{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2021:BVEP5LIBBYGJCME3PTVLYTJNNN","short_pith_number":"pith:BVEP5LIB","canonical_record":{"source":{"id":"2101.07328","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2021-01-18T21:06:52Z","cross_cats_sorted":[],"title_canon_sha256":"dbeea5844c8438d2618c578bf3053e628afcbec2990cc6dda54c51520941c9ba","abstract_canon_sha256":"a266ca66395a6101a227b286d0811238619287db8cbc116ae9096117f191ac10"},"schema_version":"1.0"},"canonical_sha256":"0d48fead010e0c91309b7ceabc4d2d6b582931567bc255832e43a39a2be97627","source":{"kind":"arxiv","id":"2101.07328","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2101.07328","created_at":"2026-07-05T02:07:56Z"},{"alias_kind":"arxiv_version","alias_value":"2101.07328v1","created_at":"2026-07-05T02:07:56Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2101.07328","created_at":"2026-07-05T02:07:56Z"},{"alias_kind":"pith_short_12","alias_value":"BVEP5LIBBYGJ","created_at":"2026-07-05T02:07:56Z"},{"alias_kind":"pith_short_16","alias_value":"BVEP5LIBBYGJCME3","created_at":"2026-07-05T02:07:56Z"},{"alias_kind":"pith_short_8","alias_value":"BVEP5LIB","created_at":"2026-07-05T02:07:56Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2021:BVEP5LIBBYGJCME3PTVLYTJNNN","target":"record","payload":{"canonical_record":{"source":{"id":"2101.07328","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2021-01-18T21:06:52Z","cross_cats_sorted":[],"title_canon_sha256":"dbeea5844c8438d2618c578bf3053e628afcbec2990cc6dda54c51520941c9ba","abstract_canon_sha256":"a266ca66395a6101a227b286d0811238619287db8cbc116ae9096117f191ac10"},"schema_version":"1.0"},"canonical_sha256":"0d48fead010e0c91309b7ceabc4d2d6b582931567bc255832e43a39a2be97627","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T02:07:56.825335Z","signature_b64":"45EV4KhuXnZe5sQqL8iPnO0Mb7UAL39D6Q/4BGaQi8KEJtmO0ZI49Uloe2Cq//v7bilrnvIoQ77Cz57t4FSbDA==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"0d48fead010e0c91309b7ceabc4d2d6b582931567bc255832e43a39a2be97627","last_reissued_at":"2026-07-05T02:07:56.824922Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T02:07:56.824922Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2101.07328","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T02:07:56Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"3F7KlpAuN+MsCCW05wemu/mFNCATu1JwcRWga7rs14WsFlEV+SYH4pxXSbyR1o6ovhDPn/244ju0+xr3HNe4Aw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-07T01:05:17.991608Z"},"content_sha256":"94f3b8be9957c54a665e1014848ade08d08a399bf399717c5cac13dff7a10a79","schema_version":"1.0","event_id":"sha256:94f3b8be9957c54a665e1014848ade08d08a399bf399717c5cac13dff7a10a79"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2021:BVEP5LIBBYGJCME3PTVLYTJNNN","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"MIMOSA: Reducing Malware Analysis Overhead with Coverings","license":"http://creativecommons.org/licenses/by/4.0/","headline":"","cross_cats":[],"primary_cat":"cs.CR","authors_text":"Kevin Leach, Mohsen Ahmadi, Ryan Dougherty, Stephanie Forrest, Westley Weimer","submitted_at":"2021-01-18T21:06:52Z","abstract_excerpt":"There is a growing body of malware samples that evade automated analysis and detection tools. Malware may measure fingerprints (\"artifacts\") of the underlying analysis tool or environment and change their behavior when artifacts are detected. While analysis tools can mitigate artifacts to reduce exposure, such concealment is expensive. However, not every sample checks for every type of artifact-analysis efficiency can be improved by mitigating only those artifacts most likely to be used by a sample. Using that insight, we propose MIMOSA, a system that identifies a small set of \"covering\" tool "},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2101.07328","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2101.07328/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T02:07:56Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"xId6fcS3Af1PokLw21M6Nswej9GtCZJtfnsfC9MQCMuee3GyV1U7/NaS7TFFhGEy1aFTlGWodJslb30i9XSOBA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-07T01:05:17.992094Z"},"content_sha256":"3cb22ac56ee2f7f069af04e69c277ea0cdedd89ad4ba41a3beee54a622c18fc8","schema_version":"1.0","event_id":"sha256:3cb22ac56ee2f7f069af04e69c277ea0cdedd89ad4ba41a3beee54a622c18fc8"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/BVEP5LIBBYGJCME3PTVLYTJNNN/bundle.json","state_url":"https://pith.science/pith/BVEP5LIBBYGJCME3PTVLYTJNNN/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/BVEP5LIBBYGJCME3PTVLYTJNNN/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-07T01:05:17Z","links":{"resolver":"https://pith.science/pith/BVEP5LIBBYGJCME3PTVLYTJNNN","bundle":"https://pith.science/pith/BVEP5LIBBYGJCME3PTVLYTJNNN/bundle.json","state":"https://pith.science/pith/BVEP5LIBBYGJCME3PTVLYTJNNN/state.json","well_known_bundle":"https://pith.science/.well-known/pith/BVEP5LIBBYGJCME3PTVLYTJNNN/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2021:BVEP5LIBBYGJCME3PTVLYTJNNN","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"a266ca66395a6101a227b286d0811238619287db8cbc116ae9096117f191ac10","cross_cats_sorted":[],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2021-01-18T21:06:52Z","title_canon_sha256":"dbeea5844c8438d2618c578bf3053e628afcbec2990cc6dda54c51520941c9ba"},"schema_version":"1.0","source":{"id":"2101.07328","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2101.07328","created_at":"2026-07-05T02:07:56Z"},{"alias_kind":"arxiv_version","alias_value":"2101.07328v1","created_at":"2026-07-05T02:07:56Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2101.07328","created_at":"2026-07-05T02:07:56Z"},{"alias_kind":"pith_short_12","alias_value":"BVEP5LIBBYGJ","created_at":"2026-07-05T02:07:56Z"},{"alias_kind":"pith_short_16","alias_value":"BVEP5LIBBYGJCME3","created_at":"2026-07-05T02:07:56Z"},{"alias_kind":"pith_short_8","alias_value":"BVEP5LIB","created_at":"2026-07-05T02:07:56Z"}],"graph_snapshots":[{"event_id":"sha256:3cb22ac56ee2f7f069af04e69c277ea0cdedd89ad4ba41a3beee54a622c18fc8","target":"graph","created_at":"2026-07-05T02:07:56Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2101.07328/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"There is a growing body of malware samples that evade automated analysis and detection tools. Malware may measure fingerprints (\"artifacts\") of the underlying analysis tool or environment and change their behavior when artifacts are detected. While analysis tools can mitigate artifacts to reduce exposure, such concealment is expensive. However, not every sample checks for every type of artifact-analysis efficiency can be improved by mitigating only those artifacts most likely to be used by a sample. Using that insight, we propose MIMOSA, a system that identifies a small set of \"covering\" tool ","authors_text":"Kevin Leach, Mohsen Ahmadi, Ryan Dougherty, Stephanie Forrest, Westley Weimer","cross_cats":[],"headline":"","license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2021-01-18T21:06:52Z","title":"MIMOSA: Reducing Malware Analysis Overhead with Coverings"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2101.07328","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:94f3b8be9957c54a665e1014848ade08d08a399bf399717c5cac13dff7a10a79","target":"record","created_at":"2026-07-05T02:07:56Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"a266ca66395a6101a227b286d0811238619287db8cbc116ae9096117f191ac10","cross_cats_sorted":[],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2021-01-18T21:06:52Z","title_canon_sha256":"dbeea5844c8438d2618c578bf3053e628afcbec2990cc6dda54c51520941c9ba"},"schema_version":"1.0","source":{"id":"2101.07328","kind":"arxiv","version":1}},"canonical_sha256":"0d48fead010e0c91309b7ceabc4d2d6b582931567bc255832e43a39a2be97627","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"0d48fead010e0c91309b7ceabc4d2d6b582931567bc255832e43a39a2be97627","first_computed_at":"2026-07-05T02:07:56.824922Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T02:07:56.824922Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"45EV4KhuXnZe5sQqL8iPnO0Mb7UAL39D6Q/4BGaQi8KEJtmO0ZI49Uloe2Cq//v7bilrnvIoQ77Cz57t4FSbDA==","signature_status":"signed_v1","signed_at":"2026-07-05T02:07:56.825335Z","signed_message":"canonical_sha256_bytes"},"source_id":"2101.07328","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:94f3b8be9957c54a665e1014848ade08d08a399bf399717c5cac13dff7a10a79","sha256:3cb22ac56ee2f7f069af04e69c277ea0cdedd89ad4ba41a3beee54a622c18fc8"],"state_sha256":"381eaad1a1e77b84796c612067b72bc6d2d4ac65dddd3682cbfb536d349b9a92"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"/EK7xn00YtF4TaPGxGgFYnaX4IJwMLKDQksAFd1l33J+350rq1oQ/WSFlDVN7iGZWko6xRujYi+c1kZN3F7yAw==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-07T01:05:17.995641Z","bundle_sha256":"a54b15c00f4d0018bf617bdaf7fba246a609a8dc3c8635fbb0a021756cb805f2"}}