{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2022:HONN2V3OXTMBGVVLP32BS7FVCH","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"22d1a5a60b97a4d819aad9bcf4903bb9501ba82a85b39546dc373a4e18380463","cross_cats_sorted":["cs.LG","cs.NI"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2022-09-02T10:56:15Z","title_canon_sha256":"35bc79d90b26a2f433bd08fd5036ec5b92b1f2d912f8ee83cec49157f33a2100"},"schema_version":"1.0","source":{"id":"2209.00943","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2209.00943","created_at":"2026-07-05T04:54:06Z"},{"alias_kind":"arxiv_version","alias_value":"2209.00943v1","created_at":"2026-07-05T04:54:06Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2209.00943","created_at":"2026-07-05T04:54:06Z"},{"alias_kind":"pith_short_12","alias_value":"HONN2V3OXTMB","created_at":"2026-07-05T04:54:06Z"},{"alias_kind":"pith_short_16","alias_value":"HONN2V3OXTMBGVVL","created_at":"2026-07-05T04:54:06Z"},{"alias_kind":"pith_short_8","alias_value":"HONN2V3O","created_at":"2026-07-05T04:54:06Z"}],"graph_snapshots":[{"event_id":"sha256:c9aceb7299ea0781cec310639fb4673715366be3f482abc2be6feba3bde9fd6b","target":"graph","created_at":"2026-07-05T04:54:06Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2209.00943/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Command and Control (C2) communication is a key component of any structured cyber-attack. As such, security operations actively try to detect this type of communication in their networks. This poses a problem for legitimate pentesters that try to remain undetected, since commonly used pentesting tools, such as Metasploit, generate constant traffic patterns that are easily distinguishable from regular web traffic. In this paper we start with these identifiable patterns in Metasploit's C2 traffic and show that a machine learning-based detector is able to detect the presence of such traffic with ","authors_text":"Carlos Novo, Gon\\c{c}alo Xavier, Ricardo Morla","cross_cats":["cs.LG","cs.NI"],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2022-09-02T10:56:15Z","title":"Tweaking Metasploit to Evade Encrypted C2 Traffic Detection"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2209.00943","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:339d2f4dd4dfc56a6a54226463fd035008904a03ab15cfe7b1f90d255c2e5c92","target":"record","created_at":"2026-07-05T04:54:06Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"22d1a5a60b97a4d819aad9bcf4903bb9501ba82a85b39546dc373a4e18380463","cross_cats_sorted":["cs.LG","cs.NI"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2022-09-02T10:56:15Z","title_canon_sha256":"35bc79d90b26a2f433bd08fd5036ec5b92b1f2d912f8ee83cec49157f33a2100"},"schema_version":"1.0","source":{"id":"2209.00943","kind":"arxiv","version":1}},"canonical_sha256":"3b9add576ebcd81356ab7ef4197cb511d1b36b269ef134e0ff0448b0baec861a","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"3b9add576ebcd81356ab7ef4197cb511d1b36b269ef134e0ff0448b0baec861a","first_computed_at":"2026-07-05T04:54:06.834027Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T04:54:06.834027Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"8nVlZfqvTq5kMTyr/lJTAwEe5BMhD7nwlHgWet6xNp0w10E0mD0bXMQKQ1l1LC1LCS8ERjLB5R35sSMple+0Cg==","signature_status":"signed_v1","signed_at":"2026-07-05T04:54:06.834432Z","signed_message":"canonical_sha256_bytes"},"source_id":"2209.00943","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:339d2f4dd4dfc56a6a54226463fd035008904a03ab15cfe7b1f90d255c2e5c92","sha256:c9aceb7299ea0781cec310639fb4673715366be3f482abc2be6feba3bde9fd6b"],"state_sha256":"737fe847592975532ae3f84060e165a9ec4400df4fc362933f8dcba45a551e79"}