{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2025:FN7CFKU7SHK7BC5DNEDPUM3PW5","short_pith_number":"pith:FN7CFKU7","canonical_record":{"source":{"id":"2507.22447","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2025-07-30T07:46:49Z","cross_cats_sorted":["cs.LG"],"title_canon_sha256":"98370c29848d4a20795e14e79d64bf86200c3669215100989b3740732f885c5e","abstract_canon_sha256":"82f08d6c623ea34f2821a668a87ac6916a3c0dbfb07e3cad1ecb5b8de0a2f40b"},"schema_version":"1.0"},"canonical_sha256":"2b7e22aa9f91d5f08ba36906fa336fb77a3c915b9e0a65f5553873aaf2d5e60a","source":{"kind":"arxiv","id":"2507.22447","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2507.22447","created_at":"2026-07-05T11:45:42Z"},{"alias_kind":"arxiv_version","alias_value":"2507.22447v1","created_at":"2026-07-05T11:45:42Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2507.22447","created_at":"2026-07-05T11:45:42Z"},{"alias_kind":"pith_short_12","alias_value":"FN7CFKU7SHK7","created_at":"2026-07-05T11:45:42Z"},{"alias_kind":"pith_short_16","alias_value":"FN7CFKU7SHK7BC5D","created_at":"2026-07-05T11:45:42Z"},{"alias_kind":"pith_short_8","alias_value":"FN7CFKU7","created_at":"2026-07-05T11:45:42Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2025:FN7CFKU7SHK7BC5DNEDPUM3PW5","target":"record","payload":{"canonical_record":{"source":{"id":"2507.22447","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2025-07-30T07:46:49Z","cross_cats_sorted":["cs.LG"],"title_canon_sha256":"98370c29848d4a20795e14e79d64bf86200c3669215100989b3740732f885c5e","abstract_canon_sha256":"82f08d6c623ea34f2821a668a87ac6916a3c0dbfb07e3cad1ecb5b8de0a2f40b"},"schema_version":"1.0"},"canonical_sha256":"2b7e22aa9f91d5f08ba36906fa336fb77a3c915b9e0a65f5553873aaf2d5e60a","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T11:45:42.387244Z","signature_b64":"ZeV5csUfmTpRyKygP7B3/AX61ksv7QMThrDgXp8plU60wfS5BKxpc2Jd68PFzBRjHA+EkbyY0W6UDV5FkSEaDA==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"2b7e22aa9f91d5f08ba36906fa336fb77a3c915b9e0a65f5553873aaf2d5e60a","last_reissued_at":"2026-07-05T11:45:42.386720Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T11:45:42.386720Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2507.22447","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T11:45:42Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"s0d2OdKrcVAaZH9auZwnNYp4csEaJPgZxeDE7JpR4YRkD2mPsAbDI9eEbFADWFxEsqeI6pRWuZH9ol1WLtnECg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-07-10T09:48:02.924641Z"},"content_sha256":"1d0418ccbd4d89d736483a0b51084a03a428446949efbfcc262364a177bfb300","schema_version":"1.0","event_id":"sha256:1d0418ccbd4d89d736483a0b51084a03a428446949efbfcc262364a177bfb300"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2025:FN7CFKU7SHK7BC5DNEDPUM3PW5","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Breaking Obfuscation: Cluster-Aware Graph with LLM-Aided Recovery for Malicious JavaScript Detection","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":["cs.LG"],"primary_cat":"cs.CR","authors_text":"JingJing Guo, Liangliang Song, Lin Chen, Xin Wang, Yanbin Wang, Ye Tian, Zhenhuang Hu, Zhihong Liang","submitted_at":"2025-07-30T07:46:49Z","abstract_excerpt":"With the rapid expansion of web-based applications and cloud services, malicious JavaScript code continues to pose significant threats to user privacy, system integrity, and enterprise security. But, detecting such threats remains challenging due to sophisticated code obfuscation techniques and JavaScript's inherent language characteristics, particularly its nested closure structures and syntactic flexibility. In this work, we propose DeCoda, a hybrid defense framework that combines large language model (LLM)-based deobfuscation with code graph learning: (1) We first construct a sophisticated "},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2507.22447","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2507.22447/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T11:45:42Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"BYoO7QUe9uRsmNsMshdHZ1LAFQrW4SnhhHxG0bMeESJdNdg9VxDB/SiYqnSJUIZh61nr5EYvOnSE0NYmi8nEBA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-07-10T09:48:02.925002Z"},"content_sha256":"f8fac652dc3d603b735bb5250db1ad846b783b422b9e82a0a6b6477f767d843a","schema_version":"1.0","event_id":"sha256:f8fac652dc3d603b735bb5250db1ad846b783b422b9e82a0a6b6477f767d843a"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/FN7CFKU7SHK7BC5DNEDPUM3PW5/bundle.json","state_url":"https://pith.science/pith/FN7CFKU7SHK7BC5DNEDPUM3PW5/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/FN7CFKU7SHK7BC5DNEDPUM3PW5/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-07-10T09:48:02Z","links":{"resolver":"https://pith.science/pith/FN7CFKU7SHK7BC5DNEDPUM3PW5","bundle":"https://pith.science/pith/FN7CFKU7SHK7BC5DNEDPUM3PW5/bundle.json","state":"https://pith.science/pith/FN7CFKU7SHK7BC5DNEDPUM3PW5/state.json","well_known_bundle":"https://pith.science/.well-known/pith/FN7CFKU7SHK7BC5DNEDPUM3PW5/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2025:FN7CFKU7SHK7BC5DNEDPUM3PW5","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"82f08d6c623ea34f2821a668a87ac6916a3c0dbfb07e3cad1ecb5b8de0a2f40b","cross_cats_sorted":["cs.LG"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2025-07-30T07:46:49Z","title_canon_sha256":"98370c29848d4a20795e14e79d64bf86200c3669215100989b3740732f885c5e"},"schema_version":"1.0","source":{"id":"2507.22447","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2507.22447","created_at":"2026-07-05T11:45:42Z"},{"alias_kind":"arxiv_version","alias_value":"2507.22447v1","created_at":"2026-07-05T11:45:42Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2507.22447","created_at":"2026-07-05T11:45:42Z"},{"alias_kind":"pith_short_12","alias_value":"FN7CFKU7SHK7","created_at":"2026-07-05T11:45:42Z"},{"alias_kind":"pith_short_16","alias_value":"FN7CFKU7SHK7BC5D","created_at":"2026-07-05T11:45:42Z"},{"alias_kind":"pith_short_8","alias_value":"FN7CFKU7","created_at":"2026-07-05T11:45:42Z"}],"graph_snapshots":[{"event_id":"sha256:f8fac652dc3d603b735bb5250db1ad846b783b422b9e82a0a6b6477f767d843a","target":"graph","created_at":"2026-07-05T11:45:42Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2507.22447/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"With the rapid expansion of web-based applications and cloud services, malicious JavaScript code continues to pose significant threats to user privacy, system integrity, and enterprise security. But, detecting such threats remains challenging due to sophisticated code obfuscation techniques and JavaScript's inherent language characteristics, particularly its nested closure structures and syntactic flexibility. In this work, we propose DeCoda, a hybrid defense framework that combines large language model (LLM)-based deobfuscation with code graph learning: (1) We first construct a sophisticated ","authors_text":"JingJing Guo, Liangliang Song, Lin Chen, Xin Wang, Yanbin Wang, Ye Tian, Zhenhuang Hu, Zhihong Liang","cross_cats":["cs.LG"],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2025-07-30T07:46:49Z","title":"Breaking Obfuscation: Cluster-Aware Graph with LLM-Aided Recovery for Malicious JavaScript Detection"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2507.22447","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:1d0418ccbd4d89d736483a0b51084a03a428446949efbfcc262364a177bfb300","target":"record","created_at":"2026-07-05T11:45:42Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"82f08d6c623ea34f2821a668a87ac6916a3c0dbfb07e3cad1ecb5b8de0a2f40b","cross_cats_sorted":["cs.LG"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2025-07-30T07:46:49Z","title_canon_sha256":"98370c29848d4a20795e14e79d64bf86200c3669215100989b3740732f885c5e"},"schema_version":"1.0","source":{"id":"2507.22447","kind":"arxiv","version":1}},"canonical_sha256":"2b7e22aa9f91d5f08ba36906fa336fb77a3c915b9e0a65f5553873aaf2d5e60a","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"2b7e22aa9f91d5f08ba36906fa336fb77a3c915b9e0a65f5553873aaf2d5e60a","first_computed_at":"2026-07-05T11:45:42.386720Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T11:45:42.386720Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"ZeV5csUfmTpRyKygP7B3/AX61ksv7QMThrDgXp8plU60wfS5BKxpc2Jd68PFzBRjHA+EkbyY0W6UDV5FkSEaDA==","signature_status":"signed_v1","signed_at":"2026-07-05T11:45:42.387244Z","signed_message":"canonical_sha256_bytes"},"source_id":"2507.22447","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:1d0418ccbd4d89d736483a0b51084a03a428446949efbfcc262364a177bfb300","sha256:f8fac652dc3d603b735bb5250db1ad846b783b422b9e82a0a6b6477f767d843a"],"state_sha256":"a94690a7c6ade6a1db512c836b7c429e2e04e21d4e1b2df6d8c75399fbf45833"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"eTdOaY1OENZRGhQDz4SYXtgaqia+lGmnkKwgd6a27XO+07lKlE8qGsbuNGg+2f0KVXZwoYCuM5kNTpcFdSHjAA==","signed_message":"bundle_sha256_bytes","signed_at":"2026-07-10T09:48:02.926881Z","bundle_sha256":"80647cbfa6c0b6fc6b4c326c0cd94d2317bce7cb2859e9fb6087e623b1134e31"}}