{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2025:47YTF57YHB4NBPUTFVVZIZKA5F","short_pith_number":"pith:47YTF57Y","canonical_record":{"source":{"id":"2502.04636","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2025-02-07T03:41:40Z","cross_cats_sorted":["cs.AI","cs.SE"],"title_canon_sha256":"cf80b83a0d3e9080077a2697d46004704779057784c3cf138a11777317015f47","abstract_canon_sha256":"520a17577469bb9bbf18696d3903d7b1f87a84fac9de12e160be75a78d3a2b74"},"schema_version":"1.0"},"canonical_sha256":"e7f132f7f83878d0be932d6b946540e97d81e79ff568f4c0811dcb703debc9ec","source":{"kind":"arxiv","id":"2502.04636","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2502.04636","created_at":"2026-07-05T10:10:54Z"},{"alias_kind":"arxiv_version","alias_value":"2502.04636v1","created_at":"2026-07-05T10:10:54Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2502.04636","created_at":"2026-07-05T10:10:54Z"},{"alias_kind":"pith_short_12","alias_value":"47YTF57YHB4N","created_at":"2026-07-05T10:10:54Z"},{"alias_kind":"pith_short_16","alias_value":"47YTF57YHB4NBPUT","created_at":"2026-07-05T10:10:54Z"},{"alias_kind":"pith_short_8","alias_value":"47YTF57Y","created_at":"2026-07-05T10:10:54Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2025:47YTF57YHB4NBPUTFVVZIZKA5F","target":"record","payload":{"canonical_record":{"source":{"id":"2502.04636","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2025-02-07T03:41:40Z","cross_cats_sorted":["cs.AI","cs.SE"],"title_canon_sha256":"cf80b83a0d3e9080077a2697d46004704779057784c3cf138a11777317015f47","abstract_canon_sha256":"520a17577469bb9bbf18696d3903d7b1f87a84fac9de12e160be75a78d3a2b74"},"schema_version":"1.0"},"canonical_sha256":"e7f132f7f83878d0be932d6b946540e97d81e79ff568f4c0811dcb703debc9ec","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T10:10:54.690954Z","signature_b64":"6vMBm5k0IRb+IGDPaNmMJQ8PGbKAnYQrRsY54dBEs509ZPcJLfrkMdV4s6rqV13ca+YvasxhSGiNkiE1j/o2CA==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"e7f132f7f83878d0be932d6b946540e97d81e79ff568f4c0811dcb703debc9ec","last_reissued_at":"2026-07-05T10:10:54.690419Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T10:10:54.690419Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2502.04636","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T10:10:54Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"sR1K5oOwW7GuFKTvskuFr6uPE7v3saB3nPX3UPQyZitkboGtHZO/Oz5shF6KuU1qlu7u3r4PfjsVDzuzjFvWAw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-18T14:14:58.628356Z"},"content_sha256":"c511bc61d390b68846301c936b2086a0f7c8d9007081b442b3ce72902a60856d","schema_version":"1.0","event_id":"sha256:c511bc61d390b68846301c936b2086a0f7c8d9007081b442b3ce72902a60856d"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2025:47YTF57YHB4NBPUTFVVZIZKA5F","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"An Empirical Study of Code Obfuscation Practices in the Google Play Store","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":["cs.AI","cs.SE"],"primary_cat":"cs.CR","authors_text":"Akila Niroshan, Aruna Seneviratne, Suranga Seneviratne","submitted_at":"2025-02-07T03:41:40Z","abstract_excerpt":"The Android ecosystem is vulnerable to issues such as app repackaging, counterfeiting, and piracy, threatening both developers and users. To mitigate these risks, developers often employ code obfuscation techniques. However, while effective in protecting legitimate applications, obfuscation also hinders security investigations as it is often exploited for malicious purposes. As such, it is important to understand code obfuscation practices in Android apps. In this paper, we analyze over 500,000 Android APKs from Google Play, spanning an eight-year period, to investigate the evolution and preva"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2502.04636","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2502.04636/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T10:10:54Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"IJZHzzbUjqtNqyNwnBOrqZfaJJR15IxeEn0Ac9DnYNWPVPAy1Ddk088Des/zVr3taJU07ITsUUZIxV2w7hgtCg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-18T14:14:58.628696Z"},"content_sha256":"697271fd73f766a27409ba38a2785b075bc6185a98a38700ba5a1e6647fe6465","schema_version":"1.0","event_id":"sha256:697271fd73f766a27409ba38a2785b075bc6185a98a38700ba5a1e6647fe6465"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/47YTF57YHB4NBPUTFVVZIZKA5F/bundle.json","state_url":"https://pith.science/pith/47YTF57YHB4NBPUTFVVZIZKA5F/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/47YTF57YHB4NBPUTFVVZIZKA5F/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-18T14:14:58Z","links":{"resolver":"https://pith.science/pith/47YTF57YHB4NBPUTFVVZIZKA5F","bundle":"https://pith.science/pith/47YTF57YHB4NBPUTFVVZIZKA5F/bundle.json","state":"https://pith.science/pith/47YTF57YHB4NBPUTFVVZIZKA5F/state.json","well_known_bundle":"https://pith.science/.well-known/pith/47YTF57YHB4NBPUTFVVZIZKA5F/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2025:47YTF57YHB4NBPUTFVVZIZKA5F","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"520a17577469bb9bbf18696d3903d7b1f87a84fac9de12e160be75a78d3a2b74","cross_cats_sorted":["cs.AI","cs.SE"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2025-02-07T03:41:40Z","title_canon_sha256":"cf80b83a0d3e9080077a2697d46004704779057784c3cf138a11777317015f47"},"schema_version":"1.0","source":{"id":"2502.04636","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2502.04636","created_at":"2026-07-05T10:10:54Z"},{"alias_kind":"arxiv_version","alias_value":"2502.04636v1","created_at":"2026-07-05T10:10:54Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2502.04636","created_at":"2026-07-05T10:10:54Z"},{"alias_kind":"pith_short_12","alias_value":"47YTF57YHB4N","created_at":"2026-07-05T10:10:54Z"},{"alias_kind":"pith_short_16","alias_value":"47YTF57YHB4NBPUT","created_at":"2026-07-05T10:10:54Z"},{"alias_kind":"pith_short_8","alias_value":"47YTF57Y","created_at":"2026-07-05T10:10:54Z"}],"graph_snapshots":[{"event_id":"sha256:697271fd73f766a27409ba38a2785b075bc6185a98a38700ba5a1e6647fe6465","target":"graph","created_at":"2026-07-05T10:10:54Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2502.04636/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"The Android ecosystem is vulnerable to issues such as app repackaging, counterfeiting, and piracy, threatening both developers and users. To mitigate these risks, developers often employ code obfuscation techniques. However, while effective in protecting legitimate applications, obfuscation also hinders security investigations as it is often exploited for malicious purposes. As such, it is important to understand code obfuscation practices in Android apps. In this paper, we analyze over 500,000 Android APKs from Google Play, spanning an eight-year period, to investigate the evolution and preva","authors_text":"Akila Niroshan, Aruna Seneviratne, Suranga Seneviratne","cross_cats":["cs.AI","cs.SE"],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2025-02-07T03:41:40Z","title":"An Empirical Study of Code Obfuscation Practices in the Google Play Store"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2502.04636","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:c511bc61d390b68846301c936b2086a0f7c8d9007081b442b3ce72902a60856d","target":"record","created_at":"2026-07-05T10:10:54Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"520a17577469bb9bbf18696d3903d7b1f87a84fac9de12e160be75a78d3a2b74","cross_cats_sorted":["cs.AI","cs.SE"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2025-02-07T03:41:40Z","title_canon_sha256":"cf80b83a0d3e9080077a2697d46004704779057784c3cf138a11777317015f47"},"schema_version":"1.0","source":{"id":"2502.04636","kind":"arxiv","version":1}},"canonical_sha256":"e7f132f7f83878d0be932d6b946540e97d81e79ff568f4c0811dcb703debc9ec","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"e7f132f7f83878d0be932d6b946540e97d81e79ff568f4c0811dcb703debc9ec","first_computed_at":"2026-07-05T10:10:54.690419Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T10:10:54.690419Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"6vMBm5k0IRb+IGDPaNmMJQ8PGbKAnYQrRsY54dBEs509ZPcJLfrkMdV4s6rqV13ca+YvasxhSGiNkiE1j/o2CA==","signature_status":"signed_v1","signed_at":"2026-07-05T10:10:54.690954Z","signed_message":"canonical_sha256_bytes"},"source_id":"2502.04636","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:c511bc61d390b68846301c936b2086a0f7c8d9007081b442b3ce72902a60856d","sha256:697271fd73f766a27409ba38a2785b075bc6185a98a38700ba5a1e6647fe6465"],"state_sha256":"4761aa077ef6117454267f95c88b21d316da6dd7247823fe48fa22589ce9b6a1"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"MwAy9M9MdL+9PgkGM7vuom3qeFD+nCB7xK1a0vMOjp7gqljeO66MuauPwrOw2/FvyyedAVkoYaVvc0IrYrURCA==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-18T14:14:58.632771Z","bundle_sha256":"82148f8e89885097e0a3b1b4b156c5e7931a0250a4ff4a75f28c5e4d2c3c4416"}}