{"record_type":"pith_number_record","schema_url":"https://pith.science/schemas/pith-number/v1.json","pith_number":"pith:2018:IVTM4YO2EV6JJU6E4BLN6G2UGW","short_pith_number":"pith:IVTM4YO2","schema_version":"1.0","canonical_sha256":"4566ce61da257c94d3c4e056df1b5435b5eec5166a988baecd02c3520e48c1d8","source":{"kind":"arxiv","id":"1803.00883","version":1},"attestation_state":"computed","paper":{"title":"The Shape of Alerts: Detecting Malware Using Distributed Detectors by Robustly Amplifying Transient Correlations","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":[],"primary_cat":"cs.CR","authors_text":"Constantine Caramanis, Mikhail Kazdagli, Mohit Tiwari, Sanjay Shakkottai","submitted_at":"2018-03-01T05:08:13Z","abstract_excerpt":"We introduce a new malware detector - Shape-GD - that aggregates per-machine detectors into a robust global detector. Shape-GD is based on two insights: 1. Structural: actions such as visiting a website (waterhole attack) by nodes correlate well with malware spread, and create dynamic neighborhoods of nodes that were exposed to the same attack vector. However, neighborhood sizes vary unpredictably and require aggregating an unpredictable number of local detectors' outputs into a global alert. 2. Statistical: feature vectors corresponding to true and false positives of local detectors have mark"},"verification_status":{"content_addressed":true,"pith_receipt":true,"author_attested":false,"weak_author_claims":0,"strong_author_claims":0,"externally_anchored":false,"storage_verified":false,"citation_signatures":0,"replication_records":0,"graph_snapshot":true,"references_resolved":false,"formal_links_present":false},"canonical_record":{"source":{"id":"1803.00883","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2018-03-01T05:08:13Z","cross_cats_sorted":[],"title_canon_sha256":"bf740540561ec04e4652c2aee169d5503bff1550752a33576370b6aec8cb8e76","abstract_canon_sha256":"1290f9a5c80a6d53d3d8a8e65b92a99b2ab364207d368e67d4dfb0da7d2f9651"},"schema_version":"1.0"},"receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-05-18T00:22:07.594911Z","signature_b64":"Rlt8bUS+GxZWl7McHB37OP8nYPiryaoopBZumNBJzLQaY6erHMaKDkO6XVaruZFy+0S0pIYT0qgTvu08ndFHBg==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"4566ce61da257c94d3c4e056df1b5435b5eec5166a988baecd02c3520e48c1d8","last_reissued_at":"2026-05-18T00:22:07.594387Z","signature_status":"signed_v1","first_computed_at":"2026-05-18T00:22:07.594387Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"graph_snapshot":{"paper":{"title":"The Shape of Alerts: Detecting Malware Using Distributed Detectors by Robustly Amplifying Transient Correlations","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":[],"primary_cat":"cs.CR","authors_text":"Constantine Caramanis, Mikhail Kazdagli, Mohit Tiwari, Sanjay Shakkottai","submitted_at":"2018-03-01T05:08:13Z","abstract_excerpt":"We introduce a new malware detector - Shape-GD - that aggregates per-machine detectors into a robust global detector. Shape-GD is based on two insights: 1. Structural: actions such as visiting a website (waterhole attack) by nodes correlate well with malware spread, and create dynamic neighborhoods of nodes that were exposed to the same attack vector. However, neighborhood sizes vary unpredictably and require aggregating an unpredictable number of local detectors' outputs into a global alert. 2. Statistical: feature vectors corresponding to true and false positives of local detectors have mark"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"1803.00883","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"aliases":[{"alias_kind":"arxiv","alias_value":"1803.00883","created_at":"2026-05-18T00:22:07.594466+00:00"},{"alias_kind":"arxiv_version","alias_value":"1803.00883v1","created_at":"2026-05-18T00:22:07.594466+00:00"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.1803.00883","created_at":"2026-05-18T00:22:07.594466+00:00"},{"alias_kind":"pith_short_12","alias_value":"IVTM4YO2EV6J","created_at":"2026-05-18T12:32:31.084164+00:00"},{"alias_kind":"pith_short_16","alias_value":"IVTM4YO2EV6JJU6E","created_at":"2026-05-18T12:32:31.084164+00:00"},{"alias_kind":"pith_short_8","alias_value":"IVTM4YO2","created_at":"2026-05-18T12:32:31.084164+00:00"}],"events":[],"event_summary":{},"paper_claims":[],"inbound_citations":{"count":0,"internal_anchor_count":0,"sample":[]},"formal_canon":{"evidence_count":0,"sample":[],"anchors":[]},"links":{"html":"https://pith.science/pith/IVTM4YO2EV6JJU6E4BLN6G2UGW","json":"https://pith.science/pith/IVTM4YO2EV6JJU6E4BLN6G2UGW.json","graph_json":"https://pith.science/api/pith-number/IVTM4YO2EV6JJU6E4BLN6G2UGW/graph.json","events_json":"https://pith.science/api/pith-number/IVTM4YO2EV6JJU6E4BLN6G2UGW/events.json","paper":"https://pith.science/paper/IVTM4YO2"},"agent_actions":{"view_html":"https://pith.science/pith/IVTM4YO2EV6JJU6E4BLN6G2UGW","download_json":"https://pith.science/pith/IVTM4YO2EV6JJU6E4BLN6G2UGW.json","view_paper":"https://pith.science/paper/IVTM4YO2","resolve_alias":"https://pith.science/api/pith-number/resolve?arxiv=1803.00883&json=true","fetch_graph":"https://pith.science/api/pith-number/IVTM4YO2EV6JJU6E4BLN6G2UGW/graph.json","fetch_events":"https://pith.science/api/pith-number/IVTM4YO2EV6JJU6E4BLN6G2UGW/events.json","actions":{"anchor_timestamp":"https://pith.science/pith/IVTM4YO2EV6JJU6E4BLN6G2UGW/action/timestamp_anchor","attest_storage":"https://pith.science/pith/IVTM4YO2EV6JJU6E4BLN6G2UGW/action/storage_attestation","attest_author":"https://pith.science/pith/IVTM4YO2EV6JJU6E4BLN6G2UGW/action/author_attestation","sign_citation":"https://pith.science/pith/IVTM4YO2EV6JJU6E4BLN6G2UGW/action/citation_signature","submit_replication":"https://pith.science/pith/IVTM4YO2EV6JJU6E4BLN6G2UGW/action/replication_record"}},"created_at":"2026-05-18T00:22:07.594466+00:00","updated_at":"2026-05-18T00:22:07.594466+00:00"}