{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2023:LYAMMC3BNKNOR63GKRB5UVGSMO","short_pith_number":"pith:LYAMMC3B","canonical_record":{"source":{"id":"2301.13686","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2023-01-31T15:03:28Z","cross_cats_sorted":[],"title_canon_sha256":"cf35b454be2eeb770272c4c0f9e24cd84a9d004dafbec1600a867b8c234762a5","abstract_canon_sha256":"359cedacf6b7b9c60a85f4c6e60094f73c01dfadccbfb1081e5bb4716c399bdc"},"schema_version":"1.0"},"canonical_sha256":"5e00c60b616a9ae8fb665443da54d2639cb9ba6564c1151037eef18441a2026f","source":{"kind":"arxiv","id":"2301.13686","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2301.13686","created_at":"2026-07-05T05:37:17Z"},{"alias_kind":"arxiv_version","alias_value":"2301.13686v1","created_at":"2026-07-05T05:37:17Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2301.13686","created_at":"2026-07-05T05:37:17Z"},{"alias_kind":"pith_short_12","alias_value":"LYAMMC3BNKNO","created_at":"2026-07-05T05:37:17Z"},{"alias_kind":"pith_short_16","alias_value":"LYAMMC3BNKNOR63G","created_at":"2026-07-05T05:37:17Z"},{"alias_kind":"pith_short_8","alias_value":"LYAMMC3B","created_at":"2026-07-05T05:37:17Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2023:LYAMMC3BNKNOR63GKRB5UVGSMO","target":"record","payload":{"canonical_record":{"source":{"id":"2301.13686","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2023-01-31T15:03:28Z","cross_cats_sorted":[],"title_canon_sha256":"cf35b454be2eeb770272c4c0f9e24cd84a9d004dafbec1600a867b8c234762a5","abstract_canon_sha256":"359cedacf6b7b9c60a85f4c6e60094f73c01dfadccbfb1081e5bb4716c399bdc"},"schema_version":"1.0"},"canonical_sha256":"5e00c60b616a9ae8fb665443da54d2639cb9ba6564c1151037eef18441a2026f","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T05:37:17.541363Z","signature_b64":"SyTOqxCFLeZfUw9ZZWTchB3+9873s4JwNPReA145ZJ8Xq57VDGrd5O+43L/qWuCPjQZL/Zk8h/wvF1TBZ1SjCg==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"5e00c60b616a9ae8fb665443da54d2639cb9ba6564c1151037eef18441a2026f","last_reissued_at":"2026-07-05T05:37:17.540945Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T05:37:17.540945Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2301.13686","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T05:37:17Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"mw9sUNy1f4OXtNsuQT6WKb7p6So7VIYlFSYNOmyIxtK4HgUdIOo2D1NIOduzZldjTeG1N6DkDK/JdpkGYDCsAg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-18T09:34:41.436372Z"},"content_sha256":"2b00595174e0953f187341f9021631898cc1f8ffaef86ce3df6f78aed6545921","schema_version":"1.0","event_id":"sha256:2b00595174e0953f187341f9021631898cc1f8ffaef86ce3df6f78aed6545921"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2023:LYAMMC3BNKNOR63GKRB5UVGSMO","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Detecting Unknown Encrypted Malicious Traffic in Real Time via Flow Interaction Graph Analysis","license":"http://creativecommons.org/licenses/by/4.0/","headline":"","cross_cats":[],"primary_cat":"cs.CR","authors_text":"Chuanpu Fu, Ke Xu, Qi Li","submitted_at":"2023-01-31T15:03:28Z","abstract_excerpt":"In this paper, we propose HyperVision, a realtime unsupervised machine learning (ML) based malicious traffic detection system. Particularly, HyperVision is able to detect unknown patterns of encrypted malicious traffic by utilizing a compact inmemory graph built upon the traffic patterns. The graph captures flow interaction patterns represented by the graph structural features, instead of the features of specific known attacks. We develop an unsupervised graph learning method to detect abnormal interaction patterns by analyzing the connectivity, sparsity, and statistical features of the graph,"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2301.13686","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2301.13686/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T05:37:17Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"LDi+ZN544UYJ2KOODrLjFGnxeBkTlvB7CD8OhOfPY0Bh0BnCZDUmAWLAwAHIJXxK31WREpJpxGLRqAQrgKpGCA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-18T09:34:41.437173Z"},"content_sha256":"ba7bc549fff9d42c8a68092dc67ad09a1d634b5dac392c9a1e7fbf4adc4e0542","schema_version":"1.0","event_id":"sha256:ba7bc549fff9d42c8a68092dc67ad09a1d634b5dac392c9a1e7fbf4adc4e0542"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/LYAMMC3BNKNOR63GKRB5UVGSMO/bundle.json","state_url":"https://pith.science/pith/LYAMMC3BNKNOR63GKRB5UVGSMO/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/LYAMMC3BNKNOR63GKRB5UVGSMO/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-18T09:34:41Z","links":{"resolver":"https://pith.science/pith/LYAMMC3BNKNOR63GKRB5UVGSMO","bundle":"https://pith.science/pith/LYAMMC3BNKNOR63GKRB5UVGSMO/bundle.json","state":"https://pith.science/pith/LYAMMC3BNKNOR63GKRB5UVGSMO/state.json","well_known_bundle":"https://pith.science/.well-known/pith/LYAMMC3BNKNOR63GKRB5UVGSMO/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2023:LYAMMC3BNKNOR63GKRB5UVGSMO","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"359cedacf6b7b9c60a85f4c6e60094f73c01dfadccbfb1081e5bb4716c399bdc","cross_cats_sorted":[],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2023-01-31T15:03:28Z","title_canon_sha256":"cf35b454be2eeb770272c4c0f9e24cd84a9d004dafbec1600a867b8c234762a5"},"schema_version":"1.0","source":{"id":"2301.13686","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2301.13686","created_at":"2026-07-05T05:37:17Z"},{"alias_kind":"arxiv_version","alias_value":"2301.13686v1","created_at":"2026-07-05T05:37:17Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2301.13686","created_at":"2026-07-05T05:37:17Z"},{"alias_kind":"pith_short_12","alias_value":"LYAMMC3BNKNO","created_at":"2026-07-05T05:37:17Z"},{"alias_kind":"pith_short_16","alias_value":"LYAMMC3BNKNOR63G","created_at":"2026-07-05T05:37:17Z"},{"alias_kind":"pith_short_8","alias_value":"LYAMMC3B","created_at":"2026-07-05T05:37:17Z"}],"graph_snapshots":[{"event_id":"sha256:ba7bc549fff9d42c8a68092dc67ad09a1d634b5dac392c9a1e7fbf4adc4e0542","target":"graph","created_at":"2026-07-05T05:37:17Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2301.13686/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"In this paper, we propose HyperVision, a realtime unsupervised machine learning (ML) based malicious traffic detection system. Particularly, HyperVision is able to detect unknown patterns of encrypted malicious traffic by utilizing a compact inmemory graph built upon the traffic patterns. The graph captures flow interaction patterns represented by the graph structural features, instead of the features of specific known attacks. We develop an unsupervised graph learning method to detect abnormal interaction patterns by analyzing the connectivity, sparsity, and statistical features of the graph,","authors_text":"Chuanpu Fu, Ke Xu, Qi Li","cross_cats":[],"headline":"","license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2023-01-31T15:03:28Z","title":"Detecting Unknown Encrypted Malicious Traffic in Real Time via Flow Interaction Graph Analysis"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2301.13686","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:2b00595174e0953f187341f9021631898cc1f8ffaef86ce3df6f78aed6545921","target":"record","created_at":"2026-07-05T05:37:17Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"359cedacf6b7b9c60a85f4c6e60094f73c01dfadccbfb1081e5bb4716c399bdc","cross_cats_sorted":[],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2023-01-31T15:03:28Z","title_canon_sha256":"cf35b454be2eeb770272c4c0f9e24cd84a9d004dafbec1600a867b8c234762a5"},"schema_version":"1.0","source":{"id":"2301.13686","kind":"arxiv","version":1}},"canonical_sha256":"5e00c60b616a9ae8fb665443da54d2639cb9ba6564c1151037eef18441a2026f","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"5e00c60b616a9ae8fb665443da54d2639cb9ba6564c1151037eef18441a2026f","first_computed_at":"2026-07-05T05:37:17.540945Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T05:37:17.540945Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"SyTOqxCFLeZfUw9ZZWTchB3+9873s4JwNPReA145ZJ8Xq57VDGrd5O+43L/qWuCPjQZL/Zk8h/wvF1TBZ1SjCg==","signature_status":"signed_v1","signed_at":"2026-07-05T05:37:17.541363Z","signed_message":"canonical_sha256_bytes"},"source_id":"2301.13686","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:2b00595174e0953f187341f9021631898cc1f8ffaef86ce3df6f78aed6545921","sha256:ba7bc549fff9d42c8a68092dc67ad09a1d634b5dac392c9a1e7fbf4adc4e0542"],"state_sha256":"c5c65dc7295028e16da91c610f8790e5e5e1f1444fb11de9a1b8cfb5d14a8fb0"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"DryC3k6kmhXNYOJp3I8RJBAF+7sWRRirUhevxnsyLrF+Hc3M0ET2VNa9A3aVhDgltDxrD7GR4RABrDMoafp8Ag==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-18T09:34:41.443967Z","bundle_sha256":"f8627652e5628151f6a2c4c9bbd8d1aa12fa70bc8f0bb0a3c8b5a58f7e158a7e"}}