{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2019:4QDY6YPUMGZHOQRMSCQVO4WI54","short_pith_number":"pith:4QDY6YPU","canonical_record":{"source":{"id":"1901.01185","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2019-01-04T15:54:25Z","cross_cats_sorted":[],"title_canon_sha256":"337c6bfbd11264509b3d428a44fffe210eb0b0db5ebe756ebe79eec4109b419a","abstract_canon_sha256":"4b43f6c7adc8e5ef5469a07a7845198d1b810f4fa07c73bef1096c034bf79b9c"},"schema_version":"1.0"},"canonical_sha256":"e4078f61f461b277422c90a15772c8ef13541a359f353090e09bcb3d6064c68e","source":{"kind":"arxiv","id":"1901.01185","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"1901.01185","created_at":"2026-05-17T23:56:56Z"},{"alias_kind":"arxiv_version","alias_value":"1901.01185v1","created_at":"2026-05-17T23:56:56Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.1901.01185","created_at":"2026-05-17T23:56:56Z"},{"alias_kind":"pith_short_12","alias_value":"4QDY6YPUMGZH","created_at":"2026-05-18T12:33:10Z"},{"alias_kind":"pith_short_16","alias_value":"4QDY6YPUMGZHOQRM","created_at":"2026-05-18T12:33:10Z"},{"alias_kind":"pith_short_8","alias_value":"4QDY6YPU","created_at":"2026-05-18T12:33:10Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2019:4QDY6YPUMGZHOQRMSCQVO4WI54","target":"record","payload":{"canonical_record":{"source":{"id":"1901.01185","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2019-01-04T15:54:25Z","cross_cats_sorted":[],"title_canon_sha256":"337c6bfbd11264509b3d428a44fffe210eb0b0db5ebe756ebe79eec4109b419a","abstract_canon_sha256":"4b43f6c7adc8e5ef5469a07a7845198d1b810f4fa07c73bef1096c034bf79b9c"},"schema_version":"1.0"},"canonical_sha256":"e4078f61f461b277422c90a15772c8ef13541a359f353090e09bcb3d6064c68e","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-05-17T23:56:56.818975Z","signature_b64":"7BxzNzZXODZQEW7QyD+GyGu4zvZRYo+1sAuu9Ob7tMSC9Fm24P259kAZLN8ZDGc9JWJjpZ0FgRpS4naiqrnrDw==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"e4078f61f461b277422c90a15772c8ef13541a359f353090e09bcb3d6064c68e","last_reissued_at":"2026-05-17T23:56:56.818369Z","signature_status":"signed_v1","first_computed_at":"2026-05-17T23:56:56.818369Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"1901.01185","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-05-17T23:56:56Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"tFEMCVxcktRTRhRHQlu77wNTV3+YW0EYNPrB61DcAO6IOq+ENbnD3CjbgOdmSbDCEsj3vna+FSOv74ZzD8PdDA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-06-01T04:15:56.577464Z"},"content_sha256":"a182a26ff50b4b5f2fd9f2c218bdadb627d9c17727f3d145a7ee3174d104ca25","schema_version":"1.0","event_id":"sha256:a182a26ff50b4b5f2fd9f2c218bdadb627d9c17727f3d145a7ee3174d104ca25"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2019:4QDY6YPUMGZHOQRMSCQVO4WI54","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Network-based Analysis and Classification of Malware using Behavioral Artifacts Ordering","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":[],"primary_cat":"cs.CR","authors_text":"Aziz Mohaisen, DaeHun Nyang, Jeman Park, Joongheon Kim, Manar Mohaisen, Omar Alrawi","submitted_at":"2019-01-04T15:54:25Z","abstract_excerpt":"Using runtime execution artifacts to identify malware and its associated family is an established technique in the security domain. Many papers in the literature rely on explicit features derived from network, file system, or registry interaction. While effective, the use of these fine-granularity data points makes these techniques computationally expensive. Moreover, the signatures and heuristics are often circumvented by subsequent malware authors. In this work, we propose Chatter, a system that is concerned only with the order in which high-level system events take place. Individual events "},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"1901.01185","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-05-17T23:56:56Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"A5nbKvBko0LNFDW+OSAAtIJwM1PL+CMQe+4vDrNi9ZDuDD4fFzx01Eh365oXny7ZQ6HngVycDCHmERX33OuBDg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-06-01T04:15:56.578252Z"},"content_sha256":"4cc11f67033b8d0f933d21c267a781fc3c508491cf246a21c3fb0066357d2c9d","schema_version":"1.0","event_id":"sha256:4cc11f67033b8d0f933d21c267a781fc3c508491cf246a21c3fb0066357d2c9d"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/4QDY6YPUMGZHOQRMSCQVO4WI54/bundle.json","state_url":"https://pith.science/pith/4QDY6YPUMGZHOQRMSCQVO4WI54/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/4QDY6YPUMGZHOQRMSCQVO4WI54/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-06-01T04:15:56Z","links":{"resolver":"https://pith.science/pith/4QDY6YPUMGZHOQRMSCQVO4WI54","bundle":"https://pith.science/pith/4QDY6YPUMGZHOQRMSCQVO4WI54/bundle.json","state":"https://pith.science/pith/4QDY6YPUMGZHOQRMSCQVO4WI54/state.json","well_known_bundle":"https://pith.science/.well-known/pith/4QDY6YPUMGZHOQRMSCQVO4WI54/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2019:4QDY6YPUMGZHOQRMSCQVO4WI54","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"4b43f6c7adc8e5ef5469a07a7845198d1b810f4fa07c73bef1096c034bf79b9c","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2019-01-04T15:54:25Z","title_canon_sha256":"337c6bfbd11264509b3d428a44fffe210eb0b0db5ebe756ebe79eec4109b419a"},"schema_version":"1.0","source":{"id":"1901.01185","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"1901.01185","created_at":"2026-05-17T23:56:56Z"},{"alias_kind":"arxiv_version","alias_value":"1901.01185v1","created_at":"2026-05-17T23:56:56Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.1901.01185","created_at":"2026-05-17T23:56:56Z"},{"alias_kind":"pith_short_12","alias_value":"4QDY6YPUMGZH","created_at":"2026-05-18T12:33:10Z"},{"alias_kind":"pith_short_16","alias_value":"4QDY6YPUMGZHOQRM","created_at":"2026-05-18T12:33:10Z"},{"alias_kind":"pith_short_8","alias_value":"4QDY6YPU","created_at":"2026-05-18T12:33:10Z"}],"graph_snapshots":[{"event_id":"sha256:4cc11f67033b8d0f933d21c267a781fc3c508491cf246a21c3fb0066357d2c9d","target":"graph","created_at":"2026-05-17T23:56:56Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"paper":{"abstract_excerpt":"Using runtime execution artifacts to identify malware and its associated family is an established technique in the security domain. Many papers in the literature rely on explicit features derived from network, file system, or registry interaction. While effective, the use of these fine-granularity data points makes these techniques computationally expensive. Moreover, the signatures and heuristics are often circumvented by subsequent malware authors. In this work, we propose Chatter, a system that is concerned only with the order in which high-level system events take place. Individual events ","authors_text":"Aziz Mohaisen, DaeHun Nyang, Jeman Park, Joongheon Kim, Manar Mohaisen, Omar Alrawi","cross_cats":[],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2019-01-04T15:54:25Z","title":"Network-based Analysis and Classification of Malware using Behavioral Artifacts Ordering"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"1901.01185","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:a182a26ff50b4b5f2fd9f2c218bdadb627d9c17727f3d145a7ee3174d104ca25","target":"record","created_at":"2026-05-17T23:56:56Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"4b43f6c7adc8e5ef5469a07a7845198d1b810f4fa07c73bef1096c034bf79b9c","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2019-01-04T15:54:25Z","title_canon_sha256":"337c6bfbd11264509b3d428a44fffe210eb0b0db5ebe756ebe79eec4109b419a"},"schema_version":"1.0","source":{"id":"1901.01185","kind":"arxiv","version":1}},"canonical_sha256":"e4078f61f461b277422c90a15772c8ef13541a359f353090e09bcb3d6064c68e","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"e4078f61f461b277422c90a15772c8ef13541a359f353090e09bcb3d6064c68e","first_computed_at":"2026-05-17T23:56:56.818369Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-05-17T23:56:56.818369Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"7BxzNzZXODZQEW7QyD+GyGu4zvZRYo+1sAuu9Ob7tMSC9Fm24P259kAZLN8ZDGc9JWJjpZ0FgRpS4naiqrnrDw==","signature_status":"signed_v1","signed_at":"2026-05-17T23:56:56.818975Z","signed_message":"canonical_sha256_bytes"},"source_id":"1901.01185","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:a182a26ff50b4b5f2fd9f2c218bdadb627d9c17727f3d145a7ee3174d104ca25","sha256:4cc11f67033b8d0f933d21c267a781fc3c508491cf246a21c3fb0066357d2c9d"],"state_sha256":"77b66f80d0281a5881b1c5f0b0b4fb533345186b0ca3daa7399ab63b3de23bae"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"aqcSfLG5fOur6yvoTuuSDTJCATyZYJxb2MUzHAnUyil8YVWzEzmtB6K7/u21au/yn6wthYmIcJLIqVR6Lm8WDA==","signed_message":"bundle_sha256_bytes","signed_at":"2026-06-01T04:15:56.581721Z","bundle_sha256":"7d76ce14fc6e6095a44415ea3113508945f9f4432ea37be42a08ee818171511f"}}