{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2021:LDVW6IB52XEXJU3BUX43K6KHQ3","short_pith_number":"pith:LDVW6IB5","canonical_record":{"source":{"id":"2112.13798","kind":"arxiv","version":2},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2021-12-27T17:27:39Z","cross_cats_sorted":[],"title_canon_sha256":"1e26e54e2ba2be7e4e6ce57601b9a0127b8111ff23f6838a55316497802f6711","abstract_canon_sha256":"3e4606ba3f6a27dca9072f9134e7b9d5a986a72130b094ba0535ab9f4e347435"},"schema_version":"1.0"},"canonical_sha256":"58eb6f203dd5c974d361a5f9b5794786cc6eba2f1ff16cd07308369bc847fdf0","source":{"kind":"arxiv","id":"2112.13798","version":2},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2112.13798","created_at":"2026-07-05T04:26:12Z"},{"alias_kind":"arxiv_version","alias_value":"2112.13798v2","created_at":"2026-07-05T04:26:12Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2112.13798","created_at":"2026-07-05T04:26:12Z"},{"alias_kind":"pith_short_12","alias_value":"LDVW6IB52XEX","created_at":"2026-07-05T04:26:12Z"},{"alias_kind":"pith_short_16","alias_value":"LDVW6IB52XEXJU3B","created_at":"2026-07-05T04:26:12Z"},{"alias_kind":"pith_short_8","alias_value":"LDVW6IB5","created_at":"2026-07-05T04:26:12Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2021:LDVW6IB52XEXJU3BUX43K6KHQ3","target":"record","payload":{"canonical_record":{"source":{"id":"2112.13798","kind":"arxiv","version":2},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2021-12-27T17:27:39Z","cross_cats_sorted":[],"title_canon_sha256":"1e26e54e2ba2be7e4e6ce57601b9a0127b8111ff23f6838a55316497802f6711","abstract_canon_sha256":"3e4606ba3f6a27dca9072f9134e7b9d5a986a72130b094ba0535ab9f4e347435"},"schema_version":"1.0"},"canonical_sha256":"58eb6f203dd5c974d361a5f9b5794786cc6eba2f1ff16cd07308369bc847fdf0","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T04:26:12.902781Z","signature_b64":"CEeLzdbuUf1RHmNBsXZFE4O8kXpctDozLLYU7+QLXU0pLdylSSHOfseygJBojTAhv1yunTQ/SphcvP1V1MAJAA==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"58eb6f203dd5c974d361a5f9b5794786cc6eba2f1ff16cd07308369bc847fdf0","last_reissued_at":"2026-07-05T04:26:12.902340Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T04:26:12.902340Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2112.13798","source_version":2,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T04:26:12Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"pxgWpoAQprpTXhvCgNO4Ul428DwyUYTBZDZm2IdjVjPmsyzpBqpcZ15N9FcIK3Pq2pyom0Dg2cZdfBMcVojBBA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-07-07T12:27:40.405667Z"},"content_sha256":"ce80b4b2d6c353b1b8b0d7a5f248a3bcde8723ed414aa08964b2c7cadce63d7c","schema_version":"1.0","event_id":"sha256:ce80b4b2d6c353b1b8b0d7a5f248a3bcde8723ed414aa08964b2c7cadce63d7c"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2021:LDVW6IB52XEXJU3BUX43K6KHQ3","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"PORTFILER: Port-Level Network Profiling for Self-Propagating Malware Detection","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":[],"primary_cat":"cs.CR","authors_text":"Alastair Nottingham, Alina Oprea, Benjamin Miller, Jack Davidson, Jason Hiser, Malathi Veeraraghavan, Oliver Spohngellert, Simona Boboila, Talha Ongun, Tina Eliassi-Rad","submitted_at":"2021-12-27T17:27:39Z","abstract_excerpt":"Recent self-propagating malware (SPM) campaigns compromised hundred of thousands of victim machines on the Internet. It is challenging to detect these attacks in their early stages, as adversaries utilize common network services, use novel techniques, and can evade existing detection mechanisms. We propose PORTFILER (PORT-Level Network Traffic ProFILER), a new machine learning system applied to network traffic for detecting SPM attacks. PORTFILER extracts port-level features from the Zeek connection logs collected at a border of a monitored network, applies anomaly detection techniques to iden"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2112.13798","kind":"arxiv","version":2},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2112.13798/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T04:26:12Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"Jr2t0uJuF+fFrC0X12l08fU94ZyJYlBmX4PI9YVO9OwQ+z6K28oZk8vQCgbSh7JktkxaFFGj7KenHouLzy0cDw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-07-07T12:27:40.406035Z"},"content_sha256":"0b54b59a883e03024db4aeb930084ed49851e9a1edb359e6b5943fb3713f5854","schema_version":"1.0","event_id":"sha256:0b54b59a883e03024db4aeb930084ed49851e9a1edb359e6b5943fb3713f5854"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/LDVW6IB52XEXJU3BUX43K6KHQ3/bundle.json","state_url":"https://pith.science/pith/LDVW6IB52XEXJU3BUX43K6KHQ3/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/LDVW6IB52XEXJU3BUX43K6KHQ3/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-07-07T12:27:40Z","links":{"resolver":"https://pith.science/pith/LDVW6IB52XEXJU3BUX43K6KHQ3","bundle":"https://pith.science/pith/LDVW6IB52XEXJU3BUX43K6KHQ3/bundle.json","state":"https://pith.science/pith/LDVW6IB52XEXJU3BUX43K6KHQ3/state.json","well_known_bundle":"https://pith.science/.well-known/pith/LDVW6IB52XEXJU3BUX43K6KHQ3/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2021:LDVW6IB52XEXJU3BUX43K6KHQ3","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"3e4606ba3f6a27dca9072f9134e7b9d5a986a72130b094ba0535ab9f4e347435","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2021-12-27T17:27:39Z","title_canon_sha256":"1e26e54e2ba2be7e4e6ce57601b9a0127b8111ff23f6838a55316497802f6711"},"schema_version":"1.0","source":{"id":"2112.13798","kind":"arxiv","version":2}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2112.13798","created_at":"2026-07-05T04:26:12Z"},{"alias_kind":"arxiv_version","alias_value":"2112.13798v2","created_at":"2026-07-05T04:26:12Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2112.13798","created_at":"2026-07-05T04:26:12Z"},{"alias_kind":"pith_short_12","alias_value":"LDVW6IB52XEX","created_at":"2026-07-05T04:26:12Z"},{"alias_kind":"pith_short_16","alias_value":"LDVW6IB52XEXJU3B","created_at":"2026-07-05T04:26:12Z"},{"alias_kind":"pith_short_8","alias_value":"LDVW6IB5","created_at":"2026-07-05T04:26:12Z"}],"graph_snapshots":[{"event_id":"sha256:0b54b59a883e03024db4aeb930084ed49851e9a1edb359e6b5943fb3713f5854","target":"graph","created_at":"2026-07-05T04:26:12Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2112.13798/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Recent self-propagating malware (SPM) campaigns compromised hundred of thousands of victim machines on the Internet. It is challenging to detect these attacks in their early stages, as adversaries utilize common network services, use novel techniques, and can evade existing detection mechanisms. We propose PORTFILER (PORT-Level Network Traffic ProFILER), a new machine learning system applied to network traffic for detecting SPM attacks. PORTFILER extracts port-level features from the Zeek connection logs collected at a border of a monitored network, applies anomaly detection techniques to iden","authors_text":"Alastair Nottingham, Alina Oprea, Benjamin Miller, Jack Davidson, Jason Hiser, Malathi Veeraraghavan, Oliver Spohngellert, Simona Boboila, Talha Ongun, Tina Eliassi-Rad","cross_cats":[],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2021-12-27T17:27:39Z","title":"PORTFILER: Port-Level Network Profiling for Self-Propagating Malware Detection"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2112.13798","kind":"arxiv","version":2},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:ce80b4b2d6c353b1b8b0d7a5f248a3bcde8723ed414aa08964b2c7cadce63d7c","target":"record","created_at":"2026-07-05T04:26:12Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"3e4606ba3f6a27dca9072f9134e7b9d5a986a72130b094ba0535ab9f4e347435","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2021-12-27T17:27:39Z","title_canon_sha256":"1e26e54e2ba2be7e4e6ce57601b9a0127b8111ff23f6838a55316497802f6711"},"schema_version":"1.0","source":{"id":"2112.13798","kind":"arxiv","version":2}},"canonical_sha256":"58eb6f203dd5c974d361a5f9b5794786cc6eba2f1ff16cd07308369bc847fdf0","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"58eb6f203dd5c974d361a5f9b5794786cc6eba2f1ff16cd07308369bc847fdf0","first_computed_at":"2026-07-05T04:26:12.902340Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T04:26:12.902340Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"CEeLzdbuUf1RHmNBsXZFE4O8kXpctDozLLYU7+QLXU0pLdylSSHOfseygJBojTAhv1yunTQ/SphcvP1V1MAJAA==","signature_status":"signed_v1","signed_at":"2026-07-05T04:26:12.902781Z","signed_message":"canonical_sha256_bytes"},"source_id":"2112.13798","source_kind":"arxiv","source_version":2}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:ce80b4b2d6c353b1b8b0d7a5f248a3bcde8723ed414aa08964b2c7cadce63d7c","sha256:0b54b59a883e03024db4aeb930084ed49851e9a1edb359e6b5943fb3713f5854"],"state_sha256":"28d00a29942850473aae17bea92e357cdcfbf27032ccc1badcf9b7f74deffab8"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"83+Tb1325LMQa82C1Ztu6emb0kMAHetzopVOodVHAlKBrU+/Sf/2iip4Xj6qgg/bjIkr9bvsLtEpiblfQMsyCg==","signed_message":"bundle_sha256_bytes","signed_at":"2026-07-07T12:27:40.407945Z","bundle_sha256":"14837fab6309b60289a21462978fba804df502b8cd2ed77994a73bddd9380a7b"}}