{"record_type":"pith_number_record","schema_url":"https://pith.science/schemas/pith-number/v1.json","pith_number":"pith:2025:4Z3FUWDSTLCPWJWOGAG4EEEO3L","short_pith_number":"pith:4Z3FUWDS","schema_version":"1.0","canonical_sha256":"e6765a58729ac4fb26ce300dc2108edafe93a77e6a7f39cb9e3bf6d8351fbd06","source":{"kind":"arxiv","id":"2511.04472","version":3},"attestation_state":"computed","paper":{"title":"Evading and crashing anti-malware solutions via data collection overloading during analysis serialization","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":[],"primary_cat":"cs.CR","authors_text":"Constantinos Patsakis, Evgenios Gkritsis, George Stergiopoulos","submitted_at":"2025-11-06T15:45:03Z","abstract_excerpt":"Malware analysis systems, including dynamic-analysis sandboxes and digital forensics and incident response (DFIR) platforms, rely on telemetry pipelines comprising collection agents, serializers, and database backends to capture and present program behavior to analysts. We show that these data-handling components constitute an exploitable attack surface that can lead to denial-of-analysis (DoA) states without disabling sensors or requiring elevated privileges. We present Telemetry Complexity Attacks (TCAs), a new class of vulnerabilities that exploit mismatches between unbounded collection mec"},"verification_status":{"content_addressed":true,"pith_receipt":true,"author_attested":false,"weak_author_claims":0,"strong_author_claims":0,"externally_anchored":false,"storage_verified":false,"citation_signatures":0,"replication_records":0,"graph_snapshot":true,"references_resolved":false,"formal_links_present":false},"canonical_record":{"source":{"id":"2511.04472","kind":"arxiv","version":3},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2025-11-06T15:45:03Z","cross_cats_sorted":[],"title_canon_sha256":"a57c8b6ba00dd0221a752e51f9760e8878b311e42b1d2a13cf88cd031ed7cab7","abstract_canon_sha256":"2b1c16ba8c31c68c550bf7539d9bf05a48a128956c5786fe2981272af5b9ec4f"},"schema_version":"1.0"},"receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-05-20T00:04:16.968869Z","signature_b64":"0XmXM4EcTThL6b4mGmeXiLHvOn4f8xtQ7cx91G6VrDAVESP5tqtBxXA3bUCM3AXG29SGrfjiszxM27AkXDmFDA==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"e6765a58729ac4fb26ce300dc2108edafe93a77e6a7f39cb9e3bf6d8351fbd06","last_reissued_at":"2026-05-20T00:04:16.968223Z","signature_status":"signed_v1","first_computed_at":"2026-05-20T00:04:16.968223Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"graph_snapshot":{"paper":{"title":"Evading and crashing anti-malware solutions via data collection overloading during analysis serialization","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":[],"primary_cat":"cs.CR","authors_text":"Constantinos Patsakis, Evgenios Gkritsis, George Stergiopoulos","submitted_at":"2025-11-06T15:45:03Z","abstract_excerpt":"Malware analysis systems, including dynamic-analysis sandboxes and digital forensics and incident response (DFIR) platforms, rely on telemetry pipelines comprising collection agents, serializers, and database backends to capture and present program behavior to analysts. We show that these data-handling components constitute an exploitable attack surface that can lead to denial-of-analysis (DoA) states without disabling sensors or requiring elevated privileges. We present Telemetry Complexity Attacks (TCAs), a new class of vulnerabilities that exploit mismatches between unbounded collection mec"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2511.04472","kind":"arxiv","version":3},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2511.04472/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"aliases":[{"alias_kind":"arxiv","alias_value":"2511.04472","created_at":"2026-05-20T00:04:16.968305+00:00"},{"alias_kind":"arxiv_version","alias_value":"2511.04472v3","created_at":"2026-05-20T00:04:16.968305+00:00"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2511.04472","created_at":"2026-05-20T00:04:16.968305+00:00"},{"alias_kind":"pith_short_12","alias_value":"4Z3FUWDSTLCP","created_at":"2026-05-20T00:04:16.968305+00:00"},{"alias_kind":"pith_short_16","alias_value":"4Z3FUWDSTLCPWJWO","created_at":"2026-05-20T00:04:16.968305+00:00"},{"alias_kind":"pith_short_8","alias_value":"4Z3FUWDS","created_at":"2026-05-20T00:04:16.968305+00:00"}],"events":[],"event_summary":{},"paper_claims":[],"inbound_citations":{"count":0,"internal_anchor_count":0,"sample":[]},"formal_canon":{"evidence_count":0,"sample":[],"anchors":[]},"links":{"html":"https://pith.science/pith/4Z3FUWDSTLCPWJWOGAG4EEEO3L","json":"https://pith.science/pith/4Z3FUWDSTLCPWJWOGAG4EEEO3L.json","graph_json":"https://pith.science/api/pith-number/4Z3FUWDSTLCPWJWOGAG4EEEO3L/graph.json","events_json":"https://pith.science/api/pith-number/4Z3FUWDSTLCPWJWOGAG4EEEO3L/events.json","paper":"https://pith.science/paper/4Z3FUWDS"},"agent_actions":{"view_html":"https://pith.science/pith/4Z3FUWDSTLCPWJWOGAG4EEEO3L","download_json":"https://pith.science/pith/4Z3FUWDSTLCPWJWOGAG4EEEO3L.json","view_paper":"https://pith.science/paper/4Z3FUWDS","resolve_alias":"https://pith.science/api/pith-number/resolve?arxiv=2511.04472&json=true","fetch_graph":"https://pith.science/api/pith-number/4Z3FUWDSTLCPWJWOGAG4EEEO3L/graph.json","fetch_events":"https://pith.science/api/pith-number/4Z3FUWDSTLCPWJWOGAG4EEEO3L/events.json","actions":{"anchor_timestamp":"https://pith.science/pith/4Z3FUWDSTLCPWJWOGAG4EEEO3L/action/timestamp_anchor","attest_storage":"https://pith.science/pith/4Z3FUWDSTLCPWJWOGAG4EEEO3L/action/storage_attestation","attest_author":"https://pith.science/pith/4Z3FUWDSTLCPWJWOGAG4EEEO3L/action/author_attestation","sign_citation":"https://pith.science/pith/4Z3FUWDSTLCPWJWOGAG4EEEO3L/action/citation_signature","submit_replication":"https://pith.science/pith/4Z3FUWDSTLCPWJWOGAG4EEEO3L/action/replication_record"}},"created_at":"2026-05-20T00:04:16.968305+00:00","updated_at":"2026-05-20T00:04:16.968305+00:00"}