{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2022:FCJUAVQATSCVNN3TNCRKTXJDER","short_pith_number":"pith:FCJUAVQA","canonical_record":{"source":{"id":"2207.01837","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2022-07-05T06:41:39Z","cross_cats_sorted":["cs.SE"],"title_canon_sha256":"5d354b9b7993922a274d1bbc73f5102803ea7c0c1309cb0e13a6556f4e2f5285","abstract_canon_sha256":"0baafee65e9dfb281639945e0fd29c1f397065959d00913f6d038391a577abb8"},"schema_version":"1.0"},"canonical_sha256":"28934056009c8556b77368a2a9dd2324440bd5f6063e01fb565565c64346e350","source":{"kind":"arxiv","id":"2207.01837","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2207.01837","created_at":"2026-07-05T04:37:44Z"},{"alias_kind":"arxiv_version","alias_value":"2207.01837v1","created_at":"2026-07-05T04:37:44Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2207.01837","created_at":"2026-07-05T04:37:44Z"},{"alias_kind":"pith_short_12","alias_value":"FCJUAVQATSCV","created_at":"2026-07-05T04:37:44Z"},{"alias_kind":"pith_short_16","alias_value":"FCJUAVQATSCVNN3T","created_at":"2026-07-05T04:37:44Z"},{"alias_kind":"pith_short_8","alias_value":"FCJUAVQA","created_at":"2026-07-05T04:37:44Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2022:FCJUAVQATSCVNN3TNCRKTXJDER","target":"record","payload":{"canonical_record":{"source":{"id":"2207.01837","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2022-07-05T06:41:39Z","cross_cats_sorted":["cs.SE"],"title_canon_sha256":"5d354b9b7993922a274d1bbc73f5102803ea7c0c1309cb0e13a6556f4e2f5285","abstract_canon_sha256":"0baafee65e9dfb281639945e0fd29c1f397065959d00913f6d038391a577abb8"},"schema_version":"1.0"},"canonical_sha256":"28934056009c8556b77368a2a9dd2324440bd5f6063e01fb565565c64346e350","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T04:37:44.918238Z","signature_b64":"4h3dhi4zzJlYLgS2f4llOM8UOWuEtB9sw6dPbH07W3wZDD9qVREYMITBaxfNUaUue7gVpi9CXXbzJKCFOkDFDA==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"28934056009c8556b77368a2a9dd2324440bd5f6063e01fb565565c64346e350","last_reissued_at":"2026-07-05T04:37:44.917827Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T04:37:44.917827Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2207.01837","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T04:37:44Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"yOfh1QfT/fJQ0nGcvcDrgNNTfF3syGaOoJcYC1r3xrkQVvgi534Ox9O8SBTR4O4RaWuI3PoKQrLJIdrBw1JcCw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-24T03:41:34.717355Z"},"content_sha256":"d08543b4e6b10299e787350d0e27f6cb7a1f3844db5b30ac161733815d348d5b","schema_version":"1.0","event_id":"sha256:d08543b4e6b10299e787350d0e27f6cb7a1f3844db5b30ac161733815d348d5b"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2022:FCJUAVQATSCVNN3TNCRKTXJDER","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"iLibScope: Reliable Third-Party Library Detection for iOS Mobile Apps","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":["cs.SE"],"primary_cat":"cs.CR","authors_text":"Haoyu Wang, Jingyi Guo, Kui Ren, Lei Wu, Min Zheng, Xiapu Luo, Yajin Zhou","submitted_at":"2022-07-05T06:41:39Z","abstract_excerpt":"Vetting security impacts introduced by third-party libraries in iOS apps requires a reliable library detection technique. Especially when a new vulnerability (or a privacy-invasive behavior) was discovered in a third-party library, there is a practical need to precisely identify the existence of libraries and their versions for iOS apps. However, few studies have been proposed to tackle this problem, and they all suffer from the code duplication problem in different libraries. In this paper, we focus on third-party library detection in iOS apps. Given an app, we aim to identify the integrated "},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2207.01837","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2207.01837/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T04:37:44Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"hbq0GXVO88IK5o37IihkY83VHcwIDfn+ISY9pk8jSI8QczqOWaIny0r9zRB99lyFAKR6ZYjT7U7BGk2KOw8DDQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-24T03:41:34.717682Z"},"content_sha256":"0a803244d8ec5fef466cdd72b69ddeba56593624b3d5eab21d6f2b73c4a88383","schema_version":"1.0","event_id":"sha256:0a803244d8ec5fef466cdd72b69ddeba56593624b3d5eab21d6f2b73c4a88383"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/FCJUAVQATSCVNN3TNCRKTXJDER/bundle.json","state_url":"https://pith.science/pith/FCJUAVQATSCVNN3TNCRKTXJDER/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/FCJUAVQATSCVNN3TNCRKTXJDER/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-24T03:41:34Z","links":{"resolver":"https://pith.science/pith/FCJUAVQATSCVNN3TNCRKTXJDER","bundle":"https://pith.science/pith/FCJUAVQATSCVNN3TNCRKTXJDER/bundle.json","state":"https://pith.science/pith/FCJUAVQATSCVNN3TNCRKTXJDER/state.json","well_known_bundle":"https://pith.science/.well-known/pith/FCJUAVQATSCVNN3TNCRKTXJDER/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2022:FCJUAVQATSCVNN3TNCRKTXJDER","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"0baafee65e9dfb281639945e0fd29c1f397065959d00913f6d038391a577abb8","cross_cats_sorted":["cs.SE"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2022-07-05T06:41:39Z","title_canon_sha256":"5d354b9b7993922a274d1bbc73f5102803ea7c0c1309cb0e13a6556f4e2f5285"},"schema_version":"1.0","source":{"id":"2207.01837","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2207.01837","created_at":"2026-07-05T04:37:44Z"},{"alias_kind":"arxiv_version","alias_value":"2207.01837v1","created_at":"2026-07-05T04:37:44Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2207.01837","created_at":"2026-07-05T04:37:44Z"},{"alias_kind":"pith_short_12","alias_value":"FCJUAVQATSCV","created_at":"2026-07-05T04:37:44Z"},{"alias_kind":"pith_short_16","alias_value":"FCJUAVQATSCVNN3T","created_at":"2026-07-05T04:37:44Z"},{"alias_kind":"pith_short_8","alias_value":"FCJUAVQA","created_at":"2026-07-05T04:37:44Z"}],"graph_snapshots":[{"event_id":"sha256:0a803244d8ec5fef466cdd72b69ddeba56593624b3d5eab21d6f2b73c4a88383","target":"graph","created_at":"2026-07-05T04:37:44Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2207.01837/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Vetting security impacts introduced by third-party libraries in iOS apps requires a reliable library detection technique. Especially when a new vulnerability (or a privacy-invasive behavior) was discovered in a third-party library, there is a practical need to precisely identify the existence of libraries and their versions for iOS apps. However, few studies have been proposed to tackle this problem, and they all suffer from the code duplication problem in different libraries. In this paper, we focus on third-party library detection in iOS apps. Given an app, we aim to identify the integrated ","authors_text":"Haoyu Wang, Jingyi Guo, Kui Ren, Lei Wu, Min Zheng, Xiapu Luo, Yajin Zhou","cross_cats":["cs.SE"],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2022-07-05T06:41:39Z","title":"iLibScope: Reliable Third-Party Library Detection for iOS Mobile Apps"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2207.01837","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:d08543b4e6b10299e787350d0e27f6cb7a1f3844db5b30ac161733815d348d5b","target":"record","created_at":"2026-07-05T04:37:44Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"0baafee65e9dfb281639945e0fd29c1f397065959d00913f6d038391a577abb8","cross_cats_sorted":["cs.SE"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2022-07-05T06:41:39Z","title_canon_sha256":"5d354b9b7993922a274d1bbc73f5102803ea7c0c1309cb0e13a6556f4e2f5285"},"schema_version":"1.0","source":{"id":"2207.01837","kind":"arxiv","version":1}},"canonical_sha256":"28934056009c8556b77368a2a9dd2324440bd5f6063e01fb565565c64346e350","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"28934056009c8556b77368a2a9dd2324440bd5f6063e01fb565565c64346e350","first_computed_at":"2026-07-05T04:37:44.917827Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T04:37:44.917827Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"4h3dhi4zzJlYLgS2f4llOM8UOWuEtB9sw6dPbH07W3wZDD9qVREYMITBaxfNUaUue7gVpi9CXXbzJKCFOkDFDA==","signature_status":"signed_v1","signed_at":"2026-07-05T04:37:44.918238Z","signed_message":"canonical_sha256_bytes"},"source_id":"2207.01837","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:d08543b4e6b10299e787350d0e27f6cb7a1f3844db5b30ac161733815d348d5b","sha256:0a803244d8ec5fef466cdd72b69ddeba56593624b3d5eab21d6f2b73c4a88383"],"state_sha256":"11ae8588bd9a05864128774648dd0af4f3398b459591b4c11f08513ac97d9688"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"ELzm8moMzlshCUcrexdibArk5xqS+M8gfPHuZax8211Cj42suaJw0kVR36m50v5dy5FJouRZdoiuH0WROC0GDw==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-24T03:41:34.720849Z","bundle_sha256":"846e5bc99149f62b9b3ad1d4d83b59becaeba8f53d3ba44741ddac30b660c0cb"}}