{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2022:7CTO5KQ5MC3QS4Y7H5VTTQDYWR","short_pith_number":"pith:7CTO5KQ5","canonical_record":{"source":{"id":"2204.04084","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2022-04-08T14:01:58Z","cross_cats_sorted":[],"title_canon_sha256":"a7f59c6cbb3ca855ffd4d00a7066fedf3a5516490c313a06f7446067e85fb885","abstract_canon_sha256":"81a1eddfaf3977d29958b1cd3e74813d87a78b1bc2bf143ca133023f93905592"},"schema_version":"1.0"},"canonical_sha256":"f8a6eeaa1d60b709731f3f6b39c078b45cf46e1a63f70cc59798fbcb5ae5de34","source":{"kind":"arxiv","id":"2204.04084","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2204.04084","created_at":"2026-07-05T04:12:45Z"},{"alias_kind":"arxiv_version","alias_value":"2204.04084v1","created_at":"2026-07-05T04:12:45Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2204.04084","created_at":"2026-07-05T04:12:45Z"},{"alias_kind":"pith_short_12","alias_value":"7CTO5KQ5MC3Q","created_at":"2026-07-05T04:12:45Z"},{"alias_kind":"pith_short_16","alias_value":"7CTO5KQ5MC3QS4Y7","created_at":"2026-07-05T04:12:45Z"},{"alias_kind":"pith_short_8","alias_value":"7CTO5KQ5","created_at":"2026-07-05T04:12:45Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2022:7CTO5KQ5MC3QS4Y7H5VTTQDYWR","target":"record","payload":{"canonical_record":{"source":{"id":"2204.04084","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2022-04-08T14:01:58Z","cross_cats_sorted":[],"title_canon_sha256":"a7f59c6cbb3ca855ffd4d00a7066fedf3a5516490c313a06f7446067e85fb885","abstract_canon_sha256":"81a1eddfaf3977d29958b1cd3e74813d87a78b1bc2bf143ca133023f93905592"},"schema_version":"1.0"},"canonical_sha256":"f8a6eeaa1d60b709731f3f6b39c078b45cf46e1a63f70cc59798fbcb5ae5de34","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T04:12:45.247334Z","signature_b64":"K0YgVM4KnAk6Y2Kt6B+cRZAqPKA8AOQhIhcg7id+Ir9IuFH2AePOaIhDBGez4kV+c6vmn12swJ+z30aY75lGDg==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"f8a6eeaa1d60b709731f3f6b39c078b45cf46e1a63f70cc59798fbcb5ae5de34","last_reissued_at":"2026-07-05T04:12:45.246900Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T04:12:45.246900Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2204.04084","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T04:12:45Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"z9HZDTjiGkslNSs7omHTiKlgKU3dMwQ32wWuPt9EozSRVIqNKHt6gM2T8l/II5k7KgFjANCmC+0ubiPrYxCVAQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-15T00:21:16.570123Z"},"content_sha256":"2b9602b34e788ed9c552c13fafb5e95ed686483e8348c7485a8c94426b51a038","schema_version":"1.0","event_id":"sha256:2b9602b34e788ed9c552c13fafb5e95ed686483e8348c7485a8c94426b51a038"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2022:7CTO5KQ5MC3QS4Y7H5VTTQDYWR","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"On the Effectiveness of Binary Emulation in Malware Classification","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":[],"primary_cat":"cs.CR","authors_text":"Constantinos Patsakis, Fran Casino, Vasilis Vouvoutsis","submitted_at":"2022-04-08T14:01:58Z","abstract_excerpt":"Malware authors are continuously evolving their code base to include counter-analysis methods that can significantly hinder their detection and blocking. While the execution of malware in a sandboxed environment may provide a lot of insightful feedback about what the malware actually does in a machine, anti-virtualisation and hooking evasion methods may allow malware to bypass such detection methods. The main objective of this work is to complement sandbox execution with the use of binary emulation frameworks. The core idea is to exploit the fact that binary emulation frameworks may quickly te"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2204.04084","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2204.04084/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T04:12:45Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"WxqTLQf2f/l7ZIZfDz/D2wUr4t+g/YE/C9Z3XmUpVh8Jb9QN+JIfmJp5bSZO+q6HoxjX58NX/gdw42tJfFISBg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-15T00:21:16.571462Z"},"content_sha256":"11e3e34fe13fe0ca5629fecbb62269cb8f0594fc3bd1cae1e9211f2486e92b79","schema_version":"1.0","event_id":"sha256:11e3e34fe13fe0ca5629fecbb62269cb8f0594fc3bd1cae1e9211f2486e92b79"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/7CTO5KQ5MC3QS4Y7H5VTTQDYWR/bundle.json","state_url":"https://pith.science/pith/7CTO5KQ5MC3QS4Y7H5VTTQDYWR/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/7CTO5KQ5MC3QS4Y7H5VTTQDYWR/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-15T00:21:16Z","links":{"resolver":"https://pith.science/pith/7CTO5KQ5MC3QS4Y7H5VTTQDYWR","bundle":"https://pith.science/pith/7CTO5KQ5MC3QS4Y7H5VTTQDYWR/bundle.json","state":"https://pith.science/pith/7CTO5KQ5MC3QS4Y7H5VTTQDYWR/state.json","well_known_bundle":"https://pith.science/.well-known/pith/7CTO5KQ5MC3QS4Y7H5VTTQDYWR/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2022:7CTO5KQ5MC3QS4Y7H5VTTQDYWR","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"81a1eddfaf3977d29958b1cd3e74813d87a78b1bc2bf143ca133023f93905592","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2022-04-08T14:01:58Z","title_canon_sha256":"a7f59c6cbb3ca855ffd4d00a7066fedf3a5516490c313a06f7446067e85fb885"},"schema_version":"1.0","source":{"id":"2204.04084","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2204.04084","created_at":"2026-07-05T04:12:45Z"},{"alias_kind":"arxiv_version","alias_value":"2204.04084v1","created_at":"2026-07-05T04:12:45Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2204.04084","created_at":"2026-07-05T04:12:45Z"},{"alias_kind":"pith_short_12","alias_value":"7CTO5KQ5MC3Q","created_at":"2026-07-05T04:12:45Z"},{"alias_kind":"pith_short_16","alias_value":"7CTO5KQ5MC3QS4Y7","created_at":"2026-07-05T04:12:45Z"},{"alias_kind":"pith_short_8","alias_value":"7CTO5KQ5","created_at":"2026-07-05T04:12:45Z"}],"graph_snapshots":[{"event_id":"sha256:11e3e34fe13fe0ca5629fecbb62269cb8f0594fc3bd1cae1e9211f2486e92b79","target":"graph","created_at":"2026-07-05T04:12:45Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2204.04084/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Malware authors are continuously evolving their code base to include counter-analysis methods that can significantly hinder their detection and blocking. While the execution of malware in a sandboxed environment may provide a lot of insightful feedback about what the malware actually does in a machine, anti-virtualisation and hooking evasion methods may allow malware to bypass such detection methods. The main objective of this work is to complement sandbox execution with the use of binary emulation frameworks. The core idea is to exploit the fact that binary emulation frameworks may quickly te","authors_text":"Constantinos Patsakis, Fran Casino, Vasilis Vouvoutsis","cross_cats":[],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2022-04-08T14:01:58Z","title":"On the Effectiveness of Binary Emulation in Malware Classification"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2204.04084","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:2b9602b34e788ed9c552c13fafb5e95ed686483e8348c7485a8c94426b51a038","target":"record","created_at":"2026-07-05T04:12:45Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"81a1eddfaf3977d29958b1cd3e74813d87a78b1bc2bf143ca133023f93905592","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2022-04-08T14:01:58Z","title_canon_sha256":"a7f59c6cbb3ca855ffd4d00a7066fedf3a5516490c313a06f7446067e85fb885"},"schema_version":"1.0","source":{"id":"2204.04084","kind":"arxiv","version":1}},"canonical_sha256":"f8a6eeaa1d60b709731f3f6b39c078b45cf46e1a63f70cc59798fbcb5ae5de34","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"f8a6eeaa1d60b709731f3f6b39c078b45cf46e1a63f70cc59798fbcb5ae5de34","first_computed_at":"2026-07-05T04:12:45.246900Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T04:12:45.246900Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"K0YgVM4KnAk6Y2Kt6B+cRZAqPKA8AOQhIhcg7id+Ir9IuFH2AePOaIhDBGez4kV+c6vmn12swJ+z30aY75lGDg==","signature_status":"signed_v1","signed_at":"2026-07-05T04:12:45.247334Z","signed_message":"canonical_sha256_bytes"},"source_id":"2204.04084","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:2b9602b34e788ed9c552c13fafb5e95ed686483e8348c7485a8c94426b51a038","sha256:11e3e34fe13fe0ca5629fecbb62269cb8f0594fc3bd1cae1e9211f2486e92b79"],"state_sha256":"13df087326427f66f6298fb22d47cc19f7aa79bf546eaacf677ea5118c935a00"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"6wUk1BgeOf8iwJDJWr3lJKm9nTqWvo2xlg/hoTnnnpjTavYLPKf2GrzCnlVTj6RRC5HBlQi34FcUWwArQbiRDg==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-15T00:21:16.579277Z","bundle_sha256":"33292e4d2233cf9eabf65fed7b3b5275e0ebd2baa4ec7734d1eda0511b9bdbc3"}}