{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2016:IQ3A5ZSRQQUTEITZI7XHD7GSWC","short_pith_number":"pith:IQ3A5ZSR","canonical_record":{"source":{"id":"1611.08294","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2016-11-24T19:43:10Z","cross_cats_sorted":[],"title_canon_sha256":"a2304915bdffb9a9cc5c2325894b546e47e29dccbbcde25eff6a81c82f94da5a","abstract_canon_sha256":"94bfe21d9861a9b1ee2cbf4ef6176e8185ab7004c7cf74e0279eef2958edb40f"},"schema_version":"1.0"},"canonical_sha256":"44360ee651842932227947ee71fcd2b0952d6b8155805a539d0a36af286441d5","source":{"kind":"arxiv","id":"1611.08294","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"1611.08294","created_at":"2026-05-18T00:19:04Z"},{"alias_kind":"arxiv_version","alias_value":"1611.08294v1","created_at":"2026-05-18T00:19:04Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.1611.08294","created_at":"2026-05-18T00:19:04Z"},{"alias_kind":"pith_short_12","alias_value":"IQ3A5ZSRQQUT","created_at":"2026-05-18T12:30:22Z"},{"alias_kind":"pith_short_16","alias_value":"IQ3A5ZSRQQUTEITZ","created_at":"2026-05-18T12:30:22Z"},{"alias_kind":"pith_short_8","alias_value":"IQ3A5ZSR","created_at":"2026-05-18T12:30:22Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2016:IQ3A5ZSRQQUTEITZI7XHD7GSWC","target":"record","payload":{"canonical_record":{"source":{"id":"1611.08294","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2016-11-24T19:43:10Z","cross_cats_sorted":[],"title_canon_sha256":"a2304915bdffb9a9cc5c2325894b546e47e29dccbbcde25eff6a81c82f94da5a","abstract_canon_sha256":"94bfe21d9861a9b1ee2cbf4ef6176e8185ab7004c7cf74e0279eef2958edb40f"},"schema_version":"1.0"},"canonical_sha256":"44360ee651842932227947ee71fcd2b0952d6b8155805a539d0a36af286441d5","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-05-18T00:19:04.425346Z","signature_b64":"+MpV6tHRwbfyrGVaEfvjTw3Dk6ysd/Xdsd1rjIbr/UYvl8PzMNhEB00jxQxpAjsOjw1HLmL0n83vpQEGAJWEBQ==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"44360ee651842932227947ee71fcd2b0952d6b8155805a539d0a36af286441d5","last_reissued_at":"2026-05-18T00:19:04.424831Z","signature_status":"signed_v1","first_computed_at":"2026-05-18T00:19:04.424831Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"1611.08294","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-05-18T00:19:04Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"QborHq+RNW9zZTtBRaUd6MfZlAWT2Do+ON3k+V8uEIqu+82rrXV73l7LrJGyVwDWmW//KS5J4k5/TTGvE0qoAw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-06-09T02:04:32.984884Z"},"content_sha256":"1e1e37b35112e9cb88b978f5e04fd1c309cd85e6ac272cab9e5c6eb3c72e92f4","schema_version":"1.0","event_id":"sha256:1e1e37b35112e9cb88b978f5e04fd1c309cd85e6ac272cab9e5c6eb3c72e92f4"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2016:IQ3A5ZSRQQUTEITZI7XHD7GSWC","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Software-Defined Networking-based Crypto Ransomware Detection Using HTTP Traffic Characteristics","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":[],"primary_cat":"cs.CR","authors_text":"Krzysztof Cabaj, Marcin Gregorczyk, Wojciech Mazurczyk","submitted_at":"2016-11-24T19:43:10Z","abstract_excerpt":"Ransomware is currently the key threat for individual as well as corporate Internet users. Especially dangerous is crypto ransomware that encrypts important user data and it is only possible to recover it once a ransom has been paid. Therefore devising efficient and effective countermeasures is a rising necessity. In this paper we present a novel Software-Defined Networking (SDN) based detection approach that utilizes characteristics of ransomware communication. Based on the observation of network communication of two crypto ransomware families, namely CryptoWall and Locky we conclude that ana"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"1611.08294","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-05-18T00:19:04Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"/NFUlVqviTjzCt2g6McTD2M7K0q3AM0XQaNEYxRrR6iw8n+pZv+5LTbpQ4gafNdbSs4OZH7XhPB0y3Wk2W2vBg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-06-09T02:04:32.985529Z"},"content_sha256":"ffc12bc2b4b2b9bfc6f68bb290b9b89e0953d3d182822710a0d7bd483feb6ba8","schema_version":"1.0","event_id":"sha256:ffc12bc2b4b2b9bfc6f68bb290b9b89e0953d3d182822710a0d7bd483feb6ba8"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/IQ3A5ZSRQQUTEITZI7XHD7GSWC/bundle.json","state_url":"https://pith.science/pith/IQ3A5ZSRQQUTEITZI7XHD7GSWC/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/IQ3A5ZSRQQUTEITZI7XHD7GSWC/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-06-09T02:04:32Z","links":{"resolver":"https://pith.science/pith/IQ3A5ZSRQQUTEITZI7XHD7GSWC","bundle":"https://pith.science/pith/IQ3A5ZSRQQUTEITZI7XHD7GSWC/bundle.json","state":"https://pith.science/pith/IQ3A5ZSRQQUTEITZI7XHD7GSWC/state.json","well_known_bundle":"https://pith.science/.well-known/pith/IQ3A5ZSRQQUTEITZI7XHD7GSWC/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2016:IQ3A5ZSRQQUTEITZI7XHD7GSWC","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"94bfe21d9861a9b1ee2cbf4ef6176e8185ab7004c7cf74e0279eef2958edb40f","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2016-11-24T19:43:10Z","title_canon_sha256":"a2304915bdffb9a9cc5c2325894b546e47e29dccbbcde25eff6a81c82f94da5a"},"schema_version":"1.0","source":{"id":"1611.08294","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"1611.08294","created_at":"2026-05-18T00:19:04Z"},{"alias_kind":"arxiv_version","alias_value":"1611.08294v1","created_at":"2026-05-18T00:19:04Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.1611.08294","created_at":"2026-05-18T00:19:04Z"},{"alias_kind":"pith_short_12","alias_value":"IQ3A5ZSRQQUT","created_at":"2026-05-18T12:30:22Z"},{"alias_kind":"pith_short_16","alias_value":"IQ3A5ZSRQQUTEITZ","created_at":"2026-05-18T12:30:22Z"},{"alias_kind":"pith_short_8","alias_value":"IQ3A5ZSR","created_at":"2026-05-18T12:30:22Z"}],"graph_snapshots":[{"event_id":"sha256:ffc12bc2b4b2b9bfc6f68bb290b9b89e0953d3d182822710a0d7bd483feb6ba8","target":"graph","created_at":"2026-05-18T00:19:04Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"paper":{"abstract_excerpt":"Ransomware is currently the key threat for individual as well as corporate Internet users. Especially dangerous is crypto ransomware that encrypts important user data and it is only possible to recover it once a ransom has been paid. Therefore devising efficient and effective countermeasures is a rising necessity. In this paper we present a novel Software-Defined Networking (SDN) based detection approach that utilizes characteristics of ransomware communication. Based on the observation of network communication of two crypto ransomware families, namely CryptoWall and Locky we conclude that ana","authors_text":"Krzysztof Cabaj, Marcin Gregorczyk, Wojciech Mazurczyk","cross_cats":[],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2016-11-24T19:43:10Z","title":"Software-Defined Networking-based Crypto Ransomware Detection Using HTTP Traffic Characteristics"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"1611.08294","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:1e1e37b35112e9cb88b978f5e04fd1c309cd85e6ac272cab9e5c6eb3c72e92f4","target":"record","created_at":"2026-05-18T00:19:04Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"94bfe21d9861a9b1ee2cbf4ef6176e8185ab7004c7cf74e0279eef2958edb40f","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2016-11-24T19:43:10Z","title_canon_sha256":"a2304915bdffb9a9cc5c2325894b546e47e29dccbbcde25eff6a81c82f94da5a"},"schema_version":"1.0","source":{"id":"1611.08294","kind":"arxiv","version":1}},"canonical_sha256":"44360ee651842932227947ee71fcd2b0952d6b8155805a539d0a36af286441d5","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"44360ee651842932227947ee71fcd2b0952d6b8155805a539d0a36af286441d5","first_computed_at":"2026-05-18T00:19:04.424831Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-05-18T00:19:04.424831Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"+MpV6tHRwbfyrGVaEfvjTw3Dk6ysd/Xdsd1rjIbr/UYvl8PzMNhEB00jxQxpAjsOjw1HLmL0n83vpQEGAJWEBQ==","signature_status":"signed_v1","signed_at":"2026-05-18T00:19:04.425346Z","signed_message":"canonical_sha256_bytes"},"source_id":"1611.08294","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:1e1e37b35112e9cb88b978f5e04fd1c309cd85e6ac272cab9e5c6eb3c72e92f4","sha256:ffc12bc2b4b2b9bfc6f68bb290b9b89e0953d3d182822710a0d7bd483feb6ba8"],"state_sha256":"acdf9a7b530eecbb7218d4b0e8137e57fdc6d1fd400a107dffe39504e9e48777"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"luEgJaGHsAhBeTa0/lEPkXUbYvoQFBjODtSD3GSlwsqGPBtw5Or/Pt4Wsmzws3iynns+ULDrKIL5DuAO5udgBQ==","signed_message":"bundle_sha256_bytes","signed_at":"2026-06-09T02:04:32.988963Z","bundle_sha256":"a21537d5dbce3c98e82f780340373821468e8d5597cd35af65874ca7c59c21c4"}}