{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2016:52XVQWTJTI3RSYX27VTPYKVSA3","short_pith_number":"pith:52XVQWTJ","canonical_record":{"source":{"id":"1606.06908","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2016-06-22T11:45:13Z","cross_cats_sorted":["cs.AI"],"title_canon_sha256":"2c6a6e5ab1f64b7d095abe1f7cee975e45b98f52d22daa6dd2d14d51cf7e30be","abstract_canon_sha256":"4be572c6dc2bcd8481320133fd8a75799fe2d99a2b1075df20a6777c22642ca7"},"schema_version":"1.0"},"canonical_sha256":"eeaf585a699a371962fafd66fc2ab206d90e78e22fc29759a52af82dc01fedad","source":{"kind":"arxiv","id":"1606.06908","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"1606.06908","created_at":"2026-05-18T00:05:39Z"},{"alias_kind":"arxiv_version","alias_value":"1606.06908v1","created_at":"2026-05-18T00:05:39Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.1606.06908","created_at":"2026-05-18T00:05:39Z"},{"alias_kind":"pith_short_12","alias_value":"52XVQWTJTI3R","created_at":"2026-05-18T12:29:58Z"},{"alias_kind":"pith_short_16","alias_value":"52XVQWTJTI3RSYX2","created_at":"2026-05-18T12:29:58Z"},{"alias_kind":"pith_short_8","alias_value":"52XVQWTJ","created_at":"2026-05-18T12:29:58Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2016:52XVQWTJTI3RSYX27VTPYKVSA3","target":"record","payload":{"canonical_record":{"source":{"id":"1606.06908","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2016-06-22T11:45:13Z","cross_cats_sorted":["cs.AI"],"title_canon_sha256":"2c6a6e5ab1f64b7d095abe1f7cee975e45b98f52d22daa6dd2d14d51cf7e30be","abstract_canon_sha256":"4be572c6dc2bcd8481320133fd8a75799fe2d99a2b1075df20a6777c22642ca7"},"schema_version":"1.0"},"canonical_sha256":"eeaf585a699a371962fafd66fc2ab206d90e78e22fc29759a52af82dc01fedad","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-05-18T00:05:39.997054Z","signature_b64":"jaW2QYjX8JCZB1s0iMPVGBOouplPiHK1leUMEL+kUD66hSbV/8Z9Bdmkkn/zIy+G3kKuKnUeWNh4JHZdVtqoDQ==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"eeaf585a699a371962fafd66fc2ab206d90e78e22fc29759a52af82dc01fedad","last_reissued_at":"2026-05-18T00:05:39.996626Z","signature_status":"signed_v1","first_computed_at":"2026-05-18T00:05:39.996626Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"1606.06908","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-05-18T00:05:39Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"vh4iZ1SnBVO9p8Ss2CaZwaZePlQrH9z+s7VZ9SF80yCAw7FgVXnB9aKK7va+PWhvdSUr9yPz2h14q5wTV9xaAg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-07-02T17:05:08.129608Z"},"content_sha256":"f5a90d4a5ef174d6da20fdae7381179d9abd44a390ff2f91527c6a8567943799","schema_version":"1.0","event_id":"sha256:f5a90d4a5ef174d6da20fdae7381179d9abd44a390ff2f91527c6a8567943799"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2016:52XVQWTJTI3RSYX27VTPYKVSA3","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Grouping the executables to detect malware with high accuracy","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":["cs.AI"],"primary_cat":"cs.CR","authors_text":"Ashu Sharma, Sanjay K. Sahay","submitted_at":"2016-06-22T11:45:13Z","abstract_excerpt":"The metamorphic malware variants with the same malicious behavior (family), can obfuscate themselves to look different from each other. This variation in structure leads to a huge signature database for traditional signature matching techniques to detect them. In order to effective and efficient detection of malware in large amounts of executables, we need to partition these files into groups which can identify their respective families. In addition, the grouping criteria should be chosen such a way that, it can also be applied to unknown files encounter on computers for classification. This p"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"1606.06908","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-05-18T00:05:39Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"lagJ96wUGc84v8l11YsGz2AeZDQ5fzX4EnFz+r4Pxfiq2n3rLkDqyJ6+rloOPTBcVeGX0rEYMDIcTor8MjxFAQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-07-02T17:05:08.129939Z"},"content_sha256":"c2be24d474c6de3a96367cd7c1ffaa74b20dbd95743cc3bc117d30d5ee11967e","schema_version":"1.0","event_id":"sha256:c2be24d474c6de3a96367cd7c1ffaa74b20dbd95743cc3bc117d30d5ee11967e"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/52XVQWTJTI3RSYX27VTPYKVSA3/bundle.json","state_url":"https://pith.science/pith/52XVQWTJTI3RSYX27VTPYKVSA3/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/52XVQWTJTI3RSYX27VTPYKVSA3/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-07-02T17:05:08Z","links":{"resolver":"https://pith.science/pith/52XVQWTJTI3RSYX27VTPYKVSA3","bundle":"https://pith.science/pith/52XVQWTJTI3RSYX27VTPYKVSA3/bundle.json","state":"https://pith.science/pith/52XVQWTJTI3RSYX27VTPYKVSA3/state.json","well_known_bundle":"https://pith.science/.well-known/pith/52XVQWTJTI3RSYX27VTPYKVSA3/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2016:52XVQWTJTI3RSYX27VTPYKVSA3","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"4be572c6dc2bcd8481320133fd8a75799fe2d99a2b1075df20a6777c22642ca7","cross_cats_sorted":["cs.AI"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2016-06-22T11:45:13Z","title_canon_sha256":"2c6a6e5ab1f64b7d095abe1f7cee975e45b98f52d22daa6dd2d14d51cf7e30be"},"schema_version":"1.0","source":{"id":"1606.06908","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"1606.06908","created_at":"2026-05-18T00:05:39Z"},{"alias_kind":"arxiv_version","alias_value":"1606.06908v1","created_at":"2026-05-18T00:05:39Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.1606.06908","created_at":"2026-05-18T00:05:39Z"},{"alias_kind":"pith_short_12","alias_value":"52XVQWTJTI3R","created_at":"2026-05-18T12:29:58Z"},{"alias_kind":"pith_short_16","alias_value":"52XVQWTJTI3RSYX2","created_at":"2026-05-18T12:29:58Z"},{"alias_kind":"pith_short_8","alias_value":"52XVQWTJ","created_at":"2026-05-18T12:29:58Z"}],"graph_snapshots":[{"event_id":"sha256:c2be24d474c6de3a96367cd7c1ffaa74b20dbd95743cc3bc117d30d5ee11967e","target":"graph","created_at":"2026-05-18T00:05:39Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"paper":{"abstract_excerpt":"The metamorphic malware variants with the same malicious behavior (family), can obfuscate themselves to look different from each other. This variation in structure leads to a huge signature database for traditional signature matching techniques to detect them. In order to effective and efficient detection of malware in large amounts of executables, we need to partition these files into groups which can identify their respective families. In addition, the grouping criteria should be chosen such a way that, it can also be applied to unknown files encounter on computers for classification. This p","authors_text":"Ashu Sharma, Sanjay K. Sahay","cross_cats":["cs.AI"],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2016-06-22T11:45:13Z","title":"Grouping the executables to detect malware with high accuracy"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"1606.06908","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:f5a90d4a5ef174d6da20fdae7381179d9abd44a390ff2f91527c6a8567943799","target":"record","created_at":"2026-05-18T00:05:39Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"4be572c6dc2bcd8481320133fd8a75799fe2d99a2b1075df20a6777c22642ca7","cross_cats_sorted":["cs.AI"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2016-06-22T11:45:13Z","title_canon_sha256":"2c6a6e5ab1f64b7d095abe1f7cee975e45b98f52d22daa6dd2d14d51cf7e30be"},"schema_version":"1.0","source":{"id":"1606.06908","kind":"arxiv","version":1}},"canonical_sha256":"eeaf585a699a371962fafd66fc2ab206d90e78e22fc29759a52af82dc01fedad","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"eeaf585a699a371962fafd66fc2ab206d90e78e22fc29759a52af82dc01fedad","first_computed_at":"2026-05-18T00:05:39.996626Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-05-18T00:05:39.996626Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"jaW2QYjX8JCZB1s0iMPVGBOouplPiHK1leUMEL+kUD66hSbV/8Z9Bdmkkn/zIy+G3kKuKnUeWNh4JHZdVtqoDQ==","signature_status":"signed_v1","signed_at":"2026-05-18T00:05:39.997054Z","signed_message":"canonical_sha256_bytes"},"source_id":"1606.06908","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:f5a90d4a5ef174d6da20fdae7381179d9abd44a390ff2f91527c6a8567943799","sha256:c2be24d474c6de3a96367cd7c1ffaa74b20dbd95743cc3bc117d30d5ee11967e"],"state_sha256":"21e2d561910e5be7ae116e1959539cf3b33f66b20b3e5d20092f7f1c571c0263"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"gg6ZcuXKOfndlJmcVmc9S42UYdvv1xOI6DDh4OG0ylMoM3u59lmbXZrGnaAbo16aIdNO1OnfG6jgd9kT4q0XDQ==","signed_message":"bundle_sha256_bytes","signed_at":"2026-07-02T17:05:08.131804Z","bundle_sha256":"4fd2b3ce1857770755d0e512d9a5868d552faae3d36b3e758b8d57a487cdcd8e"}}