{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2024:PT3KLNGDCHWA7KB7QSK3YJ34WB","short_pith_number":"pith:PT3KLNGD","canonical_record":{"source":{"id":"2401.07154","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","primary_cat":"cs.CR","submitted_at":"2024-01-13T20:03:11Z","cross_cats_sorted":["cs.LG"],"title_canon_sha256":"5d3dea7fe9b310a3f19192848559b4a2eda8d65cff9f0e4760db1358e394ab00","abstract_canon_sha256":"443bd93c7cd0331885f992f7bd5ab54c49cfd62c251336530438c91c901aa6b7"},"schema_version":"1.0"},"canonical_sha256":"7cf6a5b4c311ec0fa83f8495bc277cb07ba66a845defcdeffd5f75c5f1748a68","source":{"kind":"arxiv","id":"2401.07154","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2401.07154","created_at":"2026-07-05T07:33:32Z"},{"alias_kind":"arxiv_version","alias_value":"2401.07154v1","created_at":"2026-07-05T07:33:32Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2401.07154","created_at":"2026-07-05T07:33:32Z"},{"alias_kind":"pith_short_12","alias_value":"PT3KLNGDCHWA","created_at":"2026-07-05T07:33:32Z"},{"alias_kind":"pith_short_16","alias_value":"PT3KLNGDCHWA7KB7","created_at":"2026-07-05T07:33:32Z"},{"alias_kind":"pith_short_8","alias_value":"PT3KLNGD","created_at":"2026-07-05T07:33:32Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2024:PT3KLNGDCHWA7KB7QSK3YJ34WB","target":"record","payload":{"canonical_record":{"source":{"id":"2401.07154","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","primary_cat":"cs.CR","submitted_at":"2024-01-13T20:03:11Z","cross_cats_sorted":["cs.LG"],"title_canon_sha256":"5d3dea7fe9b310a3f19192848559b4a2eda8d65cff9f0e4760db1358e394ab00","abstract_canon_sha256":"443bd93c7cd0331885f992f7bd5ab54c49cfd62c251336530438c91c901aa6b7"},"schema_version":"1.0"},"canonical_sha256":"7cf6a5b4c311ec0fa83f8495bc277cb07ba66a845defcdeffd5f75c5f1748a68","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T07:33:32.704308Z","signature_b64":"EBm5zUC5hQGjSPPNLpguGDU/1tGxNXoAxmtfTOaVwa3I5ZgvUbfADL620SCWHE+gK+Yc37RjBOkOqOFa0rc1BQ==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"7cf6a5b4c311ec0fa83f8495bc277cb07ba66a845defcdeffd5f75c5f1748a68","last_reissued_at":"2026-07-05T07:33:32.703915Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T07:33:32.703915Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2401.07154","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T07:33:32Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"Ol81u8MUGIdhd18iXawzRCDCtCbefG3GrcvS73QAvGE0J2kP7QgfK50/w/wr+LqU2cvt8KQZap5BGSjh7WeOAA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-03T19:56:41.824768Z"},"content_sha256":"855191e8d45befb49d62a6204d2219bcb6630e226ee0e37b17f0b49097b2747e","schema_version":"1.0","event_id":"sha256:855191e8d45befb49d62a6204d2219bcb6630e226ee0e37b17f0b49097b2747e"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2024:PT3KLNGDCHWA7KB7QSK3YJ34WB","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Discovering Command and Control Channels Using Reinforcement Learning","license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","headline":"","cross_cats":["cs.LG"],"primary_cat":"cs.CR","authors_text":"Abdul Rahman, Ajinsyam S, Akshay Kakkar, Cheng Wang, Christopher Redino, Daniel Radke, Edward Bowen, Lanxiao Huang, Ryan Clark, Tyler Cody","submitted_at":"2024-01-13T20:03:11Z","abstract_excerpt":"Command and control (C2) paths for issuing commands to malware are sometimes the only indicators of its existence within networks. Identifying potential C2 channels is often a manually driven process that involves a deep understanding of cyber tradecraft. Efforts to improve discovery of these channels through using a reinforcement learning (RL) based approach that learns to automatically carry out C2 attack campaigns on large networks, where multiple defense layers are in place serves to drive efficiency for network operators. In this paper, we model C2 traffic flow as a three-stage process an"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2401.07154","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2401.07154/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T07:33:32Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"Ro2Rqng8h1HPr0TXEZq7zeh/f/rtTVxKwY5ukPaJaeRy8qqXx+/IeOMGAmTJkVq8bfzAzQkF8bY/YumpW5deBg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-03T19:56:41.825727Z"},"content_sha256":"15a9d1f3ab6f29f042ec11d517a0d549caae31386923c0c6d0d77eb8a0afc099","schema_version":"1.0","event_id":"sha256:15a9d1f3ab6f29f042ec11d517a0d549caae31386923c0c6d0d77eb8a0afc099"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/PT3KLNGDCHWA7KB7QSK3YJ34WB/bundle.json","state_url":"https://pith.science/pith/PT3KLNGDCHWA7KB7QSK3YJ34WB/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/PT3KLNGDCHWA7KB7QSK3YJ34WB/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-03T19:56:41Z","links":{"resolver":"https://pith.science/pith/PT3KLNGDCHWA7KB7QSK3YJ34WB","bundle":"https://pith.science/pith/PT3KLNGDCHWA7KB7QSK3YJ34WB/bundle.json","state":"https://pith.science/pith/PT3KLNGDCHWA7KB7QSK3YJ34WB/state.json","well_known_bundle":"https://pith.science/.well-known/pith/PT3KLNGDCHWA7KB7QSK3YJ34WB/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2024:PT3KLNGDCHWA7KB7QSK3YJ34WB","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"443bd93c7cd0331885f992f7bd5ab54c49cfd62c251336530438c91c901aa6b7","cross_cats_sorted":["cs.LG"],"license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","primary_cat":"cs.CR","submitted_at":"2024-01-13T20:03:11Z","title_canon_sha256":"5d3dea7fe9b310a3f19192848559b4a2eda8d65cff9f0e4760db1358e394ab00"},"schema_version":"1.0","source":{"id":"2401.07154","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2401.07154","created_at":"2026-07-05T07:33:32Z"},{"alias_kind":"arxiv_version","alias_value":"2401.07154v1","created_at":"2026-07-05T07:33:32Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2401.07154","created_at":"2026-07-05T07:33:32Z"},{"alias_kind":"pith_short_12","alias_value":"PT3KLNGDCHWA","created_at":"2026-07-05T07:33:32Z"},{"alias_kind":"pith_short_16","alias_value":"PT3KLNGDCHWA7KB7","created_at":"2026-07-05T07:33:32Z"},{"alias_kind":"pith_short_8","alias_value":"PT3KLNGD","created_at":"2026-07-05T07:33:32Z"}],"graph_snapshots":[{"event_id":"sha256:15a9d1f3ab6f29f042ec11d517a0d549caae31386923c0c6d0d77eb8a0afc099","target":"graph","created_at":"2026-07-05T07:33:32Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2401.07154/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Command and control (C2) paths for issuing commands to malware are sometimes the only indicators of its existence within networks. Identifying potential C2 channels is often a manually driven process that involves a deep understanding of cyber tradecraft. Efforts to improve discovery of these channels through using a reinforcement learning (RL) based approach that learns to automatically carry out C2 attack campaigns on large networks, where multiple defense layers are in place serves to drive efficiency for network operators. In this paper, we model C2 traffic flow as a three-stage process an","authors_text":"Abdul Rahman, Ajinsyam S, Akshay Kakkar, Cheng Wang, Christopher Redino, Daniel Radke, Edward Bowen, Lanxiao Huang, Ryan Clark, Tyler Cody","cross_cats":["cs.LG"],"headline":"","license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","primary_cat":"cs.CR","submitted_at":"2024-01-13T20:03:11Z","title":"Discovering Command and Control Channels Using Reinforcement Learning"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2401.07154","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:855191e8d45befb49d62a6204d2219bcb6630e226ee0e37b17f0b49097b2747e","target":"record","created_at":"2026-07-05T07:33:32Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"443bd93c7cd0331885f992f7bd5ab54c49cfd62c251336530438c91c901aa6b7","cross_cats_sorted":["cs.LG"],"license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","primary_cat":"cs.CR","submitted_at":"2024-01-13T20:03:11Z","title_canon_sha256":"5d3dea7fe9b310a3f19192848559b4a2eda8d65cff9f0e4760db1358e394ab00"},"schema_version":"1.0","source":{"id":"2401.07154","kind":"arxiv","version":1}},"canonical_sha256":"7cf6a5b4c311ec0fa83f8495bc277cb07ba66a845defcdeffd5f75c5f1748a68","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"7cf6a5b4c311ec0fa83f8495bc277cb07ba66a845defcdeffd5f75c5f1748a68","first_computed_at":"2026-07-05T07:33:32.703915Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T07:33:32.703915Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"EBm5zUC5hQGjSPPNLpguGDU/1tGxNXoAxmtfTOaVwa3I5ZgvUbfADL620SCWHE+gK+Yc37RjBOkOqOFa0rc1BQ==","signature_status":"signed_v1","signed_at":"2026-07-05T07:33:32.704308Z","signed_message":"canonical_sha256_bytes"},"source_id":"2401.07154","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:855191e8d45befb49d62a6204d2219bcb6630e226ee0e37b17f0b49097b2747e","sha256:15a9d1f3ab6f29f042ec11d517a0d549caae31386923c0c6d0d77eb8a0afc099"],"state_sha256":"acf85654f0941b1664faecf528d2b3f94848ac38f7ac8310e6c75ada1f42b384"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"k+ZzrYgeV4gIj0Yby87SIwmbzupdigPo7tlxyA+zMD7onCZ745jEGp3bWUtu6XVcyfK8N4okkMzW0FI1ojlNCw==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-03T19:56:41.832770Z","bundle_sha256":"686bea43298b170378d164a51593506f56de78e5264b1b3a5dbb39c060047940"}}