{"record_type":"pith_number_record","schema_url":"https://pith.science/schemas/pith-number/v1.json","pith_number":"pith:2024:IBTBBQSBISXVR2VT2L2VIQPX6G","short_pith_number":"pith:IBTBBQSB","schema_version":"1.0","canonical_sha256":"406610c24144af58eab3d2f55441f7f1b638a7f4d98146cf817952d7e711cca7","source":{"kind":"arxiv","id":"2411.05982","version":2},"attestation_state":"computed","paper":{"title":"Unmasking the Shadows: Pinpoint the Implementations of Anti-Dynamic Analysis Techniques in Malware Using LLM","license":"http://creativecommons.org/licenses/by/4.0/","headline":"","cross_cats":["cs.AI"],"primary_cat":"cs.CR","authors_text":"Haizhou Wang, Nanqing Luo, Peng Liu, Xusheng Li","submitted_at":"2024-11-08T21:30:33Z","abstract_excerpt":"Sandboxes and other dynamic analysis processes are prevalent in malware detection systems nowadays to enhance the capability of detecting 0-day malware. Therefore, techniques of anti-dynamic analysis (TADA) are prevalent in modern malware samples, and sandboxes can suffer from false negatives and analysis failures when analyzing the samples with TADAs. In such cases, human reverse engineers will get involved in conducting dynamic analysis manually (i.e., debugging, patching), which in turn also gets obstructed by TADAs. In this work, we propose a Large Language Model (LLM) based workflow that "},"verification_status":{"content_addressed":true,"pith_receipt":true,"author_attested":false,"weak_author_claims":0,"strong_author_claims":0,"externally_anchored":false,"storage_verified":false,"citation_signatures":0,"replication_records":0,"graph_snapshot":true,"references_resolved":false,"formal_links_present":false},"canonical_record":{"source":{"id":"2411.05982","kind":"arxiv","version":2},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2024-11-08T21:30:33Z","cross_cats_sorted":["cs.AI"],"title_canon_sha256":"1effb55f7487d1631434f2d9d31db688b2540dd5ced8c49483a1619607e248ec","abstract_canon_sha256":"a398244dcfda779a7dbdf22f7e9205925584f626655247c587c77415f69ee8df"},"schema_version":"1.0"},"receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T10:55:25.777243Z","signature_b64":"ezjMfP+ik7STZWowL5vlrf9zhf/45tCO+34g5AmdLT8v5nB2MVd6LLu71t24ooH+S/XRWoAbsRj4gI7KApPYDA==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"406610c24144af58eab3d2f55441f7f1b638a7f4d98146cf817952d7e711cca7","last_reissued_at":"2026-07-05T10:55:25.776681Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T10:55:25.776681Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"graph_snapshot":{"paper":{"title":"Unmasking the Shadows: Pinpoint the Implementations of Anti-Dynamic Analysis Techniques in Malware Using LLM","license":"http://creativecommons.org/licenses/by/4.0/","headline":"","cross_cats":["cs.AI"],"primary_cat":"cs.CR","authors_text":"Haizhou Wang, Nanqing Luo, Peng Liu, Xusheng Li","submitted_at":"2024-11-08T21:30:33Z","abstract_excerpt":"Sandboxes and other dynamic analysis processes are prevalent in malware detection systems nowadays to enhance the capability of detecting 0-day malware. Therefore, techniques of anti-dynamic analysis (TADA) are prevalent in modern malware samples, and sandboxes can suffer from false negatives and analysis failures when analyzing the samples with TADAs. In such cases, human reverse engineers will get involved in conducting dynamic analysis manually (i.e., debugging, patching), which in turn also gets obstructed by TADAs. In this work, we propose a Large Language Model (LLM) based workflow that "},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2411.05982","kind":"arxiv","version":2},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2411.05982/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"aliases":[{"alias_kind":"arxiv","alias_value":"2411.05982","created_at":"2026-07-05T10:55:25.776758+00:00"},{"alias_kind":"arxiv_version","alias_value":"2411.05982v2","created_at":"2026-07-05T10:55:25.776758+00:00"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2411.05982","created_at":"2026-07-05T10:55:25.776758+00:00"},{"alias_kind":"pith_short_12","alias_value":"IBTBBQSBISXV","created_at":"2026-07-05T10:55:25.776758+00:00"},{"alias_kind":"pith_short_16","alias_value":"IBTBBQSBISXVR2VT","created_at":"2026-07-05T10:55:25.776758+00:00"},{"alias_kind":"pith_short_8","alias_value":"IBTBBQSB","created_at":"2026-07-05T10:55:25.776758+00:00"}],"events":[],"event_summary":{},"paper_claims":[],"inbound_citations":{"count":0,"internal_anchor_count":0,"sample":[]},"formal_canon":{"evidence_count":0,"sample":[],"anchors":[]},"links":{"html":"https://pith.science/pith/IBTBBQSBISXVR2VT2L2VIQPX6G","json":"https://pith.science/pith/IBTBBQSBISXVR2VT2L2VIQPX6G.json","graph_json":"https://pith.science/api/pith-number/IBTBBQSBISXVR2VT2L2VIQPX6G/graph.json","events_json":"https://pith.science/api/pith-number/IBTBBQSBISXVR2VT2L2VIQPX6G/events.json","paper":"https://pith.science/paper/IBTBBQSB"},"agent_actions":{"view_html":"https://pith.science/pith/IBTBBQSBISXVR2VT2L2VIQPX6G","download_json":"https://pith.science/pith/IBTBBQSBISXVR2VT2L2VIQPX6G.json","view_paper":"https://pith.science/paper/IBTBBQSB","resolve_alias":"https://pith.science/api/pith-number/resolve?arxiv=2411.05982&json=true","fetch_graph":"https://pith.science/api/pith-number/IBTBBQSBISXVR2VT2L2VIQPX6G/graph.json","fetch_events":"https://pith.science/api/pith-number/IBTBBQSBISXVR2VT2L2VIQPX6G/events.json","actions":{"anchor_timestamp":"https://pith.science/pith/IBTBBQSBISXVR2VT2L2VIQPX6G/action/timestamp_anchor","attest_storage":"https://pith.science/pith/IBTBBQSBISXVR2VT2L2VIQPX6G/action/storage_attestation","attest_author":"https://pith.science/pith/IBTBBQSBISXVR2VT2L2VIQPX6G/action/author_attestation","sign_citation":"https://pith.science/pith/IBTBBQSBISXVR2VT2L2VIQPX6G/action/citation_signature","submit_replication":"https://pith.science/pith/IBTBBQSBISXVR2VT2L2VIQPX6G/action/replication_record"}},"created_at":"2026-07-05T10:55:25.776758+00:00","updated_at":"2026-07-05T10:55:25.776758+00:00"}