{"record_type":"pith_number_record","schema_url":"https://pith.science/schemas/pith-number/v1.json","pith_number":"pith:2019:7P5M5TCQ3E72YTYBNLJY6UJ2H4","short_pith_number":"pith:7P5M5TCQ","schema_version":"1.0","canonical_sha256":"fbfacecc50d93fac4f016ad38f513a3f07b85352753410ab7849cd3fa655a5b1","source":{"kind":"arxiv","id":"1904.01371","version":3},"attestation_state":"computed","paper":{"title":"Beyond Labeling: Using Clustering to Build Network Behavioral Profiles of Malware Families","license":"http://creativecommons.org/licenses/by/4.0/","headline":"","cross_cats":[],"primary_cat":"cs.CR","authors_text":"Azqa Nadeem, Carlos H. Ga\\~n\\'an, Christian Hammerschmidt, Sicco Verwer","submitted_at":"2019-04-02T12:25:04Z","abstract_excerpt":"Malware family labels are known to be inconsistent. They are also black-box since they do not represent the capabilities of malware. The current state-of-the-art in malware capability assessment include mostly manual approaches, which are infeasible due to the ever-increasing volume of discovered malware samples. We propose a novel unsupervised machine learning-based method called MalPaCA, which automates capability assessment by clustering the temporal behavior in malware's network traces. MalPaCA provides meaningful behavioral clusters using only 20 packet headers. Behavioral profiles are ge"},"verification_status":{"content_addressed":true,"pith_receipt":true,"author_attested":false,"weak_author_claims":0,"strong_author_claims":0,"externally_anchored":false,"storage_verified":false,"citation_signatures":0,"replication_records":0,"graph_snapshot":true,"references_resolved":false,"formal_links_present":false},"canonical_record":{"source":{"id":"1904.01371","kind":"arxiv","version":3},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2019-04-02T12:25:04Z","cross_cats_sorted":[],"title_canon_sha256":"26876d63a0ac0c00c01998eb3caf42c5a8043ac38edd7b30ef1411523ccdfb51","abstract_canon_sha256":"50d55624e58529073e47018aa5cf72bc87d7ee1688403ba5bc0419a1cc93cbf6"},"schema_version":"1.0"},"receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T02:02:50.174214Z","signature_b64":"Bn3NgPnkJA42oyitCbBRLI/zVUTbxFowpa8W3G4qmF6MiZim8gZbejOYPbUsSCHjIRwvo0nefMgj+4pSsqcnDg==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"fbfacecc50d93fac4f016ad38f513a3f07b85352753410ab7849cd3fa655a5b1","last_reissued_at":"2026-07-05T02:02:50.173714Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T02:02:50.173714Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"graph_snapshot":{"paper":{"title":"Beyond Labeling: Using Clustering to Build Network Behavioral Profiles of Malware Families","license":"http://creativecommons.org/licenses/by/4.0/","headline":"","cross_cats":[],"primary_cat":"cs.CR","authors_text":"Azqa Nadeem, Carlos H. Ga\\~n\\'an, Christian Hammerschmidt, Sicco Verwer","submitted_at":"2019-04-02T12:25:04Z","abstract_excerpt":"Malware family labels are known to be inconsistent. They are also black-box since they do not represent the capabilities of malware. The current state-of-the-art in malware capability assessment include mostly manual approaches, which are infeasible due to the ever-increasing volume of discovered malware samples. We propose a novel unsupervised machine learning-based method called MalPaCA, which automates capability assessment by clustering the temporal behavior in malware's network traces. MalPaCA provides meaningful behavioral clusters using only 20 packet headers. Behavioral profiles are ge"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"1904.01371","kind":"arxiv","version":3},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/1904.01371/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"aliases":[{"alias_kind":"arxiv","alias_value":"1904.01371","created_at":"2026-07-05T02:02:50.173781+00:00"},{"alias_kind":"arxiv_version","alias_value":"1904.01371v3","created_at":"2026-07-05T02:02:50.173781+00:00"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.1904.01371","created_at":"2026-07-05T02:02:50.173781+00:00"},{"alias_kind":"pith_short_12","alias_value":"7P5M5TCQ3E72","created_at":"2026-07-05T02:02:50.173781+00:00"},{"alias_kind":"pith_short_16","alias_value":"7P5M5TCQ3E72YTYB","created_at":"2026-07-05T02:02:50.173781+00:00"},{"alias_kind":"pith_short_8","alias_value":"7P5M5TCQ","created_at":"2026-07-05T02:02:50.173781+00:00"}],"events":[],"event_summary":{},"paper_claims":[],"inbound_citations":{"count":0,"internal_anchor_count":0,"sample":[]},"formal_canon":{"evidence_count":0,"sample":[],"anchors":[]},"links":{"html":"https://pith.science/pith/7P5M5TCQ3E72YTYBNLJY6UJ2H4","json":"https://pith.science/pith/7P5M5TCQ3E72YTYBNLJY6UJ2H4.json","graph_json":"https://pith.science/api/pith-number/7P5M5TCQ3E72YTYBNLJY6UJ2H4/graph.json","events_json":"https://pith.science/api/pith-number/7P5M5TCQ3E72YTYBNLJY6UJ2H4/events.json","paper":"https://pith.science/paper/7P5M5TCQ"},"agent_actions":{"view_html":"https://pith.science/pith/7P5M5TCQ3E72YTYBNLJY6UJ2H4","download_json":"https://pith.science/pith/7P5M5TCQ3E72YTYBNLJY6UJ2H4.json","view_paper":"https://pith.science/paper/7P5M5TCQ","resolve_alias":"https://pith.science/api/pith-number/resolve?arxiv=1904.01371&json=true","fetch_graph":"https://pith.science/api/pith-number/7P5M5TCQ3E72YTYBNLJY6UJ2H4/graph.json","fetch_events":"https://pith.science/api/pith-number/7P5M5TCQ3E72YTYBNLJY6UJ2H4/events.json","actions":{"anchor_timestamp":"https://pith.science/pith/7P5M5TCQ3E72YTYBNLJY6UJ2H4/action/timestamp_anchor","attest_storage":"https://pith.science/pith/7P5M5TCQ3E72YTYBNLJY6UJ2H4/action/storage_attestation","attest_author":"https://pith.science/pith/7P5M5TCQ3E72YTYBNLJY6UJ2H4/action/author_attestation","sign_citation":"https://pith.science/pith/7P5M5TCQ3E72YTYBNLJY6UJ2H4/action/citation_signature","submit_replication":"https://pith.science/pith/7P5M5TCQ3E72YTYBNLJY6UJ2H4/action/replication_record"}},"created_at":"2026-07-05T02:02:50.173781+00:00","updated_at":"2026-07-05T02:02:50.173781+00:00"}