{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2021:E7TMCYRUQ5325T3W6H5T3DFE7N","short_pith_number":"pith:E7TMCYRU","canonical_record":{"source":{"id":"2103.03939","kind":"arxiv","version":3},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.LG","submitted_at":"2021-03-05T20:54:38Z","cross_cats_sorted":["cs.CR"],"title_canon_sha256":"c6286c8a7004e9c2b1c408e3a275079b49852d624bc33a15ac79090ad7c8c0a6","abstract_canon_sha256":"7212d026fc685a0bda077c880e405b796a865e255e3b5cc56fbbb7410aa630c6"},"schema_version":"1.0"},"canonical_sha256":"27e6c162348777aecf76f1fb3d8ca4fb47a8c1cdef94f6b35c570a2575d96e8b","source":{"kind":"arxiv","id":"2103.03939","version":3},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2103.03939","created_at":"2026-07-05T02:46:12Z"},{"alias_kind":"arxiv_version","alias_value":"2103.03939v3","created_at":"2026-07-05T02:46:12Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2103.03939","created_at":"2026-07-05T02:46:12Z"},{"alias_kind":"pith_short_12","alias_value":"E7TMCYRUQ532","created_at":"2026-07-05T02:46:12Z"},{"alias_kind":"pith_short_16","alias_value":"E7TMCYRUQ5325T3W","created_at":"2026-07-05T02:46:12Z"},{"alias_kind":"pith_short_8","alias_value":"E7TMCYRU","created_at":"2026-07-05T02:46:12Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2021:E7TMCYRUQ5325T3W6H5T3DFE7N","target":"record","payload":{"canonical_record":{"source":{"id":"2103.03939","kind":"arxiv","version":3},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.LG","submitted_at":"2021-03-05T20:54:38Z","cross_cats_sorted":["cs.CR"],"title_canon_sha256":"c6286c8a7004e9c2b1c408e3a275079b49852d624bc33a15ac79090ad7c8c0a6","abstract_canon_sha256":"7212d026fc685a0bda077c880e405b796a865e255e3b5cc56fbbb7410aa630c6"},"schema_version":"1.0"},"canonical_sha256":"27e6c162348777aecf76f1fb3d8ca4fb47a8c1cdef94f6b35c570a2575d96e8b","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T02:46:12.519841Z","signature_b64":"jYXaqypSysLkZXFRZbAnvmi94vySZERRuPXdxmGE1dxoALwuz+llTcDUuhyIapTUc4T35CuwrjE0jMPh60CPCA==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"27e6c162348777aecf76f1fb3d8ca4fb47a8c1cdef94f6b35c570a2575d96e8b","last_reissued_at":"2026-07-05T02:46:12.519393Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T02:46:12.519393Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2103.03939","source_version":3,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T02:46:12Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"pehe0EH186NaP+YcBvLUwx9eKNTBsjUrPB6scw/L8EQUuwgK55cAcbpvA4xuKoIUiEnYj7RNeb3IuTj0DRiyCw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-04T18:10:47.654759Z"},"content_sha256":"8ced7afaf1b94b64ca9c4f5d5ad24bf5b619a27f6a81531279fcd7239bf2cb4b","schema_version":"1.0","event_id":"sha256:8ced7afaf1b94b64ca9c4f5d5ad24bf5b619a27f6a81531279fcd7239bf2cb4b"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2021:E7TMCYRUQ5325T3W6H5T3DFE7N","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"NF-GNN: Network Flow Graph Neural Networks for Malware Detection and Classification","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":["cs.CR"],"primary_cat":"cs.LG","authors_text":"Anton Kocheturov, Julian Busch, Thomas Seidl, Volker Tresp","submitted_at":"2021-03-05T20:54:38Z","abstract_excerpt":"Malicious software (malware) poses an increasing threat to the security of communication systems as the number of interconnected mobile devices increases exponentially. While some existing malware detection and classification approaches successfully leverage network traffic data, they treat network flows between pairs of endpoints independently and thus fail to leverage rich communication patterns present in the complete network. Our approach first extracts flow graphs and subsequently classifies them using a novel edge feature-based graph neural network model. We present three variants of our"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2103.03939","kind":"arxiv","version":3},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2103.03939/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T02:46:12Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"gJxEhh9SkYKhEp/ysyDA38oOB/Cf3lZL96vG/JkOvlrDDbmeM7VIn750L0ii2VWjArnqI9UCql+8y3fIKZHAAg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-04T18:10:47.655272Z"},"content_sha256":"69e92568b9c783b6476f9172ac26c2a54147c8083a7dd98a059edfcb6bfe873e","schema_version":"1.0","event_id":"sha256:69e92568b9c783b6476f9172ac26c2a54147c8083a7dd98a059edfcb6bfe873e"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/E7TMCYRUQ5325T3W6H5T3DFE7N/bundle.json","state_url":"https://pith.science/pith/E7TMCYRUQ5325T3W6H5T3DFE7N/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/E7TMCYRUQ5325T3W6H5T3DFE7N/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-04T18:10:47Z","links":{"resolver":"https://pith.science/pith/E7TMCYRUQ5325T3W6H5T3DFE7N","bundle":"https://pith.science/pith/E7TMCYRUQ5325T3W6H5T3DFE7N/bundle.json","state":"https://pith.science/pith/E7TMCYRUQ5325T3W6H5T3DFE7N/state.json","well_known_bundle":"https://pith.science/.well-known/pith/E7TMCYRUQ5325T3W6H5T3DFE7N/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2021:E7TMCYRUQ5325T3W6H5T3DFE7N","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"7212d026fc685a0bda077c880e405b796a865e255e3b5cc56fbbb7410aa630c6","cross_cats_sorted":["cs.CR"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.LG","submitted_at":"2021-03-05T20:54:38Z","title_canon_sha256":"c6286c8a7004e9c2b1c408e3a275079b49852d624bc33a15ac79090ad7c8c0a6"},"schema_version":"1.0","source":{"id":"2103.03939","kind":"arxiv","version":3}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2103.03939","created_at":"2026-07-05T02:46:12Z"},{"alias_kind":"arxiv_version","alias_value":"2103.03939v3","created_at":"2026-07-05T02:46:12Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2103.03939","created_at":"2026-07-05T02:46:12Z"},{"alias_kind":"pith_short_12","alias_value":"E7TMCYRUQ532","created_at":"2026-07-05T02:46:12Z"},{"alias_kind":"pith_short_16","alias_value":"E7TMCYRUQ5325T3W","created_at":"2026-07-05T02:46:12Z"},{"alias_kind":"pith_short_8","alias_value":"E7TMCYRU","created_at":"2026-07-05T02:46:12Z"}],"graph_snapshots":[{"event_id":"sha256:69e92568b9c783b6476f9172ac26c2a54147c8083a7dd98a059edfcb6bfe873e","target":"graph","created_at":"2026-07-05T02:46:12Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2103.03939/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Malicious software (malware) poses an increasing threat to the security of communication systems as the number of interconnected mobile devices increases exponentially. While some existing malware detection and classification approaches successfully leverage network traffic data, they treat network flows between pairs of endpoints independently and thus fail to leverage rich communication patterns present in the complete network. Our approach first extracts flow graphs and subsequently classifies them using a novel edge feature-based graph neural network model. We present three variants of our","authors_text":"Anton Kocheturov, Julian Busch, Thomas Seidl, Volker Tresp","cross_cats":["cs.CR"],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.LG","submitted_at":"2021-03-05T20:54:38Z","title":"NF-GNN: Network Flow Graph Neural Networks for Malware Detection and Classification"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2103.03939","kind":"arxiv","version":3},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:8ced7afaf1b94b64ca9c4f5d5ad24bf5b619a27f6a81531279fcd7239bf2cb4b","target":"record","created_at":"2026-07-05T02:46:12Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"7212d026fc685a0bda077c880e405b796a865e255e3b5cc56fbbb7410aa630c6","cross_cats_sorted":["cs.CR"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.LG","submitted_at":"2021-03-05T20:54:38Z","title_canon_sha256":"c6286c8a7004e9c2b1c408e3a275079b49852d624bc33a15ac79090ad7c8c0a6"},"schema_version":"1.0","source":{"id":"2103.03939","kind":"arxiv","version":3}},"canonical_sha256":"27e6c162348777aecf76f1fb3d8ca4fb47a8c1cdef94f6b35c570a2575d96e8b","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"27e6c162348777aecf76f1fb3d8ca4fb47a8c1cdef94f6b35c570a2575d96e8b","first_computed_at":"2026-07-05T02:46:12.519393Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T02:46:12.519393Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"jYXaqypSysLkZXFRZbAnvmi94vySZERRuPXdxmGE1dxoALwuz+llTcDUuhyIapTUc4T35CuwrjE0jMPh60CPCA==","signature_status":"signed_v1","signed_at":"2026-07-05T02:46:12.519841Z","signed_message":"canonical_sha256_bytes"},"source_id":"2103.03939","source_kind":"arxiv","source_version":3}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:8ced7afaf1b94b64ca9c4f5d5ad24bf5b619a27f6a81531279fcd7239bf2cb4b","sha256:69e92568b9c783b6476f9172ac26c2a54147c8083a7dd98a059edfcb6bfe873e"],"state_sha256":"70e3bf8a2248064b5383e46bb0d5342ca7947b42b3edd31dcff0b1bbf3b39948"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"wMePkW9zrvaHhg/bLOYmnBTG7FaQs6vpB7wuN+e4dmaerbGGfzAhYdoJTCW8NOaBmjSdIZQnF29BU0MOdAJuDQ==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-04T18:10:47.658554Z","bundle_sha256":"91cc2bc4f7a37e619d4860c93ea0889e6baa86f8b951ceb034becfc9c99b210b"}}