{"record_type":"pith_number_record","schema_url":"https://pith.science/schemas/pith-number/v1.json","pith_number":"pith:2026:HOC3LLTYEMC4HEEESFRHZBS2DV","short_pith_number":"pith:HOC3LLTY","schema_version":"1.0","canonical_sha256":"3b85b5ae782305c3908491627c865a1d4d40838a2ad33257ed5f423358c371db","source":{"kind":"arxiv","id":"2605.26791","version":1},"attestation_state":"computed","paper":{"title":"Anonymous YARA Rules Are Not Anonymous","license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","headline":"","cross_cats":[],"primary_cat":"cs.CR","authors_text":"Laurent Bobelin, Pascal Berthom\\'e, Usman Rabiu Isah","submitted_at":"2026-05-26T10:01:50Z","abstract_excerpt":"YARA rules are widely shared across threat intelligence communities to enable collective defence against malware. This practice implicitly assumes that removing metadata (e.g., author fields) sufficiently protects the identity of contributing organisations. To assess the validity of this assumption, we systematically evaluate how much can be inferred from YARA rule text alone. Specifically, using a corpus of 23,305 rules from three major public repositories, we train independent classifiers along four stylometric fingerprint dimensions: individual author, source repository, malware family, and"},"verification_status":{"content_addressed":true,"pith_receipt":true,"author_attested":false,"weak_author_claims":0,"strong_author_claims":0,"externally_anchored":false,"storage_verified":false,"citation_signatures":0,"replication_records":0,"graph_snapshot":true,"references_resolved":false,"formal_links_present":false},"canonical_record":{"source":{"id":"2605.26791","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","primary_cat":"cs.CR","submitted_at":"2026-05-26T10:01:50Z","cross_cats_sorted":[],"title_canon_sha256":"f8e5dfec33600ed79e076a9bc95ddc49ad86a7b44551f95ac6fb43284c70a09a","abstract_canon_sha256":"51bb57c87efecb3dc3ec36f60172763508492611fad9c55625f895935fdceea8"},"schema_version":"1.0"},"receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-05-27T01:06:12.859001Z","signature_b64":"9PUPw6L1t6aiCTDwGPlE0O76LUFZ3KZ3rKk09FZOSBL+IL1cSNG+8hIgzW/uUxUnN9DQS1kWrqb75HUC0uIgDQ==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"3b85b5ae782305c3908491627c865a1d4d40838a2ad33257ed5f423358c371db","last_reissued_at":"2026-05-27T01:06:12.857847Z","signature_status":"signed_v1","first_computed_at":"2026-05-27T01:06:12.857847Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"graph_snapshot":{"paper":{"title":"Anonymous YARA Rules Are Not Anonymous","license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","headline":"","cross_cats":[],"primary_cat":"cs.CR","authors_text":"Laurent Bobelin, Pascal Berthom\\'e, Usman Rabiu Isah","submitted_at":"2026-05-26T10:01:50Z","abstract_excerpt":"YARA rules are widely shared across threat intelligence communities to enable collective defence against malware. This practice implicitly assumes that removing metadata (e.g., author fields) sufficiently protects the identity of contributing organisations. To assess the validity of this assumption, we systematically evaluate how much can be inferred from YARA rule text alone. Specifically, using a corpus of 23,305 rules from three major public repositories, we train independent classifiers along four stylometric fingerprint dimensions: individual author, source repository, malware family, and"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2605.26791","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2605.26791/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"aliases":[{"alias_kind":"arxiv","alias_value":"2605.26791","created_at":"2026-05-27T01:06:12.857945+00:00"},{"alias_kind":"arxiv_version","alias_value":"2605.26791v1","created_at":"2026-05-27T01:06:12.857945+00:00"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2605.26791","created_at":"2026-05-27T01:06:12.857945+00:00"},{"alias_kind":"pith_short_12","alias_value":"HOC3LLTYEMC4","created_at":"2026-05-27T01:06:12.857945+00:00"},{"alias_kind":"pith_short_16","alias_value":"HOC3LLTYEMC4HEEE","created_at":"2026-05-27T01:06:12.857945+00:00"},{"alias_kind":"pith_short_8","alias_value":"HOC3LLTY","created_at":"2026-05-27T01:06:12.857945+00:00"}],"events":[],"event_summary":{},"paper_claims":[],"inbound_citations":{"count":0,"internal_anchor_count":0,"sample":[]},"formal_canon":{"evidence_count":0,"sample":[],"anchors":[]},"links":{"html":"https://pith.science/pith/HOC3LLTYEMC4HEEESFRHZBS2DV","json":"https://pith.science/pith/HOC3LLTYEMC4HEEESFRHZBS2DV.json","graph_json":"https://pith.science/api/pith-number/HOC3LLTYEMC4HEEESFRHZBS2DV/graph.json","events_json":"https://pith.science/api/pith-number/HOC3LLTYEMC4HEEESFRHZBS2DV/events.json","paper":"https://pith.science/paper/HOC3LLTY"},"agent_actions":{"view_html":"https://pith.science/pith/HOC3LLTYEMC4HEEESFRHZBS2DV","download_json":"https://pith.science/pith/HOC3LLTYEMC4HEEESFRHZBS2DV.json","view_paper":"https://pith.science/paper/HOC3LLTY","resolve_alias":"https://pith.science/api/pith-number/resolve?arxiv=2605.26791&json=true","fetch_graph":"https://pith.science/api/pith-number/HOC3LLTYEMC4HEEESFRHZBS2DV/graph.json","fetch_events":"https://pith.science/api/pith-number/HOC3LLTYEMC4HEEESFRHZBS2DV/events.json","actions":{"anchor_timestamp":"https://pith.science/pith/HOC3LLTYEMC4HEEESFRHZBS2DV/action/timestamp_anchor","attest_storage":"https://pith.science/pith/HOC3LLTYEMC4HEEESFRHZBS2DV/action/storage_attestation","attest_author":"https://pith.science/pith/HOC3LLTYEMC4HEEESFRHZBS2DV/action/author_attestation","sign_citation":"https://pith.science/pith/HOC3LLTYEMC4HEEESFRHZBS2DV/action/citation_signature","submit_replication":"https://pith.science/pith/HOC3LLTYEMC4HEEESFRHZBS2DV/action/replication_record"}},"created_at":"2026-05-27T01:06:12.857945+00:00","updated_at":"2026-05-27T01:06:12.857945+00:00"}