{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2024:IBTBBQSBISXVR2VT2L2VIQPX6G","short_pith_number":"pith:IBTBBQSB","canonical_record":{"source":{"id":"2411.05982","kind":"arxiv","version":2},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2024-11-08T21:30:33Z","cross_cats_sorted":["cs.AI"],"title_canon_sha256":"1effb55f7487d1631434f2d9d31db688b2540dd5ced8c49483a1619607e248ec","abstract_canon_sha256":"a398244dcfda779a7dbdf22f7e9205925584f626655247c587c77415f69ee8df"},"schema_version":"1.0"},"canonical_sha256":"406610c24144af58eab3d2f55441f7f1b638a7f4d98146cf817952d7e711cca7","source":{"kind":"arxiv","id":"2411.05982","version":2},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2411.05982","created_at":"2026-07-05T10:55:25Z"},{"alias_kind":"arxiv_version","alias_value":"2411.05982v2","created_at":"2026-07-05T10:55:25Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2411.05982","created_at":"2026-07-05T10:55:25Z"},{"alias_kind":"pith_short_12","alias_value":"IBTBBQSBISXV","created_at":"2026-07-05T10:55:25Z"},{"alias_kind":"pith_short_16","alias_value":"IBTBBQSBISXVR2VT","created_at":"2026-07-05T10:55:25Z"},{"alias_kind":"pith_short_8","alias_value":"IBTBBQSB","created_at":"2026-07-05T10:55:25Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2024:IBTBBQSBISXVR2VT2L2VIQPX6G","target":"record","payload":{"canonical_record":{"source":{"id":"2411.05982","kind":"arxiv","version":2},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2024-11-08T21:30:33Z","cross_cats_sorted":["cs.AI"],"title_canon_sha256":"1effb55f7487d1631434f2d9d31db688b2540dd5ced8c49483a1619607e248ec","abstract_canon_sha256":"a398244dcfda779a7dbdf22f7e9205925584f626655247c587c77415f69ee8df"},"schema_version":"1.0"},"canonical_sha256":"406610c24144af58eab3d2f55441f7f1b638a7f4d98146cf817952d7e711cca7","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T10:55:25.777243Z","signature_b64":"ezjMfP+ik7STZWowL5vlrf9zhf/45tCO+34g5AmdLT8v5nB2MVd6LLu71t24ooH+S/XRWoAbsRj4gI7KApPYDA==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"406610c24144af58eab3d2f55441f7f1b638a7f4d98146cf817952d7e711cca7","last_reissued_at":"2026-07-05T10:55:25.776681Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T10:55:25.776681Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2411.05982","source_version":2,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T10:55:25Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"0jo+zoYbaZu1c5xVb9mGowlw3RSAfqNMc2PrSmv4nbXt6ft2nPBv6sMcV85JR7j38evlwIqbEJGWNMV9BUITDQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-07-09T06:40:14.535924Z"},"content_sha256":"156128e5d940156878ed63d7df0af5ea79af2ce90013a25f280100532f649a9e","schema_version":"1.0","event_id":"sha256:156128e5d940156878ed63d7df0af5ea79af2ce90013a25f280100532f649a9e"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2024:IBTBBQSBISXVR2VT2L2VIQPX6G","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Unmasking the Shadows: Pinpoint the Implementations of Anti-Dynamic Analysis Techniques in Malware Using LLM","license":"http://creativecommons.org/licenses/by/4.0/","headline":"","cross_cats":["cs.AI"],"primary_cat":"cs.CR","authors_text":"Haizhou Wang, Nanqing Luo, Peng Liu, Xusheng Li","submitted_at":"2024-11-08T21:30:33Z","abstract_excerpt":"Sandboxes and other dynamic analysis processes are prevalent in malware detection systems nowadays to enhance the capability of detecting 0-day malware. Therefore, techniques of anti-dynamic analysis (TADA) are prevalent in modern malware samples, and sandboxes can suffer from false negatives and analysis failures when analyzing the samples with TADAs. In such cases, human reverse engineers will get involved in conducting dynamic analysis manually (i.e., debugging, patching), which in turn also gets obstructed by TADAs. In this work, we propose a Large Language Model (LLM) based workflow that "},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2411.05982","kind":"arxiv","version":2},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2411.05982/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T10:55:25Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"DvbDSwkiQzLJlDG4lniTJtjcxPYUuckVvZHY+VDoWKphJINOj2YaDmlbp62yFwvv15BMFcZZij5l5k9GiNTRAw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-07-09T06:40:14.536386Z"},"content_sha256":"622015165cbb7277877dcd0ea12b0ff8969d8cb0ec2b3d09991ce412d1bf642a","schema_version":"1.0","event_id":"sha256:622015165cbb7277877dcd0ea12b0ff8969d8cb0ec2b3d09991ce412d1bf642a"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/IBTBBQSBISXVR2VT2L2VIQPX6G/bundle.json","state_url":"https://pith.science/pith/IBTBBQSBISXVR2VT2L2VIQPX6G/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/IBTBBQSBISXVR2VT2L2VIQPX6G/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-07-09T06:40:14Z","links":{"resolver":"https://pith.science/pith/IBTBBQSBISXVR2VT2L2VIQPX6G","bundle":"https://pith.science/pith/IBTBBQSBISXVR2VT2L2VIQPX6G/bundle.json","state":"https://pith.science/pith/IBTBBQSBISXVR2VT2L2VIQPX6G/state.json","well_known_bundle":"https://pith.science/.well-known/pith/IBTBBQSBISXVR2VT2L2VIQPX6G/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2024:IBTBBQSBISXVR2VT2L2VIQPX6G","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"a398244dcfda779a7dbdf22f7e9205925584f626655247c587c77415f69ee8df","cross_cats_sorted":["cs.AI"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2024-11-08T21:30:33Z","title_canon_sha256":"1effb55f7487d1631434f2d9d31db688b2540dd5ced8c49483a1619607e248ec"},"schema_version":"1.0","source":{"id":"2411.05982","kind":"arxiv","version":2}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2411.05982","created_at":"2026-07-05T10:55:25Z"},{"alias_kind":"arxiv_version","alias_value":"2411.05982v2","created_at":"2026-07-05T10:55:25Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2411.05982","created_at":"2026-07-05T10:55:25Z"},{"alias_kind":"pith_short_12","alias_value":"IBTBBQSBISXV","created_at":"2026-07-05T10:55:25Z"},{"alias_kind":"pith_short_16","alias_value":"IBTBBQSBISXVR2VT","created_at":"2026-07-05T10:55:25Z"},{"alias_kind":"pith_short_8","alias_value":"IBTBBQSB","created_at":"2026-07-05T10:55:25Z"}],"graph_snapshots":[{"event_id":"sha256:622015165cbb7277877dcd0ea12b0ff8969d8cb0ec2b3d09991ce412d1bf642a","target":"graph","created_at":"2026-07-05T10:55:25Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2411.05982/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Sandboxes and other dynamic analysis processes are prevalent in malware detection systems nowadays to enhance the capability of detecting 0-day malware. Therefore, techniques of anti-dynamic analysis (TADA) are prevalent in modern malware samples, and sandboxes can suffer from false negatives and analysis failures when analyzing the samples with TADAs. In such cases, human reverse engineers will get involved in conducting dynamic analysis manually (i.e., debugging, patching), which in turn also gets obstructed by TADAs. In this work, we propose a Large Language Model (LLM) based workflow that ","authors_text":"Haizhou Wang, Nanqing Luo, Peng Liu, Xusheng Li","cross_cats":["cs.AI"],"headline":"","license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2024-11-08T21:30:33Z","title":"Unmasking the Shadows: Pinpoint the Implementations of Anti-Dynamic Analysis Techniques in Malware Using LLM"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2411.05982","kind":"arxiv","version":2},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:156128e5d940156878ed63d7df0af5ea79af2ce90013a25f280100532f649a9e","target":"record","created_at":"2026-07-05T10:55:25Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"a398244dcfda779a7dbdf22f7e9205925584f626655247c587c77415f69ee8df","cross_cats_sorted":["cs.AI"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2024-11-08T21:30:33Z","title_canon_sha256":"1effb55f7487d1631434f2d9d31db688b2540dd5ced8c49483a1619607e248ec"},"schema_version":"1.0","source":{"id":"2411.05982","kind":"arxiv","version":2}},"canonical_sha256":"406610c24144af58eab3d2f55441f7f1b638a7f4d98146cf817952d7e711cca7","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"406610c24144af58eab3d2f55441f7f1b638a7f4d98146cf817952d7e711cca7","first_computed_at":"2026-07-05T10:55:25.776681Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T10:55:25.776681Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"ezjMfP+ik7STZWowL5vlrf9zhf/45tCO+34g5AmdLT8v5nB2MVd6LLu71t24ooH+S/XRWoAbsRj4gI7KApPYDA==","signature_status":"signed_v1","signed_at":"2026-07-05T10:55:25.777243Z","signed_message":"canonical_sha256_bytes"},"source_id":"2411.05982","source_kind":"arxiv","source_version":2}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:156128e5d940156878ed63d7df0af5ea79af2ce90013a25f280100532f649a9e","sha256:622015165cbb7277877dcd0ea12b0ff8969d8cb0ec2b3d09991ce412d1bf642a"],"state_sha256":"e0425608740f28a3ea911a5951eb3e0e07b5aaaf007f8b3681a07f9a7964f441"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"MGWq2K7L38B3g/xbLwUqNKU23tCW92iZpX7a1bzg3sfaVrK+ZXazj74eSBJLl+kTCbnEhgGOGUkNobsPG+sEBg==","signed_message":"bundle_sha256_bytes","signed_at":"2026-07-09T06:40:14.538652Z","bundle_sha256":"3867a65ebe98ace428a74d5a78f73802ed221b4a4ffb257b38d7d8730f2598b0"}}