{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2018:6KJ4AZBPZX42XDXN23NXLULCD3","short_pith_number":"pith:6KJ4AZBP","canonical_record":{"source":{"id":"1803.01598","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2018-03-05T10:51:24Z","cross_cats_sorted":[],"title_canon_sha256":"3c25bd0b55c06cb519ee14378012ec95fa4c0c422d3c6ffe1f228ab06a90d41e","abstract_canon_sha256":"9aa124173f938173de2d086cff5fad195bf7ef234b94638b119b29b048238e1a"},"schema_version":"1.0"},"canonical_sha256":"f293c0642fcdf9ab8eedd6db75d1621eef356b2bcd6f5c2e287bf65d1b66f2de","source":{"kind":"arxiv","id":"1803.01598","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"1803.01598","created_at":"2026-05-18T00:22:00Z"},{"alias_kind":"arxiv_version","alias_value":"1803.01598v1","created_at":"2026-05-18T00:22:00Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.1803.01598","created_at":"2026-05-18T00:22:00Z"},{"alias_kind":"pith_short_12","alias_value":"6KJ4AZBPZX42","created_at":"2026-05-18T12:32:08Z"},{"alias_kind":"pith_short_16","alias_value":"6KJ4AZBPZX42XDXN","created_at":"2026-05-18T12:32:08Z"},{"alias_kind":"pith_short_8","alias_value":"6KJ4AZBP","created_at":"2026-05-18T12:32:08Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2018:6KJ4AZBPZX42XDXN23NXLULCD3","target":"record","payload":{"canonical_record":{"source":{"id":"1803.01598","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2018-03-05T10:51:24Z","cross_cats_sorted":[],"title_canon_sha256":"3c25bd0b55c06cb519ee14378012ec95fa4c0c422d3c6ffe1f228ab06a90d41e","abstract_canon_sha256":"9aa124173f938173de2d086cff5fad195bf7ef234b94638b119b29b048238e1a"},"schema_version":"1.0"},"canonical_sha256":"f293c0642fcdf9ab8eedd6db75d1621eef356b2bcd6f5c2e287bf65d1b66f2de","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-05-18T00:22:00.124087Z","signature_b64":"7lHMBTB2Tjp+54/pHTLi0qkpsZJkKLSkc4c0SYk2BuQWApC4e9dGP4iOid2clhzNeW+eHyCV0ZSC2BxV4sfzDw==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"f293c0642fcdf9ab8eedd6db75d1621eef356b2bcd6f5c2e287bf65d1b66f2de","last_reissued_at":"2026-05-18T00:22:00.123383Z","signature_status":"signed_v1","first_computed_at":"2026-05-18T00:22:00.123383Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"1803.01598","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-05-18T00:22:00Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"IAkTgknutcdHQlaIWfuyP0b4H4sld5CUGVnxa+/mFjLzmL3SUxjgP7xSzTKY0w4F/gUbJEawnjA3ZgWomDe2Bg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-06-03T06:52:03.982053Z"},"content_sha256":"c8ca46ab4b7626a5ef10dc83a663e044c01ac21bafc567df4f9a56a65fdc252e","schema_version":"1.0","event_id":"sha256:c8ca46ab4b7626a5ef10dc83a663e044c01ac21bafc567df4f9a56a65fdc252e"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2018:6KJ4AZBPZX42XDXN23NXLULCD3","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"RAPTOR: Ransomware Attack PredicTOR","license":"http://creativecommons.org/licenses/by/4.0/","headline":"","cross_cats":[],"primary_cat":"cs.CR","authors_text":"Emilio Ferrara, Florian Quinkert, Kristina Lerman, KSM Tozammel Hossain, Thorsten Holz","submitted_at":"2018-03-05T10:51:24Z","abstract_excerpt":"Ransomware, a type of malicious software that encrypts a victim's files and only releases the cryptographic key once a ransom is paid, has emerged as a potentially devastating class of cybercrimes in the past few years. In this paper, we present RAPTOR, a promising line of defense against ransomware attacks. RAPTOR fingerprints attackers' operations to forecast ransomware activity. More specifically, our method learns features of malicious domains by looking at examples of domains involved in known ransomware attacks, and then monitors newly registered domains to identify potentially malicious"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"1803.01598","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-05-18T00:22:00Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"Wf9zXMSYfgzFM+6S97ajCr+lb3LZKbHNXAjun4QLi3lhe1CKqpInFDORDa0mw0JbgUPWNwycILaTCBtU8tUHBQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-06-03T06:52:03.982421Z"},"content_sha256":"326e27d3881d2c73600269cada0cca62c271d8adfa550f8590de191253284461","schema_version":"1.0","event_id":"sha256:326e27d3881d2c73600269cada0cca62c271d8adfa550f8590de191253284461"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/6KJ4AZBPZX42XDXN23NXLULCD3/bundle.json","state_url":"https://pith.science/pith/6KJ4AZBPZX42XDXN23NXLULCD3/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/6KJ4AZBPZX42XDXN23NXLULCD3/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-06-03T06:52:03Z","links":{"resolver":"https://pith.science/pith/6KJ4AZBPZX42XDXN23NXLULCD3","bundle":"https://pith.science/pith/6KJ4AZBPZX42XDXN23NXLULCD3/bundle.json","state":"https://pith.science/pith/6KJ4AZBPZX42XDXN23NXLULCD3/state.json","well_known_bundle":"https://pith.science/.well-known/pith/6KJ4AZBPZX42XDXN23NXLULCD3/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2018:6KJ4AZBPZX42XDXN23NXLULCD3","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"9aa124173f938173de2d086cff5fad195bf7ef234b94638b119b29b048238e1a","cross_cats_sorted":[],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2018-03-05T10:51:24Z","title_canon_sha256":"3c25bd0b55c06cb519ee14378012ec95fa4c0c422d3c6ffe1f228ab06a90d41e"},"schema_version":"1.0","source":{"id":"1803.01598","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"1803.01598","created_at":"2026-05-18T00:22:00Z"},{"alias_kind":"arxiv_version","alias_value":"1803.01598v1","created_at":"2026-05-18T00:22:00Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.1803.01598","created_at":"2026-05-18T00:22:00Z"},{"alias_kind":"pith_short_12","alias_value":"6KJ4AZBPZX42","created_at":"2026-05-18T12:32:08Z"},{"alias_kind":"pith_short_16","alias_value":"6KJ4AZBPZX42XDXN","created_at":"2026-05-18T12:32:08Z"},{"alias_kind":"pith_short_8","alias_value":"6KJ4AZBP","created_at":"2026-05-18T12:32:08Z"}],"graph_snapshots":[{"event_id":"sha256:326e27d3881d2c73600269cada0cca62c271d8adfa550f8590de191253284461","target":"graph","created_at":"2026-05-18T00:22:00Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"paper":{"abstract_excerpt":"Ransomware, a type of malicious software that encrypts a victim's files and only releases the cryptographic key once a ransom is paid, has emerged as a potentially devastating class of cybercrimes in the past few years. In this paper, we present RAPTOR, a promising line of defense against ransomware attacks. RAPTOR fingerprints attackers' operations to forecast ransomware activity. More specifically, our method learns features of malicious domains by looking at examples of domains involved in known ransomware attacks, and then monitors newly registered domains to identify potentially malicious","authors_text":"Emilio Ferrara, Florian Quinkert, Kristina Lerman, KSM Tozammel Hossain, Thorsten Holz","cross_cats":[],"headline":"","license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2018-03-05T10:51:24Z","title":"RAPTOR: Ransomware Attack PredicTOR"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"1803.01598","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:c8ca46ab4b7626a5ef10dc83a663e044c01ac21bafc567df4f9a56a65fdc252e","target":"record","created_at":"2026-05-18T00:22:00Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"9aa124173f938173de2d086cff5fad195bf7ef234b94638b119b29b048238e1a","cross_cats_sorted":[],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2018-03-05T10:51:24Z","title_canon_sha256":"3c25bd0b55c06cb519ee14378012ec95fa4c0c422d3c6ffe1f228ab06a90d41e"},"schema_version":"1.0","source":{"id":"1803.01598","kind":"arxiv","version":1}},"canonical_sha256":"f293c0642fcdf9ab8eedd6db75d1621eef356b2bcd6f5c2e287bf65d1b66f2de","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"f293c0642fcdf9ab8eedd6db75d1621eef356b2bcd6f5c2e287bf65d1b66f2de","first_computed_at":"2026-05-18T00:22:00.123383Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-05-18T00:22:00.123383Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"7lHMBTB2Tjp+54/pHTLi0qkpsZJkKLSkc4c0SYk2BuQWApC4e9dGP4iOid2clhzNeW+eHyCV0ZSC2BxV4sfzDw==","signature_status":"signed_v1","signed_at":"2026-05-18T00:22:00.124087Z","signed_message":"canonical_sha256_bytes"},"source_id":"1803.01598","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:c8ca46ab4b7626a5ef10dc83a663e044c01ac21bafc567df4f9a56a65fdc252e","sha256:326e27d3881d2c73600269cada0cca62c271d8adfa550f8590de191253284461"],"state_sha256":"12f4a5cb72421be2939f06a8f963148ce6a7f57589ad05a6621a46f96468bf71"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"m0aN7ReaEFausH2QLPLpIZ21Av4tGk+UaQluNhTyg+7mtazmSNMtLnYHuzHhqFe7uHnImjPZHQC80B53GRayAw==","signed_message":"bundle_sha256_bytes","signed_at":"2026-06-03T06:52:03.984396Z","bundle_sha256":"28735984f2d2e86d6e266d24381636d4596504be562b5a67bb7328522a2e39ec"}}