{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2021:6U62ODIHUUNW2DLK4H4G6DMUHT","short_pith_number":"pith:6U62ODIH","canonical_record":{"source":{"id":"2105.05510","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","primary_cat":"cs.CR","submitted_at":"2021-05-12T08:37:59Z","cross_cats_sorted":[],"title_canon_sha256":"0bd1b6122754d4684fccbd66b4a8de4a922cf2a96000ca546eaa4bf66c1edf82","abstract_canon_sha256":"a4df73f38de3e6b12ef188f02d0da2779e1ea59e74af7b2d3a9ee56373c91291"},"schema_version":"1.0"},"canonical_sha256":"f53da70d07a51b6d0d6ae1f86f0d943cd7d681ff978d5d309eee9cba9e50c2dc","source":{"kind":"arxiv","id":"2105.05510","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2105.05510","created_at":"2026-07-05T02:39:51Z"},{"alias_kind":"arxiv_version","alias_value":"2105.05510v1","created_at":"2026-07-05T02:39:51Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2105.05510","created_at":"2026-07-05T02:39:51Z"},{"alias_kind":"pith_short_12","alias_value":"6U62ODIHUUNW","created_at":"2026-07-05T02:39:51Z"},{"alias_kind":"pith_short_16","alias_value":"6U62ODIHUUNW2DLK","created_at":"2026-07-05T02:39:51Z"},{"alias_kind":"pith_short_8","alias_value":"6U62ODIH","created_at":"2026-07-05T02:39:51Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2021:6U62ODIHUUNW2DLK4H4G6DMUHT","target":"record","payload":{"canonical_record":{"source":{"id":"2105.05510","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","primary_cat":"cs.CR","submitted_at":"2021-05-12T08:37:59Z","cross_cats_sorted":[],"title_canon_sha256":"0bd1b6122754d4684fccbd66b4a8de4a922cf2a96000ca546eaa4bf66c1edf82","abstract_canon_sha256":"a4df73f38de3e6b12ef188f02d0da2779e1ea59e74af7b2d3a9ee56373c91291"},"schema_version":"1.0"},"canonical_sha256":"f53da70d07a51b6d0d6ae1f86f0d943cd7d681ff978d5d309eee9cba9e50c2dc","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T02:39:51.629780Z","signature_b64":"nbh6DQPqosLoCdveNdtfMHph+d+BhedXJL0ct+8nYHkzF8J750DLRMdWwTP169XRIJQ6rkV6eCQ+zN3wDFlxDA==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"f53da70d07a51b6d0d6ae1f86f0d943cd7d681ff978d5d309eee9cba9e50c2dc","last_reissued_at":"2026-07-05T02:39:51.629388Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T02:39:51.629388Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2105.05510","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T02:39:51Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"jZfFbgh35kQ3GQmXWtIaHDfpoqOpODzUtgFpq7gsFc0MzCpQyMk9qgj9QUIOvdM5HOd3pZ6xVGnpyNsXzS3VDw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-21T09:32:13.310229Z"},"content_sha256":"0a1eded3734f3ec07b8a86ca21c6599ec74b8183594f9a3d7c1a388fa80c2ee6","schema_version":"1.0","event_id":"sha256:0a1eded3734f3ec07b8a86ca21c6599ec74b8183594f9a3d7c1a388fa80c2ee6"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2021:6U62ODIHUUNW2DLK4H4G6DMUHT","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Responding to Living-Off-the-Land Tactics using Just-in-Time Memory Forensics (JIT-MF) for Android","license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","headline":"","cross_cats":[],"primary_cat":"cs.CR","authors_text":"Christian Colombo, Jennifer Bellizzi, Julio Hernandez-Castro, Mark Vella","submitted_at":"2021-05-12T08:37:59Z","abstract_excerpt":"Digital investigations of stealthy attacks on Android devices pose particular challenges to incident responders. Whereas consequential late detection demands accurate and comprehensive forensic timelines to reconstruct all malicious activities, reduced forensic footprints with minimal malware involvement, such as when Living-Off-the-Land (LOtL) tactics are adopted, leave investigators little evidence to work with. Volatile memory forensics can be an effective approach since app execution of any form is always bound to leave a trail of evidence in memory, even if perhaps ephemeral. Just-in-Time"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2105.05510","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2105.05510/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T02:39:51Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"dAnQQzT3vFxMiXsVic6r3fHvzJdDLtFX732EllvJp4MZJeBQ3o839N5P1ywBRFIvHxw41gDAM4ji5f57HTu1BA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-21T09:32:13.310740Z"},"content_sha256":"d01613d9ffe0d38a327cafc4c149d3c976c322ae3a3db56e847e7704326c9275","schema_version":"1.0","event_id":"sha256:d01613d9ffe0d38a327cafc4c149d3c976c322ae3a3db56e847e7704326c9275"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/6U62ODIHUUNW2DLK4H4G6DMUHT/bundle.json","state_url":"https://pith.science/pith/6U62ODIHUUNW2DLK4H4G6DMUHT/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/6U62ODIHUUNW2DLK4H4G6DMUHT/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-21T09:32:13Z","links":{"resolver":"https://pith.science/pith/6U62ODIHUUNW2DLK4H4G6DMUHT","bundle":"https://pith.science/pith/6U62ODIHUUNW2DLK4H4G6DMUHT/bundle.json","state":"https://pith.science/pith/6U62ODIHUUNW2DLK4H4G6DMUHT/state.json","well_known_bundle":"https://pith.science/.well-known/pith/6U62ODIHUUNW2DLK4H4G6DMUHT/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2021:6U62ODIHUUNW2DLK4H4G6DMUHT","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"a4df73f38de3e6b12ef188f02d0da2779e1ea59e74af7b2d3a9ee56373c91291","cross_cats_sorted":[],"license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","primary_cat":"cs.CR","submitted_at":"2021-05-12T08:37:59Z","title_canon_sha256":"0bd1b6122754d4684fccbd66b4a8de4a922cf2a96000ca546eaa4bf66c1edf82"},"schema_version":"1.0","source":{"id":"2105.05510","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2105.05510","created_at":"2026-07-05T02:39:51Z"},{"alias_kind":"arxiv_version","alias_value":"2105.05510v1","created_at":"2026-07-05T02:39:51Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2105.05510","created_at":"2026-07-05T02:39:51Z"},{"alias_kind":"pith_short_12","alias_value":"6U62ODIHUUNW","created_at":"2026-07-05T02:39:51Z"},{"alias_kind":"pith_short_16","alias_value":"6U62ODIHUUNW2DLK","created_at":"2026-07-05T02:39:51Z"},{"alias_kind":"pith_short_8","alias_value":"6U62ODIH","created_at":"2026-07-05T02:39:51Z"}],"graph_snapshots":[{"event_id":"sha256:d01613d9ffe0d38a327cafc4c149d3c976c322ae3a3db56e847e7704326c9275","target":"graph","created_at":"2026-07-05T02:39:51Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2105.05510/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Digital investigations of stealthy attacks on Android devices pose particular challenges to incident responders. Whereas consequential late detection demands accurate and comprehensive forensic timelines to reconstruct all malicious activities, reduced forensic footprints with minimal malware involvement, such as when Living-Off-the-Land (LOtL) tactics are adopted, leave investigators little evidence to work with. Volatile memory forensics can be an effective approach since app execution of any form is always bound to leave a trail of evidence in memory, even if perhaps ephemeral. Just-in-Time","authors_text":"Christian Colombo, Jennifer Bellizzi, Julio Hernandez-Castro, Mark Vella","cross_cats":[],"headline":"","license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","primary_cat":"cs.CR","submitted_at":"2021-05-12T08:37:59Z","title":"Responding to Living-Off-the-Land Tactics using Just-in-Time Memory Forensics (JIT-MF) for Android"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2105.05510","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:0a1eded3734f3ec07b8a86ca21c6599ec74b8183594f9a3d7c1a388fa80c2ee6","target":"record","created_at":"2026-07-05T02:39:51Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"a4df73f38de3e6b12ef188f02d0da2779e1ea59e74af7b2d3a9ee56373c91291","cross_cats_sorted":[],"license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","primary_cat":"cs.CR","submitted_at":"2021-05-12T08:37:59Z","title_canon_sha256":"0bd1b6122754d4684fccbd66b4a8de4a922cf2a96000ca546eaa4bf66c1edf82"},"schema_version":"1.0","source":{"id":"2105.05510","kind":"arxiv","version":1}},"canonical_sha256":"f53da70d07a51b6d0d6ae1f86f0d943cd7d681ff978d5d309eee9cba9e50c2dc","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"f53da70d07a51b6d0d6ae1f86f0d943cd7d681ff978d5d309eee9cba9e50c2dc","first_computed_at":"2026-07-05T02:39:51.629388Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T02:39:51.629388Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"nbh6DQPqosLoCdveNdtfMHph+d+BhedXJL0ct+8nYHkzF8J750DLRMdWwTP169XRIJQ6rkV6eCQ+zN3wDFlxDA==","signature_status":"signed_v1","signed_at":"2026-07-05T02:39:51.629780Z","signed_message":"canonical_sha256_bytes"},"source_id":"2105.05510","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:0a1eded3734f3ec07b8a86ca21c6599ec74b8183594f9a3d7c1a388fa80c2ee6","sha256:d01613d9ffe0d38a327cafc4c149d3c976c322ae3a3db56e847e7704326c9275"],"state_sha256":"23f97d7cabcc284ef113968de51ad9913c719dde3a80b08eef992111d38556a0"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"Kxw4/tzFmx9cGXt1tE0tp+3SQgGkBj3DybKXhaWTHPtNh6hoiXx8GhbskbhIKcRulYZTGnJ2DjE0bW1WzTs+AA==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-21T09:32:13.315234Z","bundle_sha256":"7b8ef33999bc6d12c0d3b7b22a56e59669323ffdcaac5020bf7627528f887af9"}}