3vcelkprvR++oalcFirep+Hb44xE5aU6eZWfuuAa1dpWE8mTqgBeIumv2OoIJXIsSBw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-06-08T02:59:57.352806Z"},"content_sha256":"eb7158ba0b9f2873cd157292e306f553c1cdc2bd1059f50dce86ed874d61b6b6","schema_version":"1.0","event_id":"sha256:eb7158ba0b9f2873cd157292e306f553c1cdc2bd1059f50dce86ed874d61b6b6"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2026:2LR5GM5KZI23MKP6Y7MOQMGW3U","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Exploring the connection between coding habits and cognitive styles in malware developers","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":[],"primary_cat":"cs.CR","authors_text":"Constantinos Patsakis, Fran Casino, Vasilis Vouvoutsis","submitted_at":"2026-06-04T09:46:25Z","abstract_excerpt":"Malware research primarily studies the results, the methods, and the impact. Even from an offensive security perspective, what is examined is the method, not the development strategy of the offender. This study investigates the behavioral signatures and coding patterns embedded in the malware source code. By analyzing a large corpus of leaked malware code and comparing it with carefully selected benign open-source software, we apply static application security testing and compute multiple software metrics. Based on cognitive psychology and criminological theories, our work interprets differenc"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2606.05945","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2606.05945/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-06-05T01:15:28Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"ZDXhtLyLDlkxEBYV7b5L7W+Spsk1I5bnyRl3WB0JTU0MspP12xbB7r7nQ6l+sRQFx1/1HX7U5kQirJA3DNbMAQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-06-08T02:59:57.353201Z"},"content_sha256":"b9c372527935e4df47e739f2de6a75937227042c05cce8ae017cbb10e2d191fc","schema_version":"1.0","event_id":"sha256:b9c372527935e4df47e739f2de6a75937227042c05cce8ae017cbb10e2d191fc"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/2LR5GM5KZI23MKP6Y7MOQMGW3U/bundle.json","state_url":"https://pith.science/pith/2LR5GM5KZI23MKP6Y7MOQMGW3U/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/2LR5GM5KZI23MKP6Y7MOQMGW3U/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-06-08T02:59:57Z","links":{"resolver":"https://pith.science/pith/2LR5GM5KZI23MKP6Y7MOQMGW3U","bundle":"https://pith.science/pith/2LR5GM5KZI23MKP6Y7MOQMGW3U/bundle.json","state":"https://pith.science/pith/2LR5GM5KZI23MKP6Y7MOQMGW3U/state.json","well_known_bundle":"https://pith.science/.well-known/pith/2LR5GM5KZI23MKP6Y7MOQMGW3U/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2026:2LR5GM5KZI23MKP6Y7MOQMGW3U","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"9b8123f6eb1e1db918ed4c3a2b315195ee198d33983b104c1d5a34d0fa29368e","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2026-06-04T09:46:25Z","title_canon_sha256":"a82477db25a39caa3647cbf971f53fcbe6048cb9cbd4cd4e259c52abd4fe0e7e"},"schema_version":"1.0","source":{"id":"2606.05945","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2606.05945","created_at":"2026-06-05T01:15:28Z"},{"alias_kind":"arxiv_version","alias_value":"2606.05945v1","created_at":"2026-06-05T01:15:28Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2606.05945","created_at":"2026-06-05T01:15:28Z"},{"alias_kind":"pith_short_12","alias_value":"2LR5GM5KZI23","created_at":"2026-06-05T01:15:28Z"},{"alias_kind":"pith_short_16","alias_value":"2LR5GM5KZI23MKP6","created_at":"2026-06-05T01:15:28Z"},{"alias_kind":"pith_short_8","alias_value":"2LR5GM5K","created_at":"2026-06-05T01:15:28Z"}],"graph_snapshots":[{"event_id":"sha256:b9c372527935e4df47e739f2de6a75937227042c05cce8ae017cbb10e2d191fc","target":"graph","created_at":"2026-06-05T01:15:28Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2606.05945/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Malware research primarily studies the results, the methods, and the impact. Even from an offensive security perspective, what is examined is the method, not the development strategy of the offender. This study investigates the behavioral signatures and coding patterns embedded in the malware source code. By analyzing a large corpus of leaked malware code and comparing it with carefully selected benign open-source software, we apply static application security testing and compute multiple software metrics. Based on cognitive psychology and criminological theories, our work interprets differenc","authors_text":"Constantinos Patsakis, Fran Casino, Vasilis Vouvoutsis","cross_cats":[],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2026-06-04T09:46:25Z","title":"Exploring the connection between coding habits and cognitive styles in malware developers"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2606.05945","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:eb7158ba0b9f2873cd157292e306f553c1cdc2bd1059f50dce86ed874d61b6b6","target":"record","created_at":"2026-06-05T01:15:28Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"9b8123f6eb1e1db918ed4c3a2b315195ee198d33983b104c1d5a34d0fa29368e","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2026-06-04T09:46:25Z","title_canon_sha256":"a82477db25a39caa3647cbf971f53fcbe6048cb9cbd4cd4e259c52abd4fe0e7e"},"schema_version":"1.0","source":{"id":"2606.05945","kind":"arxiv","version":1}},"canonical_sha256":"d2e3d333aaca35b629fec7d8e830d6dd3acd096a178ce7958acfb911ae63ebd5","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"d2e3d333aaca35b629fec7d8e830d6dd3acd096a178ce7958acfb911ae63ebd5","first_computed_at":"2026-06-05T01:15:28.416562Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-06-05T01:15:28.416562Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"CYYjAFNYs6lSgyYKoohiAGa452qpgJc9b4fXUykhOH3uIMuPahcC46+ItIOzkAk2hb749EA1da2Z2s4MmGgdAg==","signature_status":"signed_v1","signed_at":"2026-06-05T01:15:28.417051Z","signed_message":"canonical_sha256_bytes"},"source_id":"2606.05945","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:eb7158ba0b9f2873cd157292e306f553c1cdc2bd1059f50dce86ed874d61b6b6","sha256:b9c372527935e4df47e739f2de6a75937227042c05cce8ae017cbb10e2d191fc"],"state_sha256":"7faf1e8ac966b9252dfbdf18b059a4750552a29d5e17e9af1a99f479a7658b32"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"RnjlnbbfztkY0G2XVJrhFzDmAVfufJNnCyrgBvGSxjR5ZKcUZ5UtFal2BuiArTZvSwpxhMeiDXZ8olUfl0qYCg==","signed_message":"bundle_sha256_bytes","signed_at":"2026-06-08T02:59:57.356081Z","bundle_sha256":"0279cfe65530079f4a8de404a3a183397ce19225607f4d63e9840f812575fad4"}}