{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2025:J5H42LYV76T7HSANTC2MW2NTHL","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"35bf99bad4b55734c61c334168532365aac874b3d302c4726898e775159a9979","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2025-02-04T22:55:39Z","title_canon_sha256":"0bc6761683f3db863b22825aa5b0f2836713ee2c95c033831f6057dbe655ad70"},"schema_version":"1.0","source":{"id":"2502.02759","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2502.02759","created_at":"2026-07-05T10:09:54Z"},{"alias_kind":"arxiv_version","alias_value":"2502.02759v1","created_at":"2026-07-05T10:09:54Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2502.02759","created_at":"2026-07-05T10:09:54Z"},{"alias_kind":"pith_short_12","alias_value":"J5H42LYV76T7","created_at":"2026-07-05T10:09:54Z"},{"alias_kind":"pith_short_16","alias_value":"J5H42LYV76T7HSAN","created_at":"2026-07-05T10:09:54Z"},{"alias_kind":"pith_short_8","alias_value":"J5H42LYV","created_at":"2026-07-05T10:09:54Z"}],"graph_snapshots":[{"event_id":"sha256:a42fb06b42f08b4ceb8f21e1564e1e0faa5a8c29ec1dead60134e8d67495fd86","target":"graph","created_at":"2026-07-05T10:09:54Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2502.02759/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Determining the family to which a malicious file belongs is an essential component of cyberattack investigation, attribution, and remediation. Performing this task manually is time consuming and requires expert knowledge. Automated tools using that label malware using antivirus detections lack accuracy and/or scalability, making them insufficient for real-world applications. Three pervasive shortcomings in these tools are responsible: (1) incorrect parsing of antivirus detections, (2) errors during family alias resolution, and (3) an inappropriate antivirus aggregation strategy. To address eac","authors_text":"Derek Everett, Edward Raff, James Holt, Maya Fuchs, Robert J. Joyce","cross_cats":[],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2025-02-04T22:55:39Z","title":"ClarAVy: A Tool for Scalable and Accurate Malware Family Labeling"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2502.02759","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:9ed9a639db7c7d8bd3afa7c9a1010b9cdd769c66f5c293d8af84859c83c39a3a","target":"record","created_at":"2026-07-05T10:09:54Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"35bf99bad4b55734c61c334168532365aac874b3d302c4726898e775159a9979","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2025-02-04T22:55:39Z","title_canon_sha256":"0bc6761683f3db863b22825aa5b0f2836713ee2c95c033831f6057dbe655ad70"},"schema_version":"1.0","source":{"id":"2502.02759","kind":"arxiv","version":1}},"canonical_sha256":"4f4fcd2f15ffa7f3c80d98b4cb69b33ac678f981de524d5422e187353400cf51","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"4f4fcd2f15ffa7f3c80d98b4cb69b33ac678f981de524d5422e187353400cf51","first_computed_at":"2026-07-05T10:09:54.816393Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T10:09:54.816393Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"IKIGfbkC0cr9P4TPLgIqrYmViULACwNZchvfWibLi5ZXPXHH5zaHIN9w7chwuTIyfMsD2FozMfAhktYt6znPDA==","signature_status":"signed_v1","signed_at":"2026-07-05T10:09:54.816763Z","signed_message":"canonical_sha256_bytes"},"source_id":"2502.02759","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:9ed9a639db7c7d8bd3afa7c9a1010b9cdd769c66f5c293d8af84859c83c39a3a","sha256:a42fb06b42f08b4ceb8f21e1564e1e0faa5a8c29ec1dead60134e8d67495fd86"],"state_sha256":"9f4b53a4862573bbfcdbbc3be2bae418f7f4c1f840c557d40bb8986c5bc83029"}