{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2019:5UEUHJQWYQXYNOXYU3274XJJSH","short_pith_number":"pith:5UEUHJQW","canonical_record":{"source":{"id":"1904.02100","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2019-03-12T18:31:21Z","cross_cats_sorted":["cs.IR"],"title_canon_sha256":"5e9d738208af5242af39cadbd30a3c8c2ba7cd375b8d04af8265e241860702a3","abstract_canon_sha256":"d0559e56df956057616e240c64880d96c9fe26e20d47c7ec2a466b466353f2dc"},"schema_version":"1.0"},"canonical_sha256":"ed0943a616c42f86baf8a6f5fe5d2991e5c0f3d63a280852262600cb1da08663","source":{"kind":"arxiv","id":"1904.02100","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"1904.02100","created_at":"2026-05-17T23:49:28Z"},{"alias_kind":"arxiv_version","alias_value":"1904.02100v1","created_at":"2026-05-17T23:49:28Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.1904.02100","created_at":"2026-05-17T23:49:28Z"},{"alias_kind":"pith_short_12","alias_value":"5UEUHJQWYQXY","created_at":"2026-05-18T12:33:10Z"},{"alias_kind":"pith_short_16","alias_value":"5UEUHJQWYQXYNOXY","created_at":"2026-05-18T12:33:10Z"},{"alias_kind":"pith_short_8","alias_value":"5UEUHJQW","created_at":"2026-05-18T12:33:10Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2019:5UEUHJQWYQXYNOXYU3274XJJSH","target":"record","payload":{"canonical_record":{"source":{"id":"1904.02100","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2019-03-12T18:31:21Z","cross_cats_sorted":["cs.IR"],"title_canon_sha256":"5e9d738208af5242af39cadbd30a3c8c2ba7cd375b8d04af8265e241860702a3","abstract_canon_sha256":"d0559e56df956057616e240c64880d96c9fe26e20d47c7ec2a466b466353f2dc"},"schema_version":"1.0"},"canonical_sha256":"ed0943a616c42f86baf8a6f5fe5d2991e5c0f3d63a280852262600cb1da08663","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-05-17T23:49:28.455636Z","signature_b64":"3CaeTqSewWc0PtFm60GWjQDBILxuubJLNm4QVA4Mi+nq3viZDdTyqwAOTXPP7z1PfUoUgVQLHfChgVABkieSAA==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"ed0943a616c42f86baf8a6f5fe5d2991e5c0f3d63a280852262600cb1da08663","last_reissued_at":"2026-05-17T23:49:28.455196Z","signature_status":"signed_v1","first_computed_at":"2026-05-17T23:49:28.455196Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"1904.02100","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-05-17T23:49:28Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"gEDO67Tk54xw0+RseV8n4GQrBkDPgn8RUhDePdrWF3+5a/6Ed96QCch2n0ULo6SFIloJaqomgGJKpcICR2VtBQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-06-11T04:21:28.447745Z"},"content_sha256":"7218929d980a7b6a095f1c6f16892ac00637db47cc41ab02845f0611d7c640eb","schema_version":"1.0","event_id":"sha256:7218929d980a7b6a095f1c6f16892ac00637db47cc41ab02845f0611d7c640eb"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2019:5UEUHJQWYQXYNOXYU3274XJJSH","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Agent-based Vs Agent-less Sandbox for Dynamic Behavioral Analysis","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":["cs.IR"],"primary_cat":"cs.CR","authors_text":"Bogdan Ghita, Maria Papadaki, Muhammad Ali, Stavros Shiaeles","submitted_at":"2019-03-12T18:31:21Z","abstract_excerpt":"Malicious software is detected and classified by either static analysis or dynamic analysis. In static analysis, malware samples are reverse engineered and analyzed so that signatures of malware can be constructed. These techniques can be easily thwarted through polymorphic, metamorphic malware, obfuscation and packing techniques, whereas in dynamic analysis malware samples are executed in a controlled environment using the sandboxing technique, in order to model the behavior of malware. In this paper, we have analyzed Petya, Spyeye, VolatileCedar, PAFISH etc. through Agent-based and Agentless"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"1904.02100","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-05-17T23:49:28Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"+YPo1dGuv4mrOfNXhlE0ibVnC9a/sTJaGgRUDXY1Wxy8YK9RfnsAn9RIC5QSa1shCKPKU3+zCCbUqeSC4uuaBw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-06-11T04:21:28.448491Z"},"content_sha256":"77c98874aaa8eb792097a628953c6124e023e4a8a80a9d26d7f261a57239e6dc","schema_version":"1.0","event_id":"sha256:77c98874aaa8eb792097a628953c6124e023e4a8a80a9d26d7f261a57239e6dc"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/5UEUHJQWYQXYNOXYU3274XJJSH/bundle.json","state_url":"https://pith.science/pith/5UEUHJQWYQXYNOXYU3274XJJSH/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/5UEUHJQWYQXYNOXYU3274XJJSH/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-06-11T04:21:28Z","links":{"resolver":"https://pith.science/pith/5UEUHJQWYQXYNOXYU3274XJJSH","bundle":"https://pith.science/pith/5UEUHJQWYQXYNOXYU3274XJJSH/bundle.json","state":"https://pith.science/pith/5UEUHJQWYQXYNOXYU3274XJJSH/state.json","well_known_bundle":"https://pith.science/.well-known/pith/5UEUHJQWYQXYNOXYU3274XJJSH/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2019:5UEUHJQWYQXYNOXYU3274XJJSH","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"d0559e56df956057616e240c64880d96c9fe26e20d47c7ec2a466b466353f2dc","cross_cats_sorted":["cs.IR"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2019-03-12T18:31:21Z","title_canon_sha256":"5e9d738208af5242af39cadbd30a3c8c2ba7cd375b8d04af8265e241860702a3"},"schema_version":"1.0","source":{"id":"1904.02100","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"1904.02100","created_at":"2026-05-17T23:49:28Z"},{"alias_kind":"arxiv_version","alias_value":"1904.02100v1","created_at":"2026-05-17T23:49:28Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.1904.02100","created_at":"2026-05-17T23:49:28Z"},{"alias_kind":"pith_short_12","alias_value":"5UEUHJQWYQXY","created_at":"2026-05-18T12:33:10Z"},{"alias_kind":"pith_short_16","alias_value":"5UEUHJQWYQXYNOXY","created_at":"2026-05-18T12:33:10Z"},{"alias_kind":"pith_short_8","alias_value":"5UEUHJQW","created_at":"2026-05-18T12:33:10Z"}],"graph_snapshots":[{"event_id":"sha256:77c98874aaa8eb792097a628953c6124e023e4a8a80a9d26d7f261a57239e6dc","target":"graph","created_at":"2026-05-17T23:49:28Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"paper":{"abstract_excerpt":"Malicious software is detected and classified by either static analysis or dynamic analysis. In static analysis, malware samples are reverse engineered and analyzed so that signatures of malware can be constructed. These techniques can be easily thwarted through polymorphic, metamorphic malware, obfuscation and packing techniques, whereas in dynamic analysis malware samples are executed in a controlled environment using the sandboxing technique, in order to model the behavior of malware. In this paper, we have analyzed Petya, Spyeye, VolatileCedar, PAFISH etc. through Agent-based and Agentless","authors_text":"Bogdan Ghita, Maria Papadaki, Muhammad Ali, Stavros Shiaeles","cross_cats":["cs.IR"],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2019-03-12T18:31:21Z","title":"Agent-based Vs Agent-less Sandbox for Dynamic Behavioral Analysis"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"1904.02100","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:7218929d980a7b6a095f1c6f16892ac00637db47cc41ab02845f0611d7c640eb","target":"record","created_at":"2026-05-17T23:49:28Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"d0559e56df956057616e240c64880d96c9fe26e20d47c7ec2a466b466353f2dc","cross_cats_sorted":["cs.IR"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2019-03-12T18:31:21Z","title_canon_sha256":"5e9d738208af5242af39cadbd30a3c8c2ba7cd375b8d04af8265e241860702a3"},"schema_version":"1.0","source":{"id":"1904.02100","kind":"arxiv","version":1}},"canonical_sha256":"ed0943a616c42f86baf8a6f5fe5d2991e5c0f3d63a280852262600cb1da08663","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"ed0943a616c42f86baf8a6f5fe5d2991e5c0f3d63a280852262600cb1da08663","first_computed_at":"2026-05-17T23:49:28.455196Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-05-17T23:49:28.455196Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"3CaeTqSewWc0PtFm60GWjQDBILxuubJLNm4QVA4Mi+nq3viZDdTyqwAOTXPP7z1PfUoUgVQLHfChgVABkieSAA==","signature_status":"signed_v1","signed_at":"2026-05-17T23:49:28.455636Z","signed_message":"canonical_sha256_bytes"},"source_id":"1904.02100","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:7218929d980a7b6a095f1c6f16892ac00637db47cc41ab02845f0611d7c640eb","sha256:77c98874aaa8eb792097a628953c6124e023e4a8a80a9d26d7f261a57239e6dc"],"state_sha256":"e711a6bcddaf541f88c437ec5abdcabd72d3d08b4347a71c0914158a0c4ec5d6"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"tG3kkuyoqolFPllv23WCU4Bm4qfd0bR23vuwgbjKPbMB1BlT1kH3651UCdsbPXJRKtb/Lpgn2LGNiahCbnzRCQ==","signed_message":"bundle_sha256_bytes","signed_at":"2026-06-11T04:21:28.452537Z","bundle_sha256":"63cd4139ade273cd07e5fcc14e75b25d187db3a4defd6a8d116a06970f546283"}}