{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2024:PIXTDR6SFJU23X4PZN3Z5H665W","short_pith_number":"pith:PIXTDR6S","canonical_record":{"source":{"id":"2407.13355","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2024-07-18T09:54:33Z","cross_cats_sorted":[],"title_canon_sha256":"a0e7c8a081311d69fdf4bd5da4b58fc14909b8fb08419c81ed622490dc677a87","abstract_canon_sha256":"3dfff91754bc455a45fa5af82aa9985ccc07c71509b5a1db4aadac00247a43ce"},"schema_version":"1.0"},"canonical_sha256":"7a2f31c7d22a69addf8fcb779e9fdeedaf8717ff6edb1929c668779ad911d90e","source":{"kind":"arxiv","id":"2407.13355","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2407.13355","created_at":"2026-07-05T08:45:37Z"},{"alias_kind":"arxiv_version","alias_value":"2407.13355v1","created_at":"2026-07-05T08:45:37Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2407.13355","created_at":"2026-07-05T08:45:37Z"},{"alias_kind":"pith_short_12","alias_value":"PIXTDR6SFJU2","created_at":"2026-07-05T08:45:37Z"},{"alias_kind":"pith_short_16","alias_value":"PIXTDR6SFJU23X4P","created_at":"2026-07-05T08:45:37Z"},{"alias_kind":"pith_short_8","alias_value":"PIXTDR6S","created_at":"2026-07-05T08:45:37Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2024:PIXTDR6SFJU23X4PZN3Z5H665W","target":"record","payload":{"canonical_record":{"source":{"id":"2407.13355","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2024-07-18T09:54:33Z","cross_cats_sorted":[],"title_canon_sha256":"a0e7c8a081311d69fdf4bd5da4b58fc14909b8fb08419c81ed622490dc677a87","abstract_canon_sha256":"3dfff91754bc455a45fa5af82aa9985ccc07c71509b5a1db4aadac00247a43ce"},"schema_version":"1.0"},"canonical_sha256":"7a2f31c7d22a69addf8fcb779e9fdeedaf8717ff6edb1929c668779ad911d90e","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T08:45:37.918971Z","signature_b64":"gid/wXuT2BtTv/QAtbXzAoG3PbQFkdoQo3FwNc+l3HI5pXJAd9ljO279PjQddFYtVuoJkGZH2nvRzCcgFD8FDQ==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"7a2f31c7d22a69addf8fcb779e9fdeedaf8717ff6edb1929c668779ad911d90e","last_reissued_at":"2026-07-05T08:45:37.918500Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T08:45:37.918500Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2407.13355","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T08:45:37Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"FncjD4eULJtGDksM2p25F2DRO8RV/eGngsR5XlmzfDGDoAsSoHr9VrDY6mejUzmHfLSj374s+lxpXYzmhBHzAw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-24T00:20:13.660351Z"},"content_sha256":"18ad41d6b7ee8296e9afe7744d7db99086473a14ee5b354fd479748354f0ab42","schema_version":"1.0","event_id":"sha256:18ad41d6b7ee8296e9afe7744d7db99086473a14ee5b354fd479748354f0ab42"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2024:PIXTDR6SFJU23X4PZN3Z5H665W","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"EarlyMalDetect: A Novel Approach for Early Windows Malware Detection Based on Sequences of API Calls","license":"http://creativecommons.org/licenses/by/4.0/","headline":"","cross_cats":[],"primary_cat":"cs.CR","authors_text":"Abdun Naser Mahmood, Mohammad Jabed Morshed Chowdhury, Pascal Maniriho","submitted_at":"2024-07-18T09:54:33Z","abstract_excerpt":"In this work, we propose EarlyMalDetect, a novel approach for early Windows malware detection based on sequences of API calls. Our approach leverages generative transformer models and attention-guided deep recurrent neural networks to accurately identify and detect patterns of malicious behaviors in the early stage of malware execution. By analyzing the sequences of API calls invoked during execution, the proposed approach can classify executable files (programs) as malware or benign by predicting their behaviors based on a few shots (initial API calls) invoked during execution. EarlyMalDetect"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2407.13355","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2407.13355/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T08:45:37Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"a3aAWEeQ3LMadG1PeGmcGM1ntHifoGCda4EqLqlRFs3toJKda6qdz1wiQbvxH1BX87ZojiG4l8qgnHP7JiBQBg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-24T00:20:13.660691Z"},"content_sha256":"c007223a8276f61e3ec4802d636ac534c70e00685274478b97445127c60f48fc","schema_version":"1.0","event_id":"sha256:c007223a8276f61e3ec4802d636ac534c70e00685274478b97445127c60f48fc"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/PIXTDR6SFJU23X4PZN3Z5H665W/bundle.json","state_url":"https://pith.science/pith/PIXTDR6SFJU23X4PZN3Z5H665W/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/PIXTDR6SFJU23X4PZN3Z5H665W/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-24T00:20:13Z","links":{"resolver":"https://pith.science/pith/PIXTDR6SFJU23X4PZN3Z5H665W","bundle":"https://pith.science/pith/PIXTDR6SFJU23X4PZN3Z5H665W/bundle.json","state":"https://pith.science/pith/PIXTDR6SFJU23X4PZN3Z5H665W/state.json","well_known_bundle":"https://pith.science/.well-known/pith/PIXTDR6SFJU23X4PZN3Z5H665W/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2024:PIXTDR6SFJU23X4PZN3Z5H665W","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"3dfff91754bc455a45fa5af82aa9985ccc07c71509b5a1db4aadac00247a43ce","cross_cats_sorted":[],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2024-07-18T09:54:33Z","title_canon_sha256":"a0e7c8a081311d69fdf4bd5da4b58fc14909b8fb08419c81ed622490dc677a87"},"schema_version":"1.0","source":{"id":"2407.13355","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2407.13355","created_at":"2026-07-05T08:45:37Z"},{"alias_kind":"arxiv_version","alias_value":"2407.13355v1","created_at":"2026-07-05T08:45:37Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2407.13355","created_at":"2026-07-05T08:45:37Z"},{"alias_kind":"pith_short_12","alias_value":"PIXTDR6SFJU2","created_at":"2026-07-05T08:45:37Z"},{"alias_kind":"pith_short_16","alias_value":"PIXTDR6SFJU23X4P","created_at":"2026-07-05T08:45:37Z"},{"alias_kind":"pith_short_8","alias_value":"PIXTDR6S","created_at":"2026-07-05T08:45:37Z"}],"graph_snapshots":[{"event_id":"sha256:c007223a8276f61e3ec4802d636ac534c70e00685274478b97445127c60f48fc","target":"graph","created_at":"2026-07-05T08:45:37Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2407.13355/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"In this work, we propose EarlyMalDetect, a novel approach for early Windows malware detection based on sequences of API calls. Our approach leverages generative transformer models and attention-guided deep recurrent neural networks to accurately identify and detect patterns of malicious behaviors in the early stage of malware execution. By analyzing the sequences of API calls invoked during execution, the proposed approach can classify executable files (programs) as malware or benign by predicting their behaviors based on a few shots (initial API calls) invoked during execution. EarlyMalDetect","authors_text":"Abdun Naser Mahmood, Mohammad Jabed Morshed Chowdhury, Pascal Maniriho","cross_cats":[],"headline":"","license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2024-07-18T09:54:33Z","title":"EarlyMalDetect: A Novel Approach for Early Windows Malware Detection Based on Sequences of API Calls"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2407.13355","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:18ad41d6b7ee8296e9afe7744d7db99086473a14ee5b354fd479748354f0ab42","target":"record","created_at":"2026-07-05T08:45:37Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"3dfff91754bc455a45fa5af82aa9985ccc07c71509b5a1db4aadac00247a43ce","cross_cats_sorted":[],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2024-07-18T09:54:33Z","title_canon_sha256":"a0e7c8a081311d69fdf4bd5da4b58fc14909b8fb08419c81ed622490dc677a87"},"schema_version":"1.0","source":{"id":"2407.13355","kind":"arxiv","version":1}},"canonical_sha256":"7a2f31c7d22a69addf8fcb779e9fdeedaf8717ff6edb1929c668779ad911d90e","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"7a2f31c7d22a69addf8fcb779e9fdeedaf8717ff6edb1929c668779ad911d90e","first_computed_at":"2026-07-05T08:45:37.918500Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T08:45:37.918500Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"gid/wXuT2BtTv/QAtbXzAoG3PbQFkdoQo3FwNc+l3HI5pXJAd9ljO279PjQddFYtVuoJkGZH2nvRzCcgFD8FDQ==","signature_status":"signed_v1","signed_at":"2026-07-05T08:45:37.918971Z","signed_message":"canonical_sha256_bytes"},"source_id":"2407.13355","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:18ad41d6b7ee8296e9afe7744d7db99086473a14ee5b354fd479748354f0ab42","sha256:c007223a8276f61e3ec4802d636ac534c70e00685274478b97445127c60f48fc"],"state_sha256":"7b1f24a8e9278feeab83340e01de11d18de396e7853176384c3cea188817c903"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"bf0mcN24v9fdRcouL6KZdJOQks+yqv09VtcZKkOOp9TPnHR1ik7ZbhdOpFixj77jDfWUD52ZCF9gDteSdPzoCA==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-24T00:20:13.663991Z","bundle_sha256":"b9ac7b6984213874db93d93d2140be816230f278f189a48897e137b19d44c465"}}