{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2018:4R7JXH72AYFRODZAKZZMN5Y5AR","short_pith_number":"pith:4R7JXH72","canonical_record":{"source":{"id":"1803.02700","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2018-03-07T15:01:40Z","cross_cats_sorted":[],"title_canon_sha256":"be1d44864d491f8ea59f97e386d96598773f011f06d9b4279a904e2d8b93f6a0","abstract_canon_sha256":"f03e895453f7c4bd88ad5eaabb8c30184d4b39bfd2717f7538b9858ca3597688"},"schema_version":"1.0"},"canonical_sha256":"e47e9b9ffa060b170f205672c6f71d0476fef2e3639ada2eee991e820d6866ca","source":{"kind":"arxiv","id":"1803.02700","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"1803.02700","created_at":"2026-05-18T00:21:49Z"},{"alias_kind":"arxiv_version","alias_value":"1803.02700v1","created_at":"2026-05-18T00:21:49Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.1803.02700","created_at":"2026-05-18T00:21:49Z"},{"alias_kind":"pith_short_12","alias_value":"4R7JXH72AYFR","created_at":"2026-05-18T12:32:05Z"},{"alias_kind":"pith_short_16","alias_value":"4R7JXH72AYFRODZA","created_at":"2026-05-18T12:32:05Z"},{"alias_kind":"pith_short_8","alias_value":"4R7JXH72","created_at":"2026-05-18T12:32:05Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2018:4R7JXH72AYFRODZAKZZMN5Y5AR","target":"record","payload":{"canonical_record":{"source":{"id":"1803.02700","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2018-03-07T15:01:40Z","cross_cats_sorted":[],"title_canon_sha256":"be1d44864d491f8ea59f97e386d96598773f011f06d9b4279a904e2d8b93f6a0","abstract_canon_sha256":"f03e895453f7c4bd88ad5eaabb8c30184d4b39bfd2717f7538b9858ca3597688"},"schema_version":"1.0"},"canonical_sha256":"e47e9b9ffa060b170f205672c6f71d0476fef2e3639ada2eee991e820d6866ca","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-05-18T00:21:49.464072Z","signature_b64":"J3/QwrV0YtNVfNL1iZ3L9KRC7vKKbQQd5FuOeVpmAMutKM7UuCvgEGC1xQw/jjgMWjBzFBD2tS5yL2PwPlRuCg==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"e47e9b9ffa060b170f205672c6f71d0476fef2e3639ada2eee991e820d6866ca","last_reissued_at":"2026-05-18T00:21:49.463431Z","signature_status":"signed_v1","first_computed_at":"2026-05-18T00:21:49.463431Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"1803.02700","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-05-18T00:21:49Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"ZYnA6RSxT4n5fnHMTTjnuU8Ly9ZHalkcG1uqwBdfPXxMJwKtWLrPBwG+IsvO+7dzIDYikGZVlZnTjCceiyLmCQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-05-28T17:56:24.279691Z"},"content_sha256":"3f7f22325765a6223e015a056124b2221fedfae5e8200f8a6643cb5129f345d8","schema_version":"1.0","event_id":"sha256:3f7f22325765a6223e015a056124b2221fedfae5e8200f8a6643cb5129f345d8"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2018:4R7JXH72AYFRODZAKZZMN5Y5AR","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Co-processor-based Behavior Monitoring: Application to the Detection of Attacks Against the System Management Mode","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":[],"primary_cat":"cs.CR","authors_text":"2), (2) CIDRE Team, CentraleSup\\'elec, CNRS, David Plaquin (1), Guillaume Hiet (2) ((1) HP Labs, Inria, IRISA), Maugan Villatel (1), Ronny Chevalier (1","submitted_at":"2018-03-07T15:01:40Z","abstract_excerpt":"Highly privileged software, such as firmware, is an attractive target for attackers. Thus, BIOS vendors use cryptographic signatures to ensure firmware integrity at boot time. Nevertheless, such protection does not prevent an attacker from exploiting vulnerabilities at runtime. To detect such attacks, we propose an event-based behavior monitoring approach that relies on an isolated co-processor. We instrument the code executed on the main CPU to send information about its behavior to the monitor. This information helps to resolve the semantic gap issue. Our approach does not depend on a specif"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"1803.02700","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-05-18T00:21:49Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"kL93v+8CjtTjA7OUm/GFwjNHV0oAacQq2FFP2hN4KN7iNg+r7wkg27UWFLpafesb3Ulf/9tEumne3A1EtENJAQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-05-28T17:56:24.280335Z"},"content_sha256":"f5d38d450d9c3e38b2bdad05b3dfe7c44ea9a715e825df66d592b296f10c7c2d","schema_version":"1.0","event_id":"sha256:f5d38d450d9c3e38b2bdad05b3dfe7c44ea9a715e825df66d592b296f10c7c2d"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/4R7JXH72AYFRODZAKZZMN5Y5AR/bundle.json","state_url":"https://pith.science/pith/4R7JXH72AYFRODZAKZZMN5Y5AR/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/4R7JXH72AYFRODZAKZZMN5Y5AR/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-05-28T17:56:24Z","links":{"resolver":"https://pith.science/pith/4R7JXH72AYFRODZAKZZMN5Y5AR","bundle":"https://pith.science/pith/4R7JXH72AYFRODZAKZZMN5Y5AR/bundle.json","state":"https://pith.science/pith/4R7JXH72AYFRODZAKZZMN5Y5AR/state.json","well_known_bundle":"https://pith.science/.well-known/pith/4R7JXH72AYFRODZAKZZMN5Y5AR/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2018:4R7JXH72AYFRODZAKZZMN5Y5AR","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"f03e895453f7c4bd88ad5eaabb8c30184d4b39bfd2717f7538b9858ca3597688","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2018-03-07T15:01:40Z","title_canon_sha256":"be1d44864d491f8ea59f97e386d96598773f011f06d9b4279a904e2d8b93f6a0"},"schema_version":"1.0","source":{"id":"1803.02700","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"1803.02700","created_at":"2026-05-18T00:21:49Z"},{"alias_kind":"arxiv_version","alias_value":"1803.02700v1","created_at":"2026-05-18T00:21:49Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.1803.02700","created_at":"2026-05-18T00:21:49Z"},{"alias_kind":"pith_short_12","alias_value":"4R7JXH72AYFR","created_at":"2026-05-18T12:32:05Z"},{"alias_kind":"pith_short_16","alias_value":"4R7JXH72AYFRODZA","created_at":"2026-05-18T12:32:05Z"},{"alias_kind":"pith_short_8","alias_value":"4R7JXH72","created_at":"2026-05-18T12:32:05Z"}],"graph_snapshots":[{"event_id":"sha256:f5d38d450d9c3e38b2bdad05b3dfe7c44ea9a715e825df66d592b296f10c7c2d","target":"graph","created_at":"2026-05-18T00:21:49Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"paper":{"abstract_excerpt":"Highly privileged software, such as firmware, is an attractive target for attackers. Thus, BIOS vendors use cryptographic signatures to ensure firmware integrity at boot time. Nevertheless, such protection does not prevent an attacker from exploiting vulnerabilities at runtime. To detect such attacks, we propose an event-based behavior monitoring approach that relies on an isolated co-processor. We instrument the code executed on the main CPU to send information about its behavior to the monitor. This information helps to resolve the semantic gap issue. Our approach does not depend on a specif","authors_text":"2), (2) CIDRE Team, CentraleSup\\'elec, CNRS, David Plaquin (1), Guillaume Hiet (2) ((1) HP Labs, Inria, IRISA), Maugan Villatel (1), Ronny Chevalier (1","cross_cats":[],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2018-03-07T15:01:40Z","title":"Co-processor-based Behavior Monitoring: Application to the Detection of Attacks Against the System Management Mode"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"1803.02700","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:3f7f22325765a6223e015a056124b2221fedfae5e8200f8a6643cb5129f345d8","target":"record","created_at":"2026-05-18T00:21:49Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"f03e895453f7c4bd88ad5eaabb8c30184d4b39bfd2717f7538b9858ca3597688","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2018-03-07T15:01:40Z","title_canon_sha256":"be1d44864d491f8ea59f97e386d96598773f011f06d9b4279a904e2d8b93f6a0"},"schema_version":"1.0","source":{"id":"1803.02700","kind":"arxiv","version":1}},"canonical_sha256":"e47e9b9ffa060b170f205672c6f71d0476fef2e3639ada2eee991e820d6866ca","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"e47e9b9ffa060b170f205672c6f71d0476fef2e3639ada2eee991e820d6866ca","first_computed_at":"2026-05-18T00:21:49.463431Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-05-18T00:21:49.463431Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"J3/QwrV0YtNVfNL1iZ3L9KRC7vKKbQQd5FuOeVpmAMutKM7UuCvgEGC1xQw/jjgMWjBzFBD2tS5yL2PwPlRuCg==","signature_status":"signed_v1","signed_at":"2026-05-18T00:21:49.464072Z","signed_message":"canonical_sha256_bytes"},"source_id":"1803.02700","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:3f7f22325765a6223e015a056124b2221fedfae5e8200f8a6643cb5129f345d8","sha256:f5d38d450d9c3e38b2bdad05b3dfe7c44ea9a715e825df66d592b296f10c7c2d"],"state_sha256":"61b5c6b8100a0e1a198480446f0fb9474a6409ff4518987c2d2e4c9afec10368"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"y2JVVBZ50Ev7xx3GAiXXrLjre8xbwn6dWzxYmJXUaB70K7D2u1L3xmIvRU/RSogF/em3QpHboGHizr8lvMYbAA==","signed_message":"bundle_sha256_bytes","signed_at":"2026-05-28T17:56:24.283686Z","bundle_sha256":"a1c93e18d8b8ec945f1ede0042f9af453dca40f4f056ca41849427e58bf1bb9d"}}