{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2018:HNAVWKI3MMJUU6R5BPHUKNIFTR","short_pith_number":"pith:HNAVWKI3","canonical_record":{"source":{"id":"1804.03643","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2018-04-10T17:43:40Z","cross_cats_sorted":[],"title_canon_sha256":"27f9fa6a3a4ef8a01226bf4e4569ef9cb2e7debd595510dd7d325a44165d3ac4","abstract_canon_sha256":"2f91fae3a804983e42731ba8d93ce451346db147b13cea6d0a6b413f9cb6c2f1"},"schema_version":"1.0"},"canonical_sha256":"3b415b291b63134a7a3d0bcf4535059c4a823ad4562d4e9bddc518d47eca822b","source":{"kind":"arxiv","id":"1804.03643","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"1804.03643","created_at":"2026-05-18T00:18:47Z"},{"alias_kind":"arxiv_version","alias_value":"1804.03643v1","created_at":"2026-05-18T00:18:47Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.1804.03643","created_at":"2026-05-18T00:18:47Z"},{"alias_kind":"pith_short_12","alias_value":"HNAVWKI3MMJU","created_at":"2026-05-18T12:32:28Z"},{"alias_kind":"pith_short_16","alias_value":"HNAVWKI3MMJUU6R5","created_at":"2026-05-18T12:32:28Z"},{"alias_kind":"pith_short_8","alias_value":"HNAVWKI3","created_at":"2026-05-18T12:32:28Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2018:HNAVWKI3MMJUU6R5BPHUKNIFTR","target":"record","payload":{"canonical_record":{"source":{"id":"1804.03643","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2018-04-10T17:43:40Z","cross_cats_sorted":[],"title_canon_sha256":"27f9fa6a3a4ef8a01226bf4e4569ef9cb2e7debd595510dd7d325a44165d3ac4","abstract_canon_sha256":"2f91fae3a804983e42731ba8d93ce451346db147b13cea6d0a6b413f9cb6c2f1"},"schema_version":"1.0"},"canonical_sha256":"3b415b291b63134a7a3d0bcf4535059c4a823ad4562d4e9bddc518d47eca822b","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-05-18T00:18:47.386562Z","signature_b64":"jbZn9neHL/1NSObe6/lOaP7lJ3bWT4qkNy31irD+NqLZvMnm3bjAuN9R43/0aeF1LXXvmfGvocribCeWTZsICQ==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"3b415b291b63134a7a3d0bcf4535059c4a823ad4562d4e9bddc518d47eca822b","last_reissued_at":"2026-05-18T00:18:47.385881Z","signature_status":"signed_v1","first_computed_at":"2026-05-18T00:18:47.385881Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"1804.03643","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-05-18T00:18:47Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"9y/tI0wNYCDpHwg8vgMKwkANgCy/ADSrLQBVKeBSFaQVwVE9Xwrb5T8mrs6qRuwUEcD/Em8UygMBqQXosbDvBw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-06-04T21:09:41.429933Z"},"content_sha256":"6e50e25b59571419287a0c07ab6a9b853e4dfb220acf9ab3f0602760d5ca0669","schema_version":"1.0","event_id":"sha256:6e50e25b59571419287a0c07ab6a9b853e4dfb220acf9ab3f0602760d5ca0669"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2018:HNAVWKI3MMJUU6R5BPHUKNIFTR","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Monotonic models for real-time dynamic malware detection","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":[],"primary_cat":"cs.CR","authors_text":"Alexander Chistyakov, Alexander Shevelev, Alexey Romanenko, Ekaterina Lobacheva","submitted_at":"2018-04-10T17:43:40Z","abstract_excerpt":"In dynamic malware analysis, programs are classified as malware or benign based on their execution logs. We propose a concept of applying monotonic classification models to the analysis process, to make the trained model's predictions consistent over execution time and provably stable to the injection of any noise or `benign-looking' activity into the program's behavior. The predictions of such models change monotonically through the log in the sense that the addition of new lines into the log may only increase the probability of the file being found malicious, which make them suitable for rea"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"1804.03643","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-05-18T00:18:47Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"zS/2b3HCCW01gMgGnVdtp4VKltlo5Ls/abJcjZTxdxWEiKEUV7r59MJGV6/PFbVMwEQ7CW5OlqDMzHP8LkQpDw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-06-04T21:09:41.430291Z"},"content_sha256":"3fe2097472659a531614a3aadc10a78fb53baac415b8eab7f6db7a26000558ac","schema_version":"1.0","event_id":"sha256:3fe2097472659a531614a3aadc10a78fb53baac415b8eab7f6db7a26000558ac"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/HNAVWKI3MMJUU6R5BPHUKNIFTR/bundle.json","state_url":"https://pith.science/pith/HNAVWKI3MMJUU6R5BPHUKNIFTR/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/HNAVWKI3MMJUU6R5BPHUKNIFTR/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-06-04T21:09:41Z","links":{"resolver":"https://pith.science/pith/HNAVWKI3MMJUU6R5BPHUKNIFTR","bundle":"https://pith.science/pith/HNAVWKI3MMJUU6R5BPHUKNIFTR/bundle.json","state":"https://pith.science/pith/HNAVWKI3MMJUU6R5BPHUKNIFTR/state.json","well_known_bundle":"https://pith.science/.well-known/pith/HNAVWKI3MMJUU6R5BPHUKNIFTR/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2018:HNAVWKI3MMJUU6R5BPHUKNIFTR","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"2f91fae3a804983e42731ba8d93ce451346db147b13cea6d0a6b413f9cb6c2f1","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2018-04-10T17:43:40Z","title_canon_sha256":"27f9fa6a3a4ef8a01226bf4e4569ef9cb2e7debd595510dd7d325a44165d3ac4"},"schema_version":"1.0","source":{"id":"1804.03643","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"1804.03643","created_at":"2026-05-18T00:18:47Z"},{"alias_kind":"arxiv_version","alias_value":"1804.03643v1","created_at":"2026-05-18T00:18:47Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.1804.03643","created_at":"2026-05-18T00:18:47Z"},{"alias_kind":"pith_short_12","alias_value":"HNAVWKI3MMJU","created_at":"2026-05-18T12:32:28Z"},{"alias_kind":"pith_short_16","alias_value":"HNAVWKI3MMJUU6R5","created_at":"2026-05-18T12:32:28Z"},{"alias_kind":"pith_short_8","alias_value":"HNAVWKI3","created_at":"2026-05-18T12:32:28Z"}],"graph_snapshots":[{"event_id":"sha256:3fe2097472659a531614a3aadc10a78fb53baac415b8eab7f6db7a26000558ac","target":"graph","created_at":"2026-05-18T00:18:47Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"paper":{"abstract_excerpt":"In dynamic malware analysis, programs are classified as malware or benign based on their execution logs. We propose a concept of applying monotonic classification models to the analysis process, to make the trained model's predictions consistent over execution time and provably stable to the injection of any noise or `benign-looking' activity into the program's behavior. The predictions of such models change monotonically through the log in the sense that the addition of new lines into the log may only increase the probability of the file being found malicious, which make them suitable for rea","authors_text":"Alexander Chistyakov, Alexander Shevelev, Alexey Romanenko, Ekaterina Lobacheva","cross_cats":[],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2018-04-10T17:43:40Z","title":"Monotonic models for real-time dynamic malware detection"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"1804.03643","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:6e50e25b59571419287a0c07ab6a9b853e4dfb220acf9ab3f0602760d5ca0669","target":"record","created_at":"2026-05-18T00:18:47Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"2f91fae3a804983e42731ba8d93ce451346db147b13cea6d0a6b413f9cb6c2f1","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2018-04-10T17:43:40Z","title_canon_sha256":"27f9fa6a3a4ef8a01226bf4e4569ef9cb2e7debd595510dd7d325a44165d3ac4"},"schema_version":"1.0","source":{"id":"1804.03643","kind":"arxiv","version":1}},"canonical_sha256":"3b415b291b63134a7a3d0bcf4535059c4a823ad4562d4e9bddc518d47eca822b","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"3b415b291b63134a7a3d0bcf4535059c4a823ad4562d4e9bddc518d47eca822b","first_computed_at":"2026-05-18T00:18:47.385881Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-05-18T00:18:47.385881Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"jbZn9neHL/1NSObe6/lOaP7lJ3bWT4qkNy31irD+NqLZvMnm3bjAuN9R43/0aeF1LXXvmfGvocribCeWTZsICQ==","signature_status":"signed_v1","signed_at":"2026-05-18T00:18:47.386562Z","signed_message":"canonical_sha256_bytes"},"source_id":"1804.03643","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:6e50e25b59571419287a0c07ab6a9b853e4dfb220acf9ab3f0602760d5ca0669","sha256:3fe2097472659a531614a3aadc10a78fb53baac415b8eab7f6db7a26000558ac"],"state_sha256":"51cfc104a7152ede59944d180b129d98eb99db2e518e80ea5e991e507da856d0"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"te1fcCWHxkHi6+2bJndl0XZVGe7zXueHLms4j00g7FEtJA/a8nt755TXY4anUHIhW46x4qfaQbomNCOXEXJtBw==","signed_message":"bundle_sha256_bytes","signed_at":"2026-06-04T21:09:41.432311Z","bundle_sha256":"9e231a839d26bcad9a8158b15830be22cac50412d2d6c003b425e8e072cb23b1"}}