{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2017:GUXVRZKVTUYPBGDEZGBKNFPUXS","short_pith_number":"pith:GUXVRZKV","canonical_record":{"source":{"id":"1709.03363","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.AI","submitted_at":"2017-09-11T13:19:08Z","cross_cats_sorted":["cs.CR"],"title_canon_sha256":"c0c9eae2f6cf049654600febf23a173604178770123431fd4bfdc9105f3dc949","abstract_canon_sha256":"ed6ba379b28988760c0322db3103283363e98a0559bda12f802777055fc5bf2b"},"schema_version":"1.0"},"canonical_sha256":"352f58e5559d30f09864c982a695f4bca5b5bafecdb295b05c3bac03aeb23b5c","source":{"kind":"arxiv","id":"1709.03363","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"1709.03363","created_at":"2026-05-18T00:35:38Z"},{"alias_kind":"arxiv_version","alias_value":"1709.03363v1","created_at":"2026-05-18T00:35:38Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.1709.03363","created_at":"2026-05-18T00:35:38Z"},{"alias_kind":"pith_short_12","alias_value":"GUXVRZKVTUYP","created_at":"2026-05-18T12:31:18Z"},{"alias_kind":"pith_short_16","alias_value":"GUXVRZKVTUYPBGDE","created_at":"2026-05-18T12:31:18Z"},{"alias_kind":"pith_short_8","alias_value":"GUXVRZKV","created_at":"2026-05-18T12:31:18Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2017:GUXVRZKVTUYPBGDEZGBKNFPUXS","target":"record","payload":{"canonical_record":{"source":{"id":"1709.03363","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.AI","submitted_at":"2017-09-11T13:19:08Z","cross_cats_sorted":["cs.CR"],"title_canon_sha256":"c0c9eae2f6cf049654600febf23a173604178770123431fd4bfdc9105f3dc949","abstract_canon_sha256":"ed6ba379b28988760c0322db3103283363e98a0559bda12f802777055fc5bf2b"},"schema_version":"1.0"},"canonical_sha256":"352f58e5559d30f09864c982a695f4bca5b5bafecdb295b05c3bac03aeb23b5c","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-05-18T00:35:38.641261Z","signature_b64":"8ePwYrcZpImyPCK3OUz2t3+SXVVlaSnm9Wv//Nb15f+cMtku95hr+M6ZerGXizxyGFl/H273vcUAnbo81jlOAA==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"352f58e5559d30f09864c982a695f4bca5b5bafecdb295b05c3bac03aeb23b5c","last_reissued_at":"2026-05-18T00:35:38.640608Z","signature_status":"signed_v1","first_computed_at":"2026-05-18T00:35:38.640608Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"1709.03363","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-05-18T00:35:38Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"y04mWmVrDEt9aDP6QtQppc99HS0VYzovXyv1/1wIjlm6Q/xZGuVVvSZ3NTTCYNI3meRVzCkN5IOtNGNNzEB3DA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-05-28T12:16:15.632611Z"},"content_sha256":"74f967ae748d49c55a349013eec60e0c6577df846738ee22e9891b5338ece255","schema_version":"1.0","event_id":"sha256:74f967ae748d49c55a349013eec60e0c6577df846738ee22e9891b5338ece255"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2017:GUXVRZKVTUYPBGDEZGBKNFPUXS","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"A Planning Approach to Monitoring Behavior of Computer Programs","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":["cs.CR"],"primary_cat":"cs.AI","authors_text":"Alexandre Cukier, David Tolpin, Ronen I. Brafman, Yotam Perkal","submitted_at":"2017-09-11T13:19:08Z","abstract_excerpt":"We describe a novel approach to monitoring high level behaviors using concepts from AI planning. Our goal is to understand what a program is doing based on its system call trace. This ability is particularly important for detecting malware. We approach this problem by building an abstract model of the operating system using the STRIPS planning language, casting system calls as planning operators. Given a system call trace, we simulate the corresponding operators on our model and by observing the properties of the state reached, we learn about the nature of the original program and its behavior"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"1709.03363","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-05-18T00:35:38Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"hffeSro0/5BXy6YRHRzY870Le6A66dqW2k9en0TouKdCU05855Mv/cpOsLpH+4UCpiPo5PyTCFsWgUmTqzBJCg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-05-28T12:16:15.632978Z"},"content_sha256":"171ba6468ea85c4bf300bd3c6acb307ad6cd47b595953548cffe8ec37a2fc09c","schema_version":"1.0","event_id":"sha256:171ba6468ea85c4bf300bd3c6acb307ad6cd47b595953548cffe8ec37a2fc09c"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/GUXVRZKVTUYPBGDEZGBKNFPUXS/bundle.json","state_url":"https://pith.science/pith/GUXVRZKVTUYPBGDEZGBKNFPUXS/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/GUXVRZKVTUYPBGDEZGBKNFPUXS/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-05-28T12:16:15Z","links":{"resolver":"https://pith.science/pith/GUXVRZKVTUYPBGDEZGBKNFPUXS","bundle":"https://pith.science/pith/GUXVRZKVTUYPBGDEZGBKNFPUXS/bundle.json","state":"https://pith.science/pith/GUXVRZKVTUYPBGDEZGBKNFPUXS/state.json","well_known_bundle":"https://pith.science/.well-known/pith/GUXVRZKVTUYPBGDEZGBKNFPUXS/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2017:GUXVRZKVTUYPBGDEZGBKNFPUXS","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"ed6ba379b28988760c0322db3103283363e98a0559bda12f802777055fc5bf2b","cross_cats_sorted":["cs.CR"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.AI","submitted_at":"2017-09-11T13:19:08Z","title_canon_sha256":"c0c9eae2f6cf049654600febf23a173604178770123431fd4bfdc9105f3dc949"},"schema_version":"1.0","source":{"id":"1709.03363","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"1709.03363","created_at":"2026-05-18T00:35:38Z"},{"alias_kind":"arxiv_version","alias_value":"1709.03363v1","created_at":"2026-05-18T00:35:38Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.1709.03363","created_at":"2026-05-18T00:35:38Z"},{"alias_kind":"pith_short_12","alias_value":"GUXVRZKVTUYP","created_at":"2026-05-18T12:31:18Z"},{"alias_kind":"pith_short_16","alias_value":"GUXVRZKVTUYPBGDE","created_at":"2026-05-18T12:31:18Z"},{"alias_kind":"pith_short_8","alias_value":"GUXVRZKV","created_at":"2026-05-18T12:31:18Z"}],"graph_snapshots":[{"event_id":"sha256:171ba6468ea85c4bf300bd3c6acb307ad6cd47b595953548cffe8ec37a2fc09c","target":"graph","created_at":"2026-05-18T00:35:38Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"paper":{"abstract_excerpt":"We describe a novel approach to monitoring high level behaviors using concepts from AI planning. Our goal is to understand what a program is doing based on its system call trace. This ability is particularly important for detecting malware. We approach this problem by building an abstract model of the operating system using the STRIPS planning language, casting system calls as planning operators. Given a system call trace, we simulate the corresponding operators on our model and by observing the properties of the state reached, we learn about the nature of the original program and its behavior","authors_text":"Alexandre Cukier, David Tolpin, Ronen I. Brafman, Yotam Perkal","cross_cats":["cs.CR"],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.AI","submitted_at":"2017-09-11T13:19:08Z","title":"A Planning Approach to Monitoring Behavior of Computer Programs"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"1709.03363","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:74f967ae748d49c55a349013eec60e0c6577df846738ee22e9891b5338ece255","target":"record","created_at":"2026-05-18T00:35:38Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"ed6ba379b28988760c0322db3103283363e98a0559bda12f802777055fc5bf2b","cross_cats_sorted":["cs.CR"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.AI","submitted_at":"2017-09-11T13:19:08Z","title_canon_sha256":"c0c9eae2f6cf049654600febf23a173604178770123431fd4bfdc9105f3dc949"},"schema_version":"1.0","source":{"id":"1709.03363","kind":"arxiv","version":1}},"canonical_sha256":"352f58e5559d30f09864c982a695f4bca5b5bafecdb295b05c3bac03aeb23b5c","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"352f58e5559d30f09864c982a695f4bca5b5bafecdb295b05c3bac03aeb23b5c","first_computed_at":"2026-05-18T00:35:38.640608Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-05-18T00:35:38.640608Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"8ePwYrcZpImyPCK3OUz2t3+SXVVlaSnm9Wv//Nb15f+cMtku95hr+M6ZerGXizxyGFl/H273vcUAnbo81jlOAA==","signature_status":"signed_v1","signed_at":"2026-05-18T00:35:38.641261Z","signed_message":"canonical_sha256_bytes"},"source_id":"1709.03363","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:74f967ae748d49c55a349013eec60e0c6577df846738ee22e9891b5338ece255","sha256:171ba6468ea85c4bf300bd3c6acb307ad6cd47b595953548cffe8ec37a2fc09c"],"state_sha256":"449ef443efb7c9113bddd2c9a5dac612fbb20c78449e8955b6efe420dc6ea2cb"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"Eaf5Ie67poSfImF6XZ9V/EeNqdIAPL9dMSmECn+LeWXZvUjyjPJWW5tjjMbJa9dgrD7r4saSP9VowYMIWAXXCQ==","signed_message":"bundle_sha256_bytes","signed_at":"2026-05-28T12:16:15.634959Z","bundle_sha256":"fe97bbc0643e7da083065f565696477927e24f9a2e06fe7f6cbf06fba549c19d"}}