{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2017:JOKG76QYTEOQMEGMPQJUH67IFN","short_pith_number":"pith:JOKG76QY","canonical_record":{"source":{"id":"1705.02268","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2017-05-05T15:35:44Z","cross_cats_sorted":[],"title_canon_sha256":"9d7ba05d899788be42efd23a4684e94c0092c7730165dccab9bab382c9c43e88","abstract_canon_sha256":"92471f53ef44823aedaf6a517bb93b39d1e19ae82544a65ab261c421fc82dc84"},"schema_version":"1.0"},"canonical_sha256":"4b946ffa18991d0610cc7c1343fbe82b408571d3747f2002e5e7cf2a87fff756","source":{"kind":"arxiv","id":"1705.02268","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"1705.02268","created_at":"2026-05-18T00:45:00Z"},{"alias_kind":"arxiv_version","alias_value":"1705.02268v1","created_at":"2026-05-18T00:45:00Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.1705.02268","created_at":"2026-05-18T00:45:00Z"},{"alias_kind":"pith_short_12","alias_value":"JOKG76QYTEOQ","created_at":"2026-05-18T12:31:24Z"},{"alias_kind":"pith_short_16","alias_value":"JOKG76QYTEOQMEGM","created_at":"2026-05-18T12:31:24Z"},{"alias_kind":"pith_short_8","alias_value":"JOKG76QY","created_at":"2026-05-18T12:31:24Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2017:JOKG76QYTEOQMEGMPQJUH67IFN","target":"record","payload":{"canonical_record":{"source":{"id":"1705.02268","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2017-05-05T15:35:44Z","cross_cats_sorted":[],"title_canon_sha256":"9d7ba05d899788be42efd23a4684e94c0092c7730165dccab9bab382c9c43e88","abstract_canon_sha256":"92471f53ef44823aedaf6a517bb93b39d1e19ae82544a65ab261c421fc82dc84"},"schema_version":"1.0"},"canonical_sha256":"4b946ffa18991d0610cc7c1343fbe82b408571d3747f2002e5e7cf2a87fff756","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-05-18T00:45:00.293566Z","signature_b64":"pS8idJLO+a873P6SSjlL9ZJL3wQqf1b5a2wSv6hmi9zT+rXyvT3QbXO/rzotDu9E1sK2RF8HQTvWd2mIDnBaAw==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"4b946ffa18991d0610cc7c1343fbe82b408571d3747f2002e5e7cf2a87fff756","last_reissued_at":"2026-05-18T00:45:00.292995Z","signature_status":"signed_v1","first_computed_at":"2026-05-18T00:45:00.292995Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"1705.02268","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-05-18T00:45:00Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"zeC8GganeDILeRS9HE6Vc04YiDp1c/BOEocb1GaRI0bKbAFKHkMaO+e27jjZBUY/G3C5LTZGsCjMqeoAnilvAQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-06-28T14:01:58.981405Z"},"content_sha256":"918e0c7d73fd8a47389f04259953df9fac8b1827bc8abb21977c5bbb7c592cc0","schema_version":"1.0","event_id":"sha256:918e0c7d73fd8a47389f04259953df9fac8b1827bc8abb21977c5bbb7c592cc0"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2017:JOKG76QYTEOQMEGMPQJUH67IFN","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Multiple Instance Learning for Malware Classification","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":[],"primary_cat":"cs.CR","authors_text":"Jan Stiborek, Martin Reh\\'ak, Tom\\'a\\v{s} Pevn\\'y","submitted_at":"2017-05-05T15:35:44Z","abstract_excerpt":"This work addresses classification of unknown binaries executed in sandbox by modeling their interaction with system resources (files, mutexes, registry keys and communication with servers over the network) and error messages provided by the operating system, using vocabulary-based method from the multiple instance learning paradigm. It introduces similarities suitable for individual resource types that combined with an approximative clustering method efficiently group the system resources and define features directly from data. This approach effectively removes randomization often employed by"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"1705.02268","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-05-18T00:45:00Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"an83OwXQ8K3PBidw/G7NqgpvLIVTyK7jBxTwKMU0nombbE08WPnWw2mMnOwpzihzda/uReAr4UtHF+uhqCyEAQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-06-28T14:01:58.981743Z"},"content_sha256":"9a58be836c4070b6fc97c596695224c2c47041218b0da84d42d7b9ff0d85d9b6","schema_version":"1.0","event_id":"sha256:9a58be836c4070b6fc97c596695224c2c47041218b0da84d42d7b9ff0d85d9b6"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/JOKG76QYTEOQMEGMPQJUH67IFN/bundle.json","state_url":"https://pith.science/pith/JOKG76QYTEOQMEGMPQJUH67IFN/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/JOKG76QYTEOQMEGMPQJUH67IFN/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-06-28T14:01:58Z","links":{"resolver":"https://pith.science/pith/JOKG76QYTEOQMEGMPQJUH67IFN","bundle":"https://pith.science/pith/JOKG76QYTEOQMEGMPQJUH67IFN/bundle.json","state":"https://pith.science/pith/JOKG76QYTEOQMEGMPQJUH67IFN/state.json","well_known_bundle":"https://pith.science/.well-known/pith/JOKG76QYTEOQMEGMPQJUH67IFN/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2017:JOKG76QYTEOQMEGMPQJUH67IFN","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"92471f53ef44823aedaf6a517bb93b39d1e19ae82544a65ab261c421fc82dc84","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2017-05-05T15:35:44Z","title_canon_sha256":"9d7ba05d899788be42efd23a4684e94c0092c7730165dccab9bab382c9c43e88"},"schema_version":"1.0","source":{"id":"1705.02268","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"1705.02268","created_at":"2026-05-18T00:45:00Z"},{"alias_kind":"arxiv_version","alias_value":"1705.02268v1","created_at":"2026-05-18T00:45:00Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.1705.02268","created_at":"2026-05-18T00:45:00Z"},{"alias_kind":"pith_short_12","alias_value":"JOKG76QYTEOQ","created_at":"2026-05-18T12:31:24Z"},{"alias_kind":"pith_short_16","alias_value":"JOKG76QYTEOQMEGM","created_at":"2026-05-18T12:31:24Z"},{"alias_kind":"pith_short_8","alias_value":"JOKG76QY","created_at":"2026-05-18T12:31:24Z"}],"graph_snapshots":[{"event_id":"sha256:9a58be836c4070b6fc97c596695224c2c47041218b0da84d42d7b9ff0d85d9b6","target":"graph","created_at":"2026-05-18T00:45:00Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"paper":{"abstract_excerpt":"This work addresses classification of unknown binaries executed in sandbox by modeling their interaction with system resources (files, mutexes, registry keys and communication with servers over the network) and error messages provided by the operating system, using vocabulary-based method from the multiple instance learning paradigm. It introduces similarities suitable for individual resource types that combined with an approximative clustering method efficiently group the system resources and define features directly from data. This approach effectively removes randomization often employed by","authors_text":"Jan Stiborek, Martin Reh\\'ak, Tom\\'a\\v{s} Pevn\\'y","cross_cats":[],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2017-05-05T15:35:44Z","title":"Multiple Instance Learning for Malware Classification"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"1705.02268","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:918e0c7d73fd8a47389f04259953df9fac8b1827bc8abb21977c5bbb7c592cc0","target":"record","created_at":"2026-05-18T00:45:00Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"92471f53ef44823aedaf6a517bb93b39d1e19ae82544a65ab261c421fc82dc84","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2017-05-05T15:35:44Z","title_canon_sha256":"9d7ba05d899788be42efd23a4684e94c0092c7730165dccab9bab382c9c43e88"},"schema_version":"1.0","source":{"id":"1705.02268","kind":"arxiv","version":1}},"canonical_sha256":"4b946ffa18991d0610cc7c1343fbe82b408571d3747f2002e5e7cf2a87fff756","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"4b946ffa18991d0610cc7c1343fbe82b408571d3747f2002e5e7cf2a87fff756","first_computed_at":"2026-05-18T00:45:00.292995Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-05-18T00:45:00.292995Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"pS8idJLO+a873P6SSjlL9ZJL3wQqf1b5a2wSv6hmi9zT+rXyvT3QbXO/rzotDu9E1sK2RF8HQTvWd2mIDnBaAw==","signature_status":"signed_v1","signed_at":"2026-05-18T00:45:00.293566Z","signed_message":"canonical_sha256_bytes"},"source_id":"1705.02268","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:918e0c7d73fd8a47389f04259953df9fac8b1827bc8abb21977c5bbb7c592cc0","sha256:9a58be836c4070b6fc97c596695224c2c47041218b0da84d42d7b9ff0d85d9b6"],"state_sha256":"3510009d3e0bc654442845f61d6ae88d2b18776f0fffdf7926cd4d1bff093bec"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"ZQOVMz4zLJebLGRMzIm9g9N95jzOIqqVWFRQXZe4LVtAdudQ3GXTGMwDnkjDMp+Kb0gi0toIv7gyg6tj27KiCg==","signed_message":"bundle_sha256_bytes","signed_at":"2026-06-28T14:01:58.983653Z","bundle_sha256":"efdcdf8abc1e255a74ee49dc77c1856f020af65a67e053470f64f3f465bcce0a"}}