{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2025:JZ3Y7GBYGOSTL4PIUGSF2RAPOQ","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"52fd1feb31f8d1410cd2a1125edbd64ae0a6ae84698114527d0b94f2e33a7410","cross_cats_sorted":["cs.LG","cs.NI"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2025-02-07T22:38:39Z","title_canon_sha256":"e5d06d5022e02eaef4946995eb62211bb13deb6223a59e396477999e265c700a"},"schema_version":"1.0","source":{"id":"2502.05367","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2502.05367","created_at":"2026-07-05T10:11:37Z"},{"alias_kind":"arxiv_version","alias_value":"2502.05367v1","created_at":"2026-07-05T10:11:37Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2502.05367","created_at":"2026-07-05T10:11:37Z"},{"alias_kind":"pith_short_12","alias_value":"JZ3Y7GBYGOST","created_at":"2026-07-05T10:11:37Z"},{"alias_kind":"pith_short_16","alias_value":"JZ3Y7GBYGOSTL4PI","created_at":"2026-07-05T10:11:37Z"},{"alias_kind":"pith_short_8","alias_value":"JZ3Y7GBY","created_at":"2026-07-05T10:11:37Z"}],"graph_snapshots":[{"event_id":"sha256:b7f1b806d38955e4bc46c97aa0538668e0572c97b93036718d39d74837b43451","target":"graph","created_at":"2026-07-05T10:11:37Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2502.05367/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Advanced Persistent Threats (APTs) are among the most sophisticated threats facing critical organizations worldwide. APTs employ specific tactics, techniques, and procedures (TTPs) which make them difficult to detect in comparison to frequent and aggressive attacks. In fact, current network intrusion detection systems struggle to detect APTs communications, allowing such threats to persist unnoticed on victims' machines for months or even years. In this paper, we present EarlyCrow, an approach to detect APT malware command and control over HTTP(S) using contextual summaries.\n  The design of Ea","authors_text":"Almuthanna Alageel, Imperial College London, Sergio Maffeis","cross_cats":["cs.LG","cs.NI"],"headline":"","license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2025-02-07T22:38:39Z","title":"Detecting APT Malware Command and Control over HTTP(S) Using Contextual Summaries"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2502.05367","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:2a58d6246de1e8e0c9524252f14a352160c5e3dda3c02dfaf22ef19e405394db","target":"record","created_at":"2026-07-05T10:11:37Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"52fd1feb31f8d1410cd2a1125edbd64ae0a6ae84698114527d0b94f2e33a7410","cross_cats_sorted":["cs.LG","cs.NI"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2025-02-07T22:38:39Z","title_canon_sha256":"e5d06d5022e02eaef4946995eb62211bb13deb6223a59e396477999e265c700a"},"schema_version":"1.0","source":{"id":"2502.05367","kind":"arxiv","version":1}},"canonical_sha256":"4e778f983833a535f1e8a1a45d440f7413712370f7163006a394e325b59d3a1f","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"4e778f983833a535f1e8a1a45d440f7413712370f7163006a394e325b59d3a1f","first_computed_at":"2026-07-05T10:11:37.063470Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T10:11:37.063470Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"TOJrT8SlRhwrDvGr6REqq46IvYo5AWrBlmFqAUutG23LXb7dSoFehsuKtH6lMwesvw/yCwkY2de2oRpxFAWlDw==","signature_status":"signed_v1","signed_at":"2026-07-05T10:11:37.064035Z","signed_message":"canonical_sha256_bytes"},"source_id":"2502.05367","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:2a58d6246de1e8e0c9524252f14a352160c5e3dda3c02dfaf22ef19e405394db","sha256:b7f1b806d38955e4bc46c97aa0538668e0572c97b93036718d39d74837b43451"],"state_sha256":"99ed303eadae5c7350b7837035f9034cf1e33d934eb80c1c29874e33b303f16c"}