{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2016:IVSPKHOARGOFLYB5LFP5BWN26T","short_pith_number":"pith:IVSPKHOA","canonical_record":{"source":{"id":"1611.02787","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2016-11-09T01:11:45Z","cross_cats_sorted":[],"title_canon_sha256":"f5a6003959f95899c5d722bd68fca764607dcb72c78361b43a25e52a2ff39703","abstract_canon_sha256":"297ce3a924c436f5d2e51e0d51601fc035ebb08383ee7d564ab6700d7fa24ed1"},"schema_version":"1.0"},"canonical_sha256":"4564f51dc0899c55e03d595fd0d9baf4ff1351937358f2f9bcb3b455032fc1e0","source":{"kind":"arxiv","id":"1611.02787","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"1611.02787","created_at":"2026-05-18T00:20:57Z"},{"alias_kind":"arxiv_version","alias_value":"1611.02787v1","created_at":"2026-05-18T00:20:57Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.1611.02787","created_at":"2026-05-18T00:20:57Z"},{"alias_kind":"pith_short_12","alias_value":"IVSPKHOARGOF","created_at":"2026-05-18T12:30:22Z"},{"alias_kind":"pith_short_16","alias_value":"IVSPKHOARGOFLYB5","created_at":"2026-05-18T12:30:22Z"},{"alias_kind":"pith_short_8","alias_value":"IVSPKHOA","created_at":"2026-05-18T12:30:22Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2016:IVSPKHOARGOFLYB5LFP5BWN26T","target":"record","payload":{"canonical_record":{"source":{"id":"1611.02787","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2016-11-09T01:11:45Z","cross_cats_sorted":[],"title_canon_sha256":"f5a6003959f95899c5d722bd68fca764607dcb72c78361b43a25e52a2ff39703","abstract_canon_sha256":"297ce3a924c436f5d2e51e0d51601fc035ebb08383ee7d564ab6700d7fa24ed1"},"schema_version":"1.0"},"canonical_sha256":"4564f51dc0899c55e03d595fd0d9baf4ff1351937358f2f9bcb3b455032fc1e0","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-05-18T00:20:57.005483Z","signature_b64":"/1rS/IcdJASv1/aszvr+l/2XPJTTNehDMk/q/Yb+yCAiQXhIydlhrG40xn0kib0S1hiMvSIlJGCiva6kG/gfDQ==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"4564f51dc0899c55e03d595fd0d9baf4ff1351937358f2f9bcb3b455032fc1e0","last_reissued_at":"2026-05-18T00:20:57.004844Z","signature_status":"signed_v1","first_computed_at":"2026-05-18T00:20:57.004844Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"1611.02787","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-05-18T00:20:57Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"Tv0ealpx2PIQh6lHSrQw56NN67NM+j7ECf72SnjUJzEiHCQVaUsMkhx41lf1mXAVHZwhrykeuCvwgc8DVT7JAQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-06-05T21:09:50.941009Z"},"content_sha256":"81a91be81b0f6c55731ca49cef5a46d1fc2bfd6ccc28a5d0c2971d45fc195a19","schema_version":"1.0","event_id":"sha256:81a91be81b0f6c55731ca49cef5a46d1fc2bfd6ccc28a5d0c2971d45fc195a19"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2016:IVSPKHOARGOFLYB5LFP5BWN26T","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Catching Worms, Trojan Horses and PUPs: Unsupervised Detection of Silent Delivery Campaigns","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":[],"primary_cat":"cs.CR","authors_text":"Amol Deshpande, Bum Jun Kwon, Tudor Dumitra\\c{s}, Virinchi Srinivas","submitted_at":"2016-11-09T01:11:45Z","abstract_excerpt":"The growing commoditization of the underground economy has given rise to malware delivery networks, which charge fees for quickly delivering malware or unwanted software to a large number of hosts. To provide this service, a key method is the orchestration of silent delivery campaigns, which involve a group of downloaders that receive remote commands and that deliver their payloads without any user interaction. These campaigns have not been characterized systematically, unlike other aspects of malware delivery networks. Moreover, silent delivery campaigns can evade detection by relying on inco"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"1611.02787","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-05-18T00:20:57Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"6r1YE2Vtf+1+Lq2yA3ChvuavSTyWgYK7zz/yIUHdof1GprUEJy/dLzIQ9ok7xlffU/nukIqTwWNntJWWTrOGDA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-06-05T21:09:50.941376Z"},"content_sha256":"1085240d45b45a9d7f203a707f89feddbbc025125132d4bf6f51fa37c1c7c4b5","schema_version":"1.0","event_id":"sha256:1085240d45b45a9d7f203a707f89feddbbc025125132d4bf6f51fa37c1c7c4b5"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/IVSPKHOARGOFLYB5LFP5BWN26T/bundle.json","state_url":"https://pith.science/pith/IVSPKHOARGOFLYB5LFP5BWN26T/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/IVSPKHOARGOFLYB5LFP5BWN26T/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-06-05T21:09:50Z","links":{"resolver":"https://pith.science/pith/IVSPKHOARGOFLYB5LFP5BWN26T","bundle":"https://pith.science/pith/IVSPKHOARGOFLYB5LFP5BWN26T/bundle.json","state":"https://pith.science/pith/IVSPKHOARGOFLYB5LFP5BWN26T/state.json","well_known_bundle":"https://pith.science/.well-known/pith/IVSPKHOARGOFLYB5LFP5BWN26T/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2016:IVSPKHOARGOFLYB5LFP5BWN26T","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"297ce3a924c436f5d2e51e0d51601fc035ebb08383ee7d564ab6700d7fa24ed1","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2016-11-09T01:11:45Z","title_canon_sha256":"f5a6003959f95899c5d722bd68fca764607dcb72c78361b43a25e52a2ff39703"},"schema_version":"1.0","source":{"id":"1611.02787","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"1611.02787","created_at":"2026-05-18T00:20:57Z"},{"alias_kind":"arxiv_version","alias_value":"1611.02787v1","created_at":"2026-05-18T00:20:57Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.1611.02787","created_at":"2026-05-18T00:20:57Z"},{"alias_kind":"pith_short_12","alias_value":"IVSPKHOARGOF","created_at":"2026-05-18T12:30:22Z"},{"alias_kind":"pith_short_16","alias_value":"IVSPKHOARGOFLYB5","created_at":"2026-05-18T12:30:22Z"},{"alias_kind":"pith_short_8","alias_value":"IVSPKHOA","created_at":"2026-05-18T12:30:22Z"}],"graph_snapshots":[{"event_id":"sha256:1085240d45b45a9d7f203a707f89feddbbc025125132d4bf6f51fa37c1c7c4b5","target":"graph","created_at":"2026-05-18T00:20:57Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"paper":{"abstract_excerpt":"The growing commoditization of the underground economy has given rise to malware delivery networks, which charge fees for quickly delivering malware or unwanted software to a large number of hosts. To provide this service, a key method is the orchestration of silent delivery campaigns, which involve a group of downloaders that receive remote commands and that deliver their payloads without any user interaction. These campaigns have not been characterized systematically, unlike other aspects of malware delivery networks. Moreover, silent delivery campaigns can evade detection by relying on inco","authors_text":"Amol Deshpande, Bum Jun Kwon, Tudor Dumitra\\c{s}, Virinchi Srinivas","cross_cats":[],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2016-11-09T01:11:45Z","title":"Catching Worms, Trojan Horses and PUPs: Unsupervised Detection of Silent Delivery Campaigns"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"1611.02787","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:81a91be81b0f6c55731ca49cef5a46d1fc2bfd6ccc28a5d0c2971d45fc195a19","target":"record","created_at":"2026-05-18T00:20:57Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"297ce3a924c436f5d2e51e0d51601fc035ebb08383ee7d564ab6700d7fa24ed1","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2016-11-09T01:11:45Z","title_canon_sha256":"f5a6003959f95899c5d722bd68fca764607dcb72c78361b43a25e52a2ff39703"},"schema_version":"1.0","source":{"id":"1611.02787","kind":"arxiv","version":1}},"canonical_sha256":"4564f51dc0899c55e03d595fd0d9baf4ff1351937358f2f9bcb3b455032fc1e0","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"4564f51dc0899c55e03d595fd0d9baf4ff1351937358f2f9bcb3b455032fc1e0","first_computed_at":"2026-05-18T00:20:57.004844Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-05-18T00:20:57.004844Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"/1rS/IcdJASv1/aszvr+l/2XPJTTNehDMk/q/Yb+yCAiQXhIydlhrG40xn0kib0S1hiMvSIlJGCiva6kG/gfDQ==","signature_status":"signed_v1","signed_at":"2026-05-18T00:20:57.005483Z","signed_message":"canonical_sha256_bytes"},"source_id":"1611.02787","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:81a91be81b0f6c55731ca49cef5a46d1fc2bfd6ccc28a5d0c2971d45fc195a19","sha256:1085240d45b45a9d7f203a707f89feddbbc025125132d4bf6f51fa37c1c7c4b5"],"state_sha256":"61d07ee5a2657fca96365554354271d3bcc512ef7c5bc74080200ba28cd3595b"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"iqN2ycEFOv1B7ZE4CplkvUOKny6CCYd87KZJ0A3oSZPXXSL1vzSMey+MoQ7VJ0639twlQkI00TsMD62m8FMZAg==","signed_message":"bundle_sha256_bytes","signed_at":"2026-06-05T21:09:50.944949Z","bundle_sha256":"1048627e5420e5d01f0dcffe304d610f8b5ec46b194cd1e6508d24222320c0b8"}}