{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2020:QJCPFLI63RH4LHTFLQD7SZXG4Z","short_pith_number":"pith:QJCPFLI6","canonical_record":{"source":{"id":"2009.01939","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2020-09-03T22:00:42Z","cross_cats_sorted":[],"title_canon_sha256":"0f0ae2a60409d6df574aa453144c9d762fae7efd7ff5fb9d178a576e01800c98","abstract_canon_sha256":"66474f4eb610e7578a6eb0b6e88ade75cbdf93728b854be1ad70129c251af960"},"schema_version":"1.0"},"canonical_sha256":"8244f2ad1edc4fc59e655c07f966e6e666793894a562dbba9afca353ccfd29ce","source":{"kind":"arxiv","id":"2009.01939","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2009.01939","created_at":"2026-07-05T01:33:01Z"},{"alias_kind":"arxiv_version","alias_value":"2009.01939v1","created_at":"2026-07-05T01:33:01Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2009.01939","created_at":"2026-07-05T01:33:01Z"},{"alias_kind":"pith_short_12","alias_value":"QJCPFLI63RH4","created_at":"2026-07-05T01:33:01Z"},{"alias_kind":"pith_short_16","alias_value":"QJCPFLI63RH4LHTF","created_at":"2026-07-05T01:33:01Z"},{"alias_kind":"pith_short_8","alias_value":"QJCPFLI6","created_at":"2026-07-05T01:33:01Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2020:QJCPFLI63RH4LHTFLQD7SZXG4Z","target":"record","payload":{"canonical_record":{"source":{"id":"2009.01939","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2020-09-03T22:00:42Z","cross_cats_sorted":[],"title_canon_sha256":"0f0ae2a60409d6df574aa453144c9d762fae7efd7ff5fb9d178a576e01800c98","abstract_canon_sha256":"66474f4eb610e7578a6eb0b6e88ade75cbdf93728b854be1ad70129c251af960"},"schema_version":"1.0"},"canonical_sha256":"8244f2ad1edc4fc59e655c07f966e6e666793894a562dbba9afca353ccfd29ce","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T01:33:01.714831Z","signature_b64":"+pu9vpW05TZriSdolp7pTVcN2Ka/hHAyLfs9Ursem9eGBLJGkGWhon98TatipkbSXBw+UgEjFwOdpxG9QAplCg==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"8244f2ad1edc4fc59e655c07f966e6e666793894a562dbba9afca353ccfd29ce","last_reissued_at":"2026-07-05T01:33:01.714479Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T01:33:01.714479Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2009.01939","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T01:33:01Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"kMosw95/gQ33xN73fKvEpwLuQZDkOFjsXnPF/4WPIK6URBSEddTb3FGcrDO9SJfdOCK0ZX774XHke+DrpdadAQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-07T18:49:37.390879Z"},"content_sha256":"38e5ec2eca44ca34774301b57bb64054ba71b2cdb0eb893b3ccdbcc3ef556ec7","schema_version":"1.0","event_id":"sha256:38e5ec2eca44ca34774301b57bb64054ba71b2cdb0eb893b3ccdbcc3ef556ec7"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2020:QJCPFLI63RH4LHTFLQD7SZXG4Z","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Accurate TLS Fingerprinting using Destination Context and Knowledge Bases","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":[],"primary_cat":"cs.CR","authors_text":"Blake Anderson, David McGrew","submitted_at":"2020-09-03T22:00:42Z","abstract_excerpt":"Network fingerprinting is used to identify applications, provide insight into network traffic, and detect malicious activity. With the broad adoption of TLS, traditional fingerprinting techniques that rely on clear-text data are no longer viable. TLS-specific techniques have been introduced that create a fingerprint string from carefully selected data features in the client_hello to facilitate process identification before data is exchanged. Unfortunately, this approach fails in practice because hundreds of processes can map to the same fingerprint string. We solve this problem by presenting a"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2009.01939","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2009.01939/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T01:33:01Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"OEJ6u7Z5aGLJuqvdfiCSev08mE5Xrj5Af7zjDGtvLDYOWon1fFn8BzTryP0qssqucsyUq+DN00avUMHGID0cAw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-07T18:49:37.391393Z"},"content_sha256":"1d96eb16ab99c988486823734eb3b3b7f5467123d90319a9bd8bca0a4e253fa3","schema_version":"1.0","event_id":"sha256:1d96eb16ab99c988486823734eb3b3b7f5467123d90319a9bd8bca0a4e253fa3"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/QJCPFLI63RH4LHTFLQD7SZXG4Z/bundle.json","state_url":"https://pith.science/pith/QJCPFLI63RH4LHTFLQD7SZXG4Z/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/QJCPFLI63RH4LHTFLQD7SZXG4Z/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-07T18:49:37Z","links":{"resolver":"https://pith.science/pith/QJCPFLI63RH4LHTFLQD7SZXG4Z","bundle":"https://pith.science/pith/QJCPFLI63RH4LHTFLQD7SZXG4Z/bundle.json","state":"https://pith.science/pith/QJCPFLI63RH4LHTFLQD7SZXG4Z/state.json","well_known_bundle":"https://pith.science/.well-known/pith/QJCPFLI63RH4LHTFLQD7SZXG4Z/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2020:QJCPFLI63RH4LHTFLQD7SZXG4Z","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"66474f4eb610e7578a6eb0b6e88ade75cbdf93728b854be1ad70129c251af960","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2020-09-03T22:00:42Z","title_canon_sha256":"0f0ae2a60409d6df574aa453144c9d762fae7efd7ff5fb9d178a576e01800c98"},"schema_version":"1.0","source":{"id":"2009.01939","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2009.01939","created_at":"2026-07-05T01:33:01Z"},{"alias_kind":"arxiv_version","alias_value":"2009.01939v1","created_at":"2026-07-05T01:33:01Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2009.01939","created_at":"2026-07-05T01:33:01Z"},{"alias_kind":"pith_short_12","alias_value":"QJCPFLI63RH4","created_at":"2026-07-05T01:33:01Z"},{"alias_kind":"pith_short_16","alias_value":"QJCPFLI63RH4LHTF","created_at":"2026-07-05T01:33:01Z"},{"alias_kind":"pith_short_8","alias_value":"QJCPFLI6","created_at":"2026-07-05T01:33:01Z"}],"graph_snapshots":[{"event_id":"sha256:1d96eb16ab99c988486823734eb3b3b7f5467123d90319a9bd8bca0a4e253fa3","target":"graph","created_at":"2026-07-05T01:33:01Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2009.01939/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Network fingerprinting is used to identify applications, provide insight into network traffic, and detect malicious activity. With the broad adoption of TLS, traditional fingerprinting techniques that rely on clear-text data are no longer viable. TLS-specific techniques have been introduced that create a fingerprint string from carefully selected data features in the client_hello to facilitate process identification before data is exchanged. Unfortunately, this approach fails in practice because hundreds of processes can map to the same fingerprint string. We solve this problem by presenting a","authors_text":"Blake Anderson, David McGrew","cross_cats":[],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2020-09-03T22:00:42Z","title":"Accurate TLS Fingerprinting using Destination Context and Knowledge Bases"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2009.01939","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:38e5ec2eca44ca34774301b57bb64054ba71b2cdb0eb893b3ccdbcc3ef556ec7","target":"record","created_at":"2026-07-05T01:33:01Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"66474f4eb610e7578a6eb0b6e88ade75cbdf93728b854be1ad70129c251af960","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2020-09-03T22:00:42Z","title_canon_sha256":"0f0ae2a60409d6df574aa453144c9d762fae7efd7ff5fb9d178a576e01800c98"},"schema_version":"1.0","source":{"id":"2009.01939","kind":"arxiv","version":1}},"canonical_sha256":"8244f2ad1edc4fc59e655c07f966e6e666793894a562dbba9afca353ccfd29ce","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"8244f2ad1edc4fc59e655c07f966e6e666793894a562dbba9afca353ccfd29ce","first_computed_at":"2026-07-05T01:33:01.714479Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T01:33:01.714479Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"+pu9vpW05TZriSdolp7pTVcN2Ka/hHAyLfs9Ursem9eGBLJGkGWhon98TatipkbSXBw+UgEjFwOdpxG9QAplCg==","signature_status":"signed_v1","signed_at":"2026-07-05T01:33:01.714831Z","signed_message":"canonical_sha256_bytes"},"source_id":"2009.01939","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:38e5ec2eca44ca34774301b57bb64054ba71b2cdb0eb893b3ccdbcc3ef556ec7","sha256:1d96eb16ab99c988486823734eb3b3b7f5467123d90319a9bd8bca0a4e253fa3"],"state_sha256":"9fb0b96055c29201e37db228d3e966d8c116f0da29af486831060709d809b438"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"jiZf1qZ35Ck8l0BsuiHYnZLXkMImbKL7zNJmMJvApJ2y6neRC+b1uv+hdglKBGbzjM2lun1s5N+j+7g1SwnmCg==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-07T18:49:37.395499Z","bundle_sha256":"d95c49cc87b4a17efd4ec0735cef3daa09d1b72ff36ec158173df24ece02332f"}}