{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2015:GBHARNZPFQJ4GJMN73DZYWJTVN","short_pith_number":"pith:GBHARNZP","canonical_record":{"source":{"id":"1502.01609","kind":"arxiv","version":2},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2015-02-05T15:36:22Z","cross_cats_sorted":[],"title_canon_sha256":"a98cf4b05a384329b2e8f9ad085f0e270e786256b22979e249a0b44c1b09d3e6","abstract_canon_sha256":"c23c3038647da620784300512fe927f17f2d2c4481448e2b192c95ce97c37d11"},"schema_version":"1.0"},"canonical_sha256":"304e08b72f2c13c3258dfec79c5933ab5c46c8a2fe988d21e54b1c0fc829a814","source":{"kind":"arxiv","id":"1502.01609","version":2},"source_aliases":[{"alias_kind":"arxiv","alias_value":"1502.01609","created_at":"2026-05-18T02:27:17Z"},{"alias_kind":"arxiv_version","alias_value":"1502.01609v2","created_at":"2026-05-18T02:27:17Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.1502.01609","created_at":"2026-05-18T02:27:17Z"},{"alias_kind":"pith_short_12","alias_value":"GBHARNZPFQJ4","created_at":"2026-05-18T12:29:22Z"},{"alias_kind":"pith_short_16","alias_value":"GBHARNZPFQJ4GJMN","created_at":"2026-05-18T12:29:22Z"},{"alias_kind":"pith_short_8","alias_value":"GBHARNZP","created_at":"2026-05-18T12:29:22Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2015:GBHARNZPFQJ4GJMN73DZYWJTVN","target":"record","payload":{"canonical_record":{"source":{"id":"1502.01609","kind":"arxiv","version":2},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2015-02-05T15:36:22Z","cross_cats_sorted":[],"title_canon_sha256":"a98cf4b05a384329b2e8f9ad085f0e270e786256b22979e249a0b44c1b09d3e6","abstract_canon_sha256":"c23c3038647da620784300512fe927f17f2d2c4481448e2b192c95ce97c37d11"},"schema_version":"1.0"},"canonical_sha256":"304e08b72f2c13c3258dfec79c5933ab5c46c8a2fe988d21e54b1c0fc829a814","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-05-18T02:27:17.997585Z","signature_b64":"ViR1rALXqqAiw7SVWE8KdiMymQMDgGss4Pr1QEb45o94lPw5wdYVBiPCQRysQ+2vLHZ44KoqA87E+mSiXKmHBQ==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"304e08b72f2c13c3258dfec79c5933ab5c46c8a2fe988d21e54b1c0fc829a814","last_reissued_at":"2026-05-18T02:27:17.996876Z","signature_status":"signed_v1","first_computed_at":"2026-05-18T02:27:17.996876Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"1502.01609","source_version":2,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-05-18T02:27:17Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"YJaB423/P4V/OXk01xIhwo3etgukIa0E4FvZn9sXpbL+upSkkjSkmHcZZQY7v7DdC15FckOxY4F8U2Ht2OpnBw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-06-10T13:14:43.551825Z"},"content_sha256":"cd628a4fe003742a54496952c9e0479b4773e0b85b8b9d6e21a5c968720f4fdd","schema_version":"1.0","event_id":"sha256:cd628a4fe003742a54496952c9e0479b4773e0b85b8b9d6e21a5c968720f4fdd"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2015:GBHARNZPFQJ4GJMN73DZYWJTVN","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Robust and Effective Malware Detection through Quantitative Data Flow Graph Metrics","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":[],"primary_cat":"cs.CR","authors_text":"Alexander Pretschner, Mart\\'in Ochoa, Tobias W\\\"uchner","submitted_at":"2015-02-05T15:36:22Z","abstract_excerpt":"We present a novel malware detection approach based on metrics over quantitative data flow graphs. Quantitative data flow graphs (QDFGs) model process behavior by interpreting issued system calls as aggregations of quantifiable data flows.Due to the high abstraction level we consider QDFG metric based detection more robust against typical behavior obfuscation like bogus call injection or call reordering than other common behavioral models that base on raw system calls. We support this claim with experiments on obfuscated malware logs and demonstrate the superior obfuscation robustness in compa"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"1502.01609","kind":"arxiv","version":2},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-05-18T02:27:17Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"3LSaVqrXjC7+OViGssPJLtsXxadTVreJQIK9u9eQ3nTaWsan4YP9WD8ShvkAKs3c/ie0bThGO9Fh5X3Ci2+1CA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-06-10T13:14:43.552540Z"},"content_sha256":"9af0e77f5f5e69363a89f8545403c0c791b149b590a741454dece3bbae176cf9","schema_version":"1.0","event_id":"sha256:9af0e77f5f5e69363a89f8545403c0c791b149b590a741454dece3bbae176cf9"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/GBHARNZPFQJ4GJMN73DZYWJTVN/bundle.json","state_url":"https://pith.science/pith/GBHARNZPFQJ4GJMN73DZYWJTVN/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/GBHARNZPFQJ4GJMN73DZYWJTVN/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-06-10T13:14:43Z","links":{"resolver":"https://pith.science/pith/GBHARNZPFQJ4GJMN73DZYWJTVN","bundle":"https://pith.science/pith/GBHARNZPFQJ4GJMN73DZYWJTVN/bundle.json","state":"https://pith.science/pith/GBHARNZPFQJ4GJMN73DZYWJTVN/state.json","well_known_bundle":"https://pith.science/.well-known/pith/GBHARNZPFQJ4GJMN73DZYWJTVN/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2015:GBHARNZPFQJ4GJMN73DZYWJTVN","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"c23c3038647da620784300512fe927f17f2d2c4481448e2b192c95ce97c37d11","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2015-02-05T15:36:22Z","title_canon_sha256":"a98cf4b05a384329b2e8f9ad085f0e270e786256b22979e249a0b44c1b09d3e6"},"schema_version":"1.0","source":{"id":"1502.01609","kind":"arxiv","version":2}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"1502.01609","created_at":"2026-05-18T02:27:17Z"},{"alias_kind":"arxiv_version","alias_value":"1502.01609v2","created_at":"2026-05-18T02:27:17Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.1502.01609","created_at":"2026-05-18T02:27:17Z"},{"alias_kind":"pith_short_12","alias_value":"GBHARNZPFQJ4","created_at":"2026-05-18T12:29:22Z"},{"alias_kind":"pith_short_16","alias_value":"GBHARNZPFQJ4GJMN","created_at":"2026-05-18T12:29:22Z"},{"alias_kind":"pith_short_8","alias_value":"GBHARNZP","created_at":"2026-05-18T12:29:22Z"}],"graph_snapshots":[{"event_id":"sha256:9af0e77f5f5e69363a89f8545403c0c791b149b590a741454dece3bbae176cf9","target":"graph","created_at":"2026-05-18T02:27:17Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"paper":{"abstract_excerpt":"We present a novel malware detection approach based on metrics over quantitative data flow graphs. Quantitative data flow graphs (QDFGs) model process behavior by interpreting issued system calls as aggregations of quantifiable data flows.Due to the high abstraction level we consider QDFG metric based detection more robust against typical behavior obfuscation like bogus call injection or call reordering than other common behavioral models that base on raw system calls. We support this claim with experiments on obfuscated malware logs and demonstrate the superior obfuscation robustness in compa","authors_text":"Alexander Pretschner, Mart\\'in Ochoa, Tobias W\\\"uchner","cross_cats":[],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2015-02-05T15:36:22Z","title":"Robust and Effective Malware Detection through Quantitative Data Flow Graph Metrics"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"1502.01609","kind":"arxiv","version":2},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:cd628a4fe003742a54496952c9e0479b4773e0b85b8b9d6e21a5c968720f4fdd","target":"record","created_at":"2026-05-18T02:27:17Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"c23c3038647da620784300512fe927f17f2d2c4481448e2b192c95ce97c37d11","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2015-02-05T15:36:22Z","title_canon_sha256":"a98cf4b05a384329b2e8f9ad085f0e270e786256b22979e249a0b44c1b09d3e6"},"schema_version":"1.0","source":{"id":"1502.01609","kind":"arxiv","version":2}},"canonical_sha256":"304e08b72f2c13c3258dfec79c5933ab5c46c8a2fe988d21e54b1c0fc829a814","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"304e08b72f2c13c3258dfec79c5933ab5c46c8a2fe988d21e54b1c0fc829a814","first_computed_at":"2026-05-18T02:27:17.996876Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-05-18T02:27:17.996876Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"ViR1rALXqqAiw7SVWE8KdiMymQMDgGss4Pr1QEb45o94lPw5wdYVBiPCQRysQ+2vLHZ44KoqA87E+mSiXKmHBQ==","signature_status":"signed_v1","signed_at":"2026-05-18T02:27:17.997585Z","signed_message":"canonical_sha256_bytes"},"source_id":"1502.01609","source_kind":"arxiv","source_version":2}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:cd628a4fe003742a54496952c9e0479b4773e0b85b8b9d6e21a5c968720f4fdd","sha256:9af0e77f5f5e69363a89f8545403c0c791b149b590a741454dece3bbae176cf9"],"state_sha256":"af35846abe944e2876d55ea0a7e3385b71aec60cf1a38fb1d2b902d8b3ad7d4a"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"1s60LzgBmuFq2UEdPqtgCJ10v3qCCw+TDKmhQmiT2pHXBkRYR4S2TDSgb1E1bcYmIcR30Z2LIsNK7N4CxM/xAw==","signed_message":"bundle_sha256_bytes","signed_at":"2026-06-10T13:14:43.556562Z","bundle_sha256":"1ef357ffaa9942cf41583983736f630ed708799be817bf2bae7f57459b05f122"}}