{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2023:32WPP4DB4MVHWU67YN4XJ6OJ5W","short_pith_number":"pith:32WPP4DB","canonical_record":{"source":{"id":"2305.04026","kind":"arxiv","version":3},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.SE","submitted_at":"2023-05-06T12:26:56Z","cross_cats_sorted":["cs.CR"],"title_canon_sha256":"9946068a3c16d7ac11d89d78f97926ab796b95e40ad94a4146250cbd8a1736b4","abstract_canon_sha256":"8bdcc5d8d406fbfb2d5698ca720cc334f400e350b1fc9754e23896df01a7f217"},"schema_version":"1.0"},"canonical_sha256":"deacf7f061e32a7b53dfc37974f9c9ed99202b59650bedb33731b23fee90d400","source":{"kind":"arxiv","id":"2305.04026","version":3},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2305.04026","created_at":"2026-07-05T06:49:42Z"},{"alias_kind":"arxiv_version","alias_value":"2305.04026v3","created_at":"2026-07-05T06:49:42Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2305.04026","created_at":"2026-07-05T06:49:42Z"},{"alias_kind":"pith_short_12","alias_value":"32WPP4DB4MVH","created_at":"2026-07-05T06:49:42Z"},{"alias_kind":"pith_short_16","alias_value":"32WPP4DB4MVHWU67","created_at":"2026-07-05T06:49:42Z"},{"alias_kind":"pith_short_8","alias_value":"32WPP4DB","created_at":"2026-07-05T06:49:42Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2023:32WPP4DB4MVHWU67YN4XJ6OJ5W","target":"record","payload":{"canonical_record":{"source":{"id":"2305.04026","kind":"arxiv","version":3},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.SE","submitted_at":"2023-05-06T12:26:56Z","cross_cats_sorted":["cs.CR"],"title_canon_sha256":"9946068a3c16d7ac11d89d78f97926ab796b95e40ad94a4146250cbd8a1736b4","abstract_canon_sha256":"8bdcc5d8d406fbfb2d5698ca720cc334f400e350b1fc9754e23896df01a7f217"},"schema_version":"1.0"},"canonical_sha256":"deacf7f061e32a7b53dfc37974f9c9ed99202b59650bedb33731b23fee90d400","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T06:49:42.559846Z","signature_b64":"G8FHNLJbAdOUwQq+FVcojHki/hb4UVYoEiirkNRUxOYIDZLQnswUjYH1xic9Ikf/3w6JrFCTLGBmNNUpSBDFDg==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"deacf7f061e32a7b53dfc37974f9c9ed99202b59650bedb33731b23fee90d400","last_reissued_at":"2026-07-05T06:49:42.559430Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T06:49:42.559430Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2305.04026","source_version":3,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T06:49:42Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"Do8B4p7i2QrONMSQ/ida2h0ZOiKLZQ+uCFM/0eudhcRyfiPjB6rG685fF8xtyzdtGeAOhUDVZlDOo/PlOCvlDQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-07-07T11:18:17.267014Z"},"content_sha256":"4d9e03f5af2c4a5a8db68701200ddcf3adb751eb8faa6442413fd919bb698b07","schema_version":"1.0","event_id":"sha256:4d9e03f5af2c4a5a8db68701200ddcf3adb751eb8faa6442413fd919bb698b07"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2023:32WPP4DB4MVHWU67YN4XJ6OJ5W","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"LibAM: An Area Matching Framework for Detecting Third-party Libraries in Binaries","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":["cs.CR"],"primary_cat":"cs.SE","authors_text":"Chaopeng Dong, Hao Sun, Hong Li, Hongsong Zhu, Limin Sun, Shouguo Yang, Siyuan Li, Weijie Wang, Yongpan Wang, Zhe Lang, Zuxin Chen","submitted_at":"2023-05-06T12:26:56Z","abstract_excerpt":"Third-party libraries (TPLs) are extensively utilized by developers to expedite the software development process and incorporate external functionalities. Nevertheless, insecure TPL reuse can lead to significant security risks. Existing methods are employed to determine the presence of TPL code in the target binary. Existing methods, which involve extracting strings or conducting function matching, are employed to determine the presence of TPL code in the target binary. However, these methods often yield unsatisfactory results due to the recurrence of strings and the presence of numerous simil"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2305.04026","kind":"arxiv","version":3},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2305.04026/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T06:49:42Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"rL08gefN5BwO/6XeskiDmhk3k8Hx/CQPLnBuRKnnoeIImq/rPcoypetbjtpnyFEjCne+xyOHm7PRdlUjB+drCQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-07-07T11:18:17.267408Z"},"content_sha256":"ca148236220a726554ca31e1e5e60a1acae3df2535f4f32f8e977a914f638a21","schema_version":"1.0","event_id":"sha256:ca148236220a726554ca31e1e5e60a1acae3df2535f4f32f8e977a914f638a21"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/32WPP4DB4MVHWU67YN4XJ6OJ5W/bundle.json","state_url":"https://pith.science/pith/32WPP4DB4MVHWU67YN4XJ6OJ5W/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/32WPP4DB4MVHWU67YN4XJ6OJ5W/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-07-07T11:18:17Z","links":{"resolver":"https://pith.science/pith/32WPP4DB4MVHWU67YN4XJ6OJ5W","bundle":"https://pith.science/pith/32WPP4DB4MVHWU67YN4XJ6OJ5W/bundle.json","state":"https://pith.science/pith/32WPP4DB4MVHWU67YN4XJ6OJ5W/state.json","well_known_bundle":"https://pith.science/.well-known/pith/32WPP4DB4MVHWU67YN4XJ6OJ5W/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2023:32WPP4DB4MVHWU67YN4XJ6OJ5W","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"8bdcc5d8d406fbfb2d5698ca720cc334f400e350b1fc9754e23896df01a7f217","cross_cats_sorted":["cs.CR"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.SE","submitted_at":"2023-05-06T12:26:56Z","title_canon_sha256":"9946068a3c16d7ac11d89d78f97926ab796b95e40ad94a4146250cbd8a1736b4"},"schema_version":"1.0","source":{"id":"2305.04026","kind":"arxiv","version":3}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2305.04026","created_at":"2026-07-05T06:49:42Z"},{"alias_kind":"arxiv_version","alias_value":"2305.04026v3","created_at":"2026-07-05T06:49:42Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2305.04026","created_at":"2026-07-05T06:49:42Z"},{"alias_kind":"pith_short_12","alias_value":"32WPP4DB4MVH","created_at":"2026-07-05T06:49:42Z"},{"alias_kind":"pith_short_16","alias_value":"32WPP4DB4MVHWU67","created_at":"2026-07-05T06:49:42Z"},{"alias_kind":"pith_short_8","alias_value":"32WPP4DB","created_at":"2026-07-05T06:49:42Z"}],"graph_snapshots":[{"event_id":"sha256:ca148236220a726554ca31e1e5e60a1acae3df2535f4f32f8e977a914f638a21","target":"graph","created_at":"2026-07-05T06:49:42Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2305.04026/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Third-party libraries (TPLs) are extensively utilized by developers to expedite the software development process and incorporate external functionalities. Nevertheless, insecure TPL reuse can lead to significant security risks. Existing methods are employed to determine the presence of TPL code in the target binary. Existing methods, which involve extracting strings or conducting function matching, are employed to determine the presence of TPL code in the target binary. However, these methods often yield unsatisfactory results due to the recurrence of strings and the presence of numerous simil","authors_text":"Chaopeng Dong, Hao Sun, Hong Li, Hongsong Zhu, Limin Sun, Shouguo Yang, Siyuan Li, Weijie Wang, Yongpan Wang, Zhe Lang, Zuxin Chen","cross_cats":["cs.CR"],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.SE","submitted_at":"2023-05-06T12:26:56Z","title":"LibAM: An Area Matching Framework for Detecting Third-party Libraries in Binaries"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2305.04026","kind":"arxiv","version":3},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:4d9e03f5af2c4a5a8db68701200ddcf3adb751eb8faa6442413fd919bb698b07","target":"record","created_at":"2026-07-05T06:49:42Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"8bdcc5d8d406fbfb2d5698ca720cc334f400e350b1fc9754e23896df01a7f217","cross_cats_sorted":["cs.CR"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.SE","submitted_at":"2023-05-06T12:26:56Z","title_canon_sha256":"9946068a3c16d7ac11d89d78f97926ab796b95e40ad94a4146250cbd8a1736b4"},"schema_version":"1.0","source":{"id":"2305.04026","kind":"arxiv","version":3}},"canonical_sha256":"deacf7f061e32a7b53dfc37974f9c9ed99202b59650bedb33731b23fee90d400","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"deacf7f061e32a7b53dfc37974f9c9ed99202b59650bedb33731b23fee90d400","first_computed_at":"2026-07-05T06:49:42.559430Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T06:49:42.559430Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"G8FHNLJbAdOUwQq+FVcojHki/hb4UVYoEiirkNRUxOYIDZLQnswUjYH1xic9Ikf/3w6JrFCTLGBmNNUpSBDFDg==","signature_status":"signed_v1","signed_at":"2026-07-05T06:49:42.559846Z","signed_message":"canonical_sha256_bytes"},"source_id":"2305.04026","source_kind":"arxiv","source_version":3}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:4d9e03f5af2c4a5a8db68701200ddcf3adb751eb8faa6442413fd919bb698b07","sha256:ca148236220a726554ca31e1e5e60a1acae3df2535f4f32f8e977a914f638a21"],"state_sha256":"111836f6750a8eb4c97a0246df2f2e58c9a840c514592dddedeb328546fe8cc5"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"uZTxF7RaINNIIgRPpaiQZCzjKfDEY/U2de1IioFpkGl14jC3/gG5yCieLxmmEnSuxfWkWzj2LqAGKOToEm3AAg==","signed_message":"bundle_sha256_bytes","signed_at":"2026-07-07T11:18:17.269547Z","bundle_sha256":"af94b227807cff8d009a32c6c949ea969d0242ae092de33f3c6a572db6c56cc0"}}