{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2019:7P5M5TCQ3E72YTYBNLJY6UJ2H4","short_pith_number":"pith:7P5M5TCQ","canonical_record":{"source":{"id":"1904.01371","kind":"arxiv","version":3},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2019-04-02T12:25:04Z","cross_cats_sorted":[],"title_canon_sha256":"26876d63a0ac0c00c01998eb3caf42c5a8043ac38edd7b30ef1411523ccdfb51","abstract_canon_sha256":"50d55624e58529073e47018aa5cf72bc87d7ee1688403ba5bc0419a1cc93cbf6"},"schema_version":"1.0"},"canonical_sha256":"fbfacecc50d93fac4f016ad38f513a3f07b85352753410ab7849cd3fa655a5b1","source":{"kind":"arxiv","id":"1904.01371","version":3},"source_aliases":[{"alias_kind":"arxiv","alias_value":"1904.01371","created_at":"2026-07-05T02:02:50Z"},{"alias_kind":"arxiv_version","alias_value":"1904.01371v3","created_at":"2026-07-05T02:02:50Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.1904.01371","created_at":"2026-07-05T02:02:50Z"},{"alias_kind":"pith_short_12","alias_value":"7P5M5TCQ3E72","created_at":"2026-07-05T02:02:50Z"},{"alias_kind":"pith_short_16","alias_value":"7P5M5TCQ3E72YTYB","created_at":"2026-07-05T02:02:50Z"},{"alias_kind":"pith_short_8","alias_value":"7P5M5TCQ","created_at":"2026-07-05T02:02:50Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2019:7P5M5TCQ3E72YTYBNLJY6UJ2H4","target":"record","payload":{"canonical_record":{"source":{"id":"1904.01371","kind":"arxiv","version":3},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2019-04-02T12:25:04Z","cross_cats_sorted":[],"title_canon_sha256":"26876d63a0ac0c00c01998eb3caf42c5a8043ac38edd7b30ef1411523ccdfb51","abstract_canon_sha256":"50d55624e58529073e47018aa5cf72bc87d7ee1688403ba5bc0419a1cc93cbf6"},"schema_version":"1.0"},"canonical_sha256":"fbfacecc50d93fac4f016ad38f513a3f07b85352753410ab7849cd3fa655a5b1","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T02:02:50.174214Z","signature_b64":"Bn3NgPnkJA42oyitCbBRLI/zVUTbxFowpa8W3G4qmF6MiZim8gZbejOYPbUsSCHjIRwvo0nefMgj+4pSsqcnDg==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"fbfacecc50d93fac4f016ad38f513a3f07b85352753410ab7849cd3fa655a5b1","last_reissued_at":"2026-07-05T02:02:50.173714Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T02:02:50.173714Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"1904.01371","source_version":3,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T02:02:50Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"1o1wvJKDrbbULN/CWqaeIlFyhUavthuLj541zjXT95gxdcHuD0VVyuBvaXI1bEjq+4S2tsyONNethTkiMCHvBw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-05T16:32:58.304178Z"},"content_sha256":"4f0f4693cad0aa0fac4fa5d50e0375647b9973193bdb6aeb24684526780aad32","schema_version":"1.0","event_id":"sha256:4f0f4693cad0aa0fac4fa5d50e0375647b9973193bdb6aeb24684526780aad32"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2019:7P5M5TCQ3E72YTYBNLJY6UJ2H4","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Beyond Labeling: Using Clustering to Build Network Behavioral Profiles of Malware Families","license":"http://creativecommons.org/licenses/by/4.0/","headline":"","cross_cats":[],"primary_cat":"cs.CR","authors_text":"Azqa Nadeem, Carlos H. Ga\\~n\\'an, Christian Hammerschmidt, Sicco Verwer","submitted_at":"2019-04-02T12:25:04Z","abstract_excerpt":"Malware family labels are known to be inconsistent. They are also black-box since they do not represent the capabilities of malware. The current state-of-the-art in malware capability assessment include mostly manual approaches, which are infeasible due to the ever-increasing volume of discovered malware samples. We propose a novel unsupervised machine learning-based method called MalPaCA, which automates capability assessment by clustering the temporal behavior in malware's network traces. MalPaCA provides meaningful behavioral clusters using only 20 packet headers. Behavioral profiles are ge"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"1904.01371","kind":"arxiv","version":3},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/1904.01371/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T02:02:50Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"pqRI1heZsqFq4Tcws45HyTLymrOYbpy2Gke3Ip5r6qvzgP1pEUNtmPdRbnevuDp1EwO6rsGKPD5AMAIafxa5DA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-05T16:32:58.305229Z"},"content_sha256":"116e08cc872800394a654d46968bdd7b9894aa13174663303fb7de98cd545568","schema_version":"1.0","event_id":"sha256:116e08cc872800394a654d46968bdd7b9894aa13174663303fb7de98cd545568"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/7P5M5TCQ3E72YTYBNLJY6UJ2H4/bundle.json","state_url":"https://pith.science/pith/7P5M5TCQ3E72YTYBNLJY6UJ2H4/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/7P5M5TCQ3E72YTYBNLJY6UJ2H4/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-05T16:32:58Z","links":{"resolver":"https://pith.science/pith/7P5M5TCQ3E72YTYBNLJY6UJ2H4","bundle":"https://pith.science/pith/7P5M5TCQ3E72YTYBNLJY6UJ2H4/bundle.json","state":"https://pith.science/pith/7P5M5TCQ3E72YTYBNLJY6UJ2H4/state.json","well_known_bundle":"https://pith.science/.well-known/pith/7P5M5TCQ3E72YTYBNLJY6UJ2H4/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2019:7P5M5TCQ3E72YTYBNLJY6UJ2H4","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"50d55624e58529073e47018aa5cf72bc87d7ee1688403ba5bc0419a1cc93cbf6","cross_cats_sorted":[],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2019-04-02T12:25:04Z","title_canon_sha256":"26876d63a0ac0c00c01998eb3caf42c5a8043ac38edd7b30ef1411523ccdfb51"},"schema_version":"1.0","source":{"id":"1904.01371","kind":"arxiv","version":3}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"1904.01371","created_at":"2026-07-05T02:02:50Z"},{"alias_kind":"arxiv_version","alias_value":"1904.01371v3","created_at":"2026-07-05T02:02:50Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.1904.01371","created_at":"2026-07-05T02:02:50Z"},{"alias_kind":"pith_short_12","alias_value":"7P5M5TCQ3E72","created_at":"2026-07-05T02:02:50Z"},{"alias_kind":"pith_short_16","alias_value":"7P5M5TCQ3E72YTYB","created_at":"2026-07-05T02:02:50Z"},{"alias_kind":"pith_short_8","alias_value":"7P5M5TCQ","created_at":"2026-07-05T02:02:50Z"}],"graph_snapshots":[{"event_id":"sha256:116e08cc872800394a654d46968bdd7b9894aa13174663303fb7de98cd545568","target":"graph","created_at":"2026-07-05T02:02:50Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/1904.01371/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Malware family labels are known to be inconsistent. They are also black-box since they do not represent the capabilities of malware. The current state-of-the-art in malware capability assessment include mostly manual approaches, which are infeasible due to the ever-increasing volume of discovered malware samples. We propose a novel unsupervised machine learning-based method called MalPaCA, which automates capability assessment by clustering the temporal behavior in malware's network traces. MalPaCA provides meaningful behavioral clusters using only 20 packet headers. Behavioral profiles are ge","authors_text":"Azqa Nadeem, Carlos H. Ga\\~n\\'an, Christian Hammerschmidt, Sicco Verwer","cross_cats":[],"headline":"","license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2019-04-02T12:25:04Z","title":"Beyond Labeling: Using Clustering to Build Network Behavioral Profiles of Malware Families"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"1904.01371","kind":"arxiv","version":3},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:4f0f4693cad0aa0fac4fa5d50e0375647b9973193bdb6aeb24684526780aad32","target":"record","created_at":"2026-07-05T02:02:50Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"50d55624e58529073e47018aa5cf72bc87d7ee1688403ba5bc0419a1cc93cbf6","cross_cats_sorted":[],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2019-04-02T12:25:04Z","title_canon_sha256":"26876d63a0ac0c00c01998eb3caf42c5a8043ac38edd7b30ef1411523ccdfb51"},"schema_version":"1.0","source":{"id":"1904.01371","kind":"arxiv","version":3}},"canonical_sha256":"fbfacecc50d93fac4f016ad38f513a3f07b85352753410ab7849cd3fa655a5b1","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"fbfacecc50d93fac4f016ad38f513a3f07b85352753410ab7849cd3fa655a5b1","first_computed_at":"2026-07-05T02:02:50.173714Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T02:02:50.173714Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"Bn3NgPnkJA42oyitCbBRLI/zVUTbxFowpa8W3G4qmF6MiZim8gZbejOYPbUsSCHjIRwvo0nefMgj+4pSsqcnDg==","signature_status":"signed_v1","signed_at":"2026-07-05T02:02:50.174214Z","signed_message":"canonical_sha256_bytes"},"source_id":"1904.01371","source_kind":"arxiv","source_version":3}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:4f0f4693cad0aa0fac4fa5d50e0375647b9973193bdb6aeb24684526780aad32","sha256:116e08cc872800394a654d46968bdd7b9894aa13174663303fb7de98cd545568"],"state_sha256":"20f3ba45aff992ac9465795d16767e2f53058f0068df102d45b374564559158b"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"UebzjfyGbl7myv1b3YdcD0NWEpTsor1cXSGIFOCP3eDbr6ZTXaMiYLAwbQpIXhiTHb4TGY+6yFsn+a8Kmz6rCg==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-05T16:32:58.320086Z","bundle_sha256":"c50a149bb5a93480d772189d2a80e73b8fd3903700dc2871c00ad6ee684cad11"}}