{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2017:JWD7MYEW2JGC2DSK7THAJ65D6Q","short_pith_number":"pith:JWD7MYEW","canonical_record":{"source":{"id":"1708.01864","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2017-08-06T09:01:32Z","cross_cats_sorted":[],"title_canon_sha256":"37a24327fb052bf3eba9c187b4fc40475ce43a9f0c12b007418c4babd68679ad","abstract_canon_sha256":"d64eefe0767f5c5c20672945d9e4cd0342e260769c2c3c8c582f826b0917b4c0"},"schema_version":"1.0"},"canonical_sha256":"4d87f66096d24c2d0e4afcce04fba3f409febbc20be318e58e752231377898cf","source":{"kind":"arxiv","id":"1708.01864","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"1708.01864","created_at":"2026-05-18T00:38:32Z"},{"alias_kind":"arxiv_version","alias_value":"1708.01864v1","created_at":"2026-05-18T00:38:32Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.1708.01864","created_at":"2026-05-18T00:38:32Z"},{"alias_kind":"pith_short_12","alias_value":"JWD7MYEW2JGC","created_at":"2026-05-18T12:31:24Z"},{"alias_kind":"pith_short_16","alias_value":"JWD7MYEW2JGC2DSK","created_at":"2026-05-18T12:31:24Z"},{"alias_kind":"pith_short_8","alias_value":"JWD7MYEW","created_at":"2026-05-18T12:31:24Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2017:JWD7MYEW2JGC2DSK7THAJ65D6Q","target":"record","payload":{"canonical_record":{"source":{"id":"1708.01864","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2017-08-06T09:01:32Z","cross_cats_sorted":[],"title_canon_sha256":"37a24327fb052bf3eba9c187b4fc40475ce43a9f0c12b007418c4babd68679ad","abstract_canon_sha256":"d64eefe0767f5c5c20672945d9e4cd0342e260769c2c3c8c582f826b0917b4c0"},"schema_version":"1.0"},"canonical_sha256":"4d87f66096d24c2d0e4afcce04fba3f409febbc20be318e58e752231377898cf","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-05-18T00:38:32.916439Z","signature_b64":"zaDAsRwEOSNHjfDlupFkqYXJ7gmmhueX/m9ueB0WIp1hRS7GM3KB1bMRtRPwvyY1EcDAPGnd+/b4q+Th5vk+AA==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"4d87f66096d24c2d0e4afcce04fba3f409febbc20be318e58e752231377898cf","last_reissued_at":"2026-05-18T00:38:32.915906Z","signature_status":"signed_v1","first_computed_at":"2026-05-18T00:38:32.915906Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"1708.01864","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-05-18T00:38:32Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"/4IwuFvutKLydr1LB/a6UotRzHw2AW3aplcYAEIW0lhf3+XlkBewf6e1g1rPf4nn6jsa5r7SHhh0VSNM9sz1Dg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-05-25T06:39:26.783598Z"},"content_sha256":"536b64c5557e4d92ed7821f73566b5f9ef7f3e2044d318214f175433c36c754d","schema_version":"1.0","event_id":"sha256:536b64c5557e4d92ed7821f73566b5f9ef7f3e2044d318214f175433c36c754d"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2017:JWD7MYEW2JGC2DSK7THAJ65D6Q","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Exploiting Latent Attack Semantics for Intelligent Malware Detection","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":[],"primary_cat":"cs.CR","authors_text":"Constantine Caramanis, Mkhail Kazdagli, Mohit Tiwari, Sanjay Shakkottai","submitted_at":"2017-08-06T09:01:32Z","abstract_excerpt":"Behavioral malware detectors promise to expose previously unknown malware and are an important security primitive. However, even the best behavioral detectors suffer from high false positives and negatives. In this paper, we address the challenge of aggregating weak per-device behavioral detectors in noisy communities (i.e., ones that produce alerts at unpredictable rates) into an accurate and robust global anomaly detector (GD).\n  Our system - Shape GD - combines two insights: Structural: actions such as visiting a website (waterhole attack) or membership in a shared email thread (phishing at"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"1708.01864","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-05-18T00:38:32Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"G7KN40ns+Sx9T2pNo4+Pte7LBYb2TTnSrNnRFEQsH3TNzH3qx7v9khu/tpqXMPqgosHOoO9tLn/yOiU7v/p4Bg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-05-25T06:39:26.784250Z"},"content_sha256":"ccfe0eee4914cb3157280f729fd3627e5c6ed11ca7cb9b8a43353f799b088794","schema_version":"1.0","event_id":"sha256:ccfe0eee4914cb3157280f729fd3627e5c6ed11ca7cb9b8a43353f799b088794"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/JWD7MYEW2JGC2DSK7THAJ65D6Q/bundle.json","state_url":"https://pith.science/pith/JWD7MYEW2JGC2DSK7THAJ65D6Q/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/JWD7MYEW2JGC2DSK7THAJ65D6Q/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-05-25T06:39:26Z","links":{"resolver":"https://pith.science/pith/JWD7MYEW2JGC2DSK7THAJ65D6Q","bundle":"https://pith.science/pith/JWD7MYEW2JGC2DSK7THAJ65D6Q/bundle.json","state":"https://pith.science/pith/JWD7MYEW2JGC2DSK7THAJ65D6Q/state.json","well_known_bundle":"https://pith.science/.well-known/pith/JWD7MYEW2JGC2DSK7THAJ65D6Q/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2017:JWD7MYEW2JGC2DSK7THAJ65D6Q","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"d64eefe0767f5c5c20672945d9e4cd0342e260769c2c3c8c582f826b0917b4c0","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2017-08-06T09:01:32Z","title_canon_sha256":"37a24327fb052bf3eba9c187b4fc40475ce43a9f0c12b007418c4babd68679ad"},"schema_version":"1.0","source":{"id":"1708.01864","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"1708.01864","created_at":"2026-05-18T00:38:32Z"},{"alias_kind":"arxiv_version","alias_value":"1708.01864v1","created_at":"2026-05-18T00:38:32Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.1708.01864","created_at":"2026-05-18T00:38:32Z"},{"alias_kind":"pith_short_12","alias_value":"JWD7MYEW2JGC","created_at":"2026-05-18T12:31:24Z"},{"alias_kind":"pith_short_16","alias_value":"JWD7MYEW2JGC2DSK","created_at":"2026-05-18T12:31:24Z"},{"alias_kind":"pith_short_8","alias_value":"JWD7MYEW","created_at":"2026-05-18T12:31:24Z"}],"graph_snapshots":[{"event_id":"sha256:ccfe0eee4914cb3157280f729fd3627e5c6ed11ca7cb9b8a43353f799b088794","target":"graph","created_at":"2026-05-18T00:38:32Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"paper":{"abstract_excerpt":"Behavioral malware detectors promise to expose previously unknown malware and are an important security primitive. However, even the best behavioral detectors suffer from high false positives and negatives. In this paper, we address the challenge of aggregating weak per-device behavioral detectors in noisy communities (i.e., ones that produce alerts at unpredictable rates) into an accurate and robust global anomaly detector (GD).\n  Our system - Shape GD - combines two insights: Structural: actions such as visiting a website (waterhole attack) or membership in a shared email thread (phishing at","authors_text":"Constantine Caramanis, Mkhail Kazdagli, Mohit Tiwari, Sanjay Shakkottai","cross_cats":[],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2017-08-06T09:01:32Z","title":"Exploiting Latent Attack Semantics for Intelligent Malware Detection"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"1708.01864","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:536b64c5557e4d92ed7821f73566b5f9ef7f3e2044d318214f175433c36c754d","target":"record","created_at":"2026-05-18T00:38:32Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"d64eefe0767f5c5c20672945d9e4cd0342e260769c2c3c8c582f826b0917b4c0","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2017-08-06T09:01:32Z","title_canon_sha256":"37a24327fb052bf3eba9c187b4fc40475ce43a9f0c12b007418c4babd68679ad"},"schema_version":"1.0","source":{"id":"1708.01864","kind":"arxiv","version":1}},"canonical_sha256":"4d87f66096d24c2d0e4afcce04fba3f409febbc20be318e58e752231377898cf","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"4d87f66096d24c2d0e4afcce04fba3f409febbc20be318e58e752231377898cf","first_computed_at":"2026-05-18T00:38:32.915906Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-05-18T00:38:32.915906Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"zaDAsRwEOSNHjfDlupFkqYXJ7gmmhueX/m9ueB0WIp1hRS7GM3KB1bMRtRPwvyY1EcDAPGnd+/b4q+Th5vk+AA==","signature_status":"signed_v1","signed_at":"2026-05-18T00:38:32.916439Z","signed_message":"canonical_sha256_bytes"},"source_id":"1708.01864","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:536b64c5557e4d92ed7821f73566b5f9ef7f3e2044d318214f175433c36c754d","sha256:ccfe0eee4914cb3157280f729fd3627e5c6ed11ca7cb9b8a43353f799b088794"],"state_sha256":"b925320edf29798bca51fddb4467b9412ab1ecfb176a789393e8c91040fdd14c"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"8+aY/KLw37M7JxDyTlmw5ed/Uzam85AyIf/S3gb0/BvWHWrA8ym0lMfTuhgiECrrAgEgwkXPQubwFrUj2LaADA==","signed_message":"bundle_sha256_bytes","signed_at":"2026-05-25T06:39:26.787723Z","bundle_sha256":"6238a5a7e24e90d4e0209737e705e13f1e2a1c7b387a9abff827fd4c8adafae4"}}