{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2020:IT6BDXX3EAWPNZ53OFXUXGYQ2S","short_pith_number":"pith:IT6BDXX3","canonical_record":{"source":{"id":"2006.10196","kind":"arxiv","version":3},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2020-06-17T23:32:50Z","cross_cats_sorted":[],"title_canon_sha256":"be3fa289c795893ff9ded921fc9bd34d1a2ad8940bb33050c155bfc980e35b6d","abstract_canon_sha256":"f6f3c642a6c03a0ad2592e45f76b3a9b0d7be41efed83cdcf6efaaf3e81922e0"},"schema_version":"1.0"},"canonical_sha256":"44fc11defb202cf6e7bb716f4b9b10d4983f2c42a09e602b82ccae3e1132d818","source":{"kind":"arxiv","id":"2006.10196","version":3},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2006.10196","created_at":"2026-07-05T02:29:09Z"},{"alias_kind":"arxiv_version","alias_value":"2006.10196v3","created_at":"2026-07-05T02:29:09Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2006.10196","created_at":"2026-07-05T02:29:09Z"},{"alias_kind":"pith_short_12","alias_value":"IT6BDXX3EAWP","created_at":"2026-07-05T02:29:09Z"},{"alias_kind":"pith_short_16","alias_value":"IT6BDXX3EAWPNZ53","created_at":"2026-07-05T02:29:09Z"},{"alias_kind":"pith_short_8","alias_value":"IT6BDXX3","created_at":"2026-07-05T02:29:09Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2020:IT6BDXX3EAWPNZ53OFXUXGYQ2S","target":"record","payload":{"canonical_record":{"source":{"id":"2006.10196","kind":"arxiv","version":3},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2020-06-17T23:32:50Z","cross_cats_sorted":[],"title_canon_sha256":"be3fa289c795893ff9ded921fc9bd34d1a2ad8940bb33050c155bfc980e35b6d","abstract_canon_sha256":"f6f3c642a6c03a0ad2592e45f76b3a9b0d7be41efed83cdcf6efaaf3e81922e0"},"schema_version":"1.0"},"canonical_sha256":"44fc11defb202cf6e7bb716f4b9b10d4983f2c42a09e602b82ccae3e1132d818","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T02:29:09.169378Z","signature_b64":"VcPGyzAZLZsITz6/Uaux+BQIHRZsBXF91wrzEyZMNBTc5A9mkid4BA5yW06OHkvUmbalq7D14bTrBlsQqRXDDw==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"44fc11defb202cf6e7bb716f4b9b10d4983f2c42a09e602b82ccae3e1132d818","last_reissued_at":"2026-07-05T02:29:09.168989Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T02:29:09.168989Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2006.10196","source_version":3,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T02:29:09Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"2DNOLjseq5QsowNo3vSDj4i4ozLjk+YNLJrqyq0iQMuQX+4QLAKAKTafr0e8GdjWLGxfA76wJ7JnrWXe9UQQCg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-14T15:56:02.822620Z"},"content_sha256":"6bdc21fe08a3d7ea490c4e3dc5dacf5c4aeff6a4fd75e679990a15b9cc624a4e","schema_version":"1.0","event_id":"sha256:6bdc21fe08a3d7ea490c4e3dc5dacf5c4aeff6a4fd75e679990a15b9cc624a4e"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2020:IT6BDXX3EAWPNZ53OFXUXGYQ2S","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"MBTree: Detecting Encryption RAT Communication Using Malicious Behavior Tree","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":[],"primary_cat":"cs.CR","authors_text":"Baoxu Liu, Cong Dong, Kai Chen, Zelin Cui, Zhigang Lu","submitted_at":"2020-06-17T23:32:50Z","abstract_excerpt":"Network trace signature matching is one reliable approach to detect active Remote Control Trojan, (RAT). Compared to statistical-based detection of malicious network traces in the face of known RATs, the signature-based method can achieve more stable performance and thus more reliability. However, with the development of encrypted technologies and disguise tricks, current methods suffer inaccurate signature descriptions and inflexible matching mechanisms. In this paper, we propose to tackle above problems by presenting MBTree, an approach to detect encryption RATs Command and Control (C&C) com"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2006.10196","kind":"arxiv","version":3},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2006.10196/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T02:29:09Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"Z7wR/CY4q+U9bD0aIGzg40I0IQnc1zeIp9HqWJ6k/2TkgFvsxpsZ6jleXyw8WC+5nxXLdgJqywTM61W9LArNDQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-14T15:56:02.823126Z"},"content_sha256":"6e51ffd1c247e66dfbfb9b5b598965758d421c628327292dcb0235cd06c61249","schema_version":"1.0","event_id":"sha256:6e51ffd1c247e66dfbfb9b5b598965758d421c628327292dcb0235cd06c61249"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/IT6BDXX3EAWPNZ53OFXUXGYQ2S/bundle.json","state_url":"https://pith.science/pith/IT6BDXX3EAWPNZ53OFXUXGYQ2S/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/IT6BDXX3EAWPNZ53OFXUXGYQ2S/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-14T15:56:02Z","links":{"resolver":"https://pith.science/pith/IT6BDXX3EAWPNZ53OFXUXGYQ2S","bundle":"https://pith.science/pith/IT6BDXX3EAWPNZ53OFXUXGYQ2S/bundle.json","state":"https://pith.science/pith/IT6BDXX3EAWPNZ53OFXUXGYQ2S/state.json","well_known_bundle":"https://pith.science/.well-known/pith/IT6BDXX3EAWPNZ53OFXUXGYQ2S/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2020:IT6BDXX3EAWPNZ53OFXUXGYQ2S","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"f6f3c642a6c03a0ad2592e45f76b3a9b0d7be41efed83cdcf6efaaf3e81922e0","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2020-06-17T23:32:50Z","title_canon_sha256":"be3fa289c795893ff9ded921fc9bd34d1a2ad8940bb33050c155bfc980e35b6d"},"schema_version":"1.0","source":{"id":"2006.10196","kind":"arxiv","version":3}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2006.10196","created_at":"2026-07-05T02:29:09Z"},{"alias_kind":"arxiv_version","alias_value":"2006.10196v3","created_at":"2026-07-05T02:29:09Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2006.10196","created_at":"2026-07-05T02:29:09Z"},{"alias_kind":"pith_short_12","alias_value":"IT6BDXX3EAWP","created_at":"2026-07-05T02:29:09Z"},{"alias_kind":"pith_short_16","alias_value":"IT6BDXX3EAWPNZ53","created_at":"2026-07-05T02:29:09Z"},{"alias_kind":"pith_short_8","alias_value":"IT6BDXX3","created_at":"2026-07-05T02:29:09Z"}],"graph_snapshots":[{"event_id":"sha256:6e51ffd1c247e66dfbfb9b5b598965758d421c628327292dcb0235cd06c61249","target":"graph","created_at":"2026-07-05T02:29:09Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2006.10196/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Network trace signature matching is one reliable approach to detect active Remote Control Trojan, (RAT). Compared to statistical-based detection of malicious network traces in the face of known RATs, the signature-based method can achieve more stable performance and thus more reliability. However, with the development of encrypted technologies and disguise tricks, current methods suffer inaccurate signature descriptions and inflexible matching mechanisms. In this paper, we propose to tackle above problems by presenting MBTree, an approach to detect encryption RATs Command and Control (C&C) com","authors_text":"Baoxu Liu, Cong Dong, Kai Chen, Zelin Cui, Zhigang Lu","cross_cats":[],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2020-06-17T23:32:50Z","title":"MBTree: Detecting Encryption RAT Communication Using Malicious Behavior Tree"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2006.10196","kind":"arxiv","version":3},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:6bdc21fe08a3d7ea490c4e3dc5dacf5c4aeff6a4fd75e679990a15b9cc624a4e","target":"record","created_at":"2026-07-05T02:29:09Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"f6f3c642a6c03a0ad2592e45f76b3a9b0d7be41efed83cdcf6efaaf3e81922e0","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2020-06-17T23:32:50Z","title_canon_sha256":"be3fa289c795893ff9ded921fc9bd34d1a2ad8940bb33050c155bfc980e35b6d"},"schema_version":"1.0","source":{"id":"2006.10196","kind":"arxiv","version":3}},"canonical_sha256":"44fc11defb202cf6e7bb716f4b9b10d4983f2c42a09e602b82ccae3e1132d818","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"44fc11defb202cf6e7bb716f4b9b10d4983f2c42a09e602b82ccae3e1132d818","first_computed_at":"2026-07-05T02:29:09.168989Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T02:29:09.168989Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"VcPGyzAZLZsITz6/Uaux+BQIHRZsBXF91wrzEyZMNBTc5A9mkid4BA5yW06OHkvUmbalq7D14bTrBlsQqRXDDw==","signature_status":"signed_v1","signed_at":"2026-07-05T02:29:09.169378Z","signed_message":"canonical_sha256_bytes"},"source_id":"2006.10196","source_kind":"arxiv","source_version":3}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:6bdc21fe08a3d7ea490c4e3dc5dacf5c4aeff6a4fd75e679990a15b9cc624a4e","sha256:6e51ffd1c247e66dfbfb9b5b598965758d421c628327292dcb0235cd06c61249"],"state_sha256":"65d7267facff26189c43440f9b382f4ebc407ad937d2d2cb7ef765e181a93bf1"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"nqdekZcQI6/04z9Lg0T80tHDgpuryLZQXXe+mskiV2hI7w9KlpRn2rOz7Gwg3ORasdtF68ioqiuw5mnvUGSVBg==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-14T15:56:02.827750Z","bundle_sha256":"e8f986f16340cdaf4c3c8b543d3a10ee49f8a93562ca41a6384f51df9de98503"}}