{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2021:RWAKTWVQQEQHVP7TDZN67SBMEW","short_pith_number":"pith:RWAKTWVQ","canonical_record":{"source":{"id":"2106.04720","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","primary_cat":"cs.CR","submitted_at":"2021-06-08T22:31:12Z","cross_cats_sorted":[],"title_canon_sha256":"0ea05706c8241d74986a7ea876605e0cbc233bc32df1608b16700ba1220364e5","abstract_canon_sha256":"db7b46dfab5eaaacb9420b45e90a1b05e4dfdcf4f79b95414e4e349432247e81"},"schema_version":"1.0"},"canonical_sha256":"8d80a9dab081207abff31e5befc82c25a27cc1ed5ee40fd34c5fa2afbd6cefdf","source":{"kind":"arxiv","id":"2106.04720","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2106.04720","created_at":"2026-07-05T03:09:30Z"},{"alias_kind":"arxiv_version","alias_value":"2106.04720v1","created_at":"2026-07-05T03:09:30Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2106.04720","created_at":"2026-07-05T03:09:30Z"},{"alias_kind":"pith_short_12","alias_value":"RWAKTWVQQEQH","created_at":"2026-07-05T03:09:30Z"},{"alias_kind":"pith_short_16","alias_value":"RWAKTWVQQEQHVP7T","created_at":"2026-07-05T03:09:30Z"},{"alias_kind":"pith_short_8","alias_value":"RWAKTWVQ","created_at":"2026-07-05T03:09:30Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2021:RWAKTWVQQEQHVP7TDZN67SBMEW","target":"record","payload":{"canonical_record":{"source":{"id":"2106.04720","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","primary_cat":"cs.CR","submitted_at":"2021-06-08T22:31:12Z","cross_cats_sorted":[],"title_canon_sha256":"0ea05706c8241d74986a7ea876605e0cbc233bc32df1608b16700ba1220364e5","abstract_canon_sha256":"db7b46dfab5eaaacb9420b45e90a1b05e4dfdcf4f79b95414e4e349432247e81"},"schema_version":"1.0"},"canonical_sha256":"8d80a9dab081207abff31e5befc82c25a27cc1ed5ee40fd34c5fa2afbd6cefdf","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T03:09:30.709970Z","signature_b64":"HPT+Tr4jBk82fa+8bZdPaEViP0U3pyapSalxIrUjjWRQlRNpwg2r2k0G3+Olpt3QAxxxxlKFQLxZirVIVWRvCQ==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"8d80a9dab081207abff31e5befc82c25a27cc1ed5ee40fd34c5fa2afbd6cefdf","last_reissued_at":"2026-07-05T03:09:30.709480Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T03:09:30.709480Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2106.04720","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T03:09:30Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"IBkpLTnH8/RBj+BKjLFaxC/czcUS2OZLtrQ9vXMrqDJa7dmWjQbf5OA4tkSkFjHueF20MUFJlrPh/iYC2IjFAA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-24T02:39:44.167545Z"},"content_sha256":"1e2b5d516daa3fcee06f929011bdb1e2ef53ceb7888fd2489176c084b4f8bbd9","schema_version":"1.0","event_id":"sha256:1e2b5d516daa3fcee06f929011bdb1e2ef53ceb7888fd2489176c084b4f8bbd9"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2021:RWAKTWVQQEQHVP7TDZN67SBMEW","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Analysis of Attacker Behavior in Compromised Hosts During Command and Control","license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","headline":"","cross_cats":[],"primary_cat":"cs.CR","authors_text":"Farhan Sadique, Shamik Sengupta","submitted_at":"2021-06-08T22:31:12Z","abstract_excerpt":"Traditional reactive approach of blacklisting botnets fails to adapt to the rapidly evolving landscape of cyberattacks. An automated and proactive approach to detect and block botnet hosts will immensely benefit the industry. Behavioral analysis of botnet is shown to be effective against a wide variety of attack types. Current works, however, focus solely on analyzing network traffic from and to the bots. In this work we take a different approach of analyzing the chain of commands input by attackers in a compromised host. We have deployed several honeypots to simulate Linux shells and allowed "},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2106.04720","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2106.04720/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T03:09:30Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"R8nb66KxzMkAzLldoi3cUb18ce+ImaYkeUJdUhne8l2O+l7B+zY4A5d7dzSfC5C+qjqL9i/YLL3hWIZOF71yDg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-24T02:39:44.168053Z"},"content_sha256":"1d2daf6e731556d168344f6dcfb13fd5a11b60b14e9adb5c9a1297026f3a2dd2","schema_version":"1.0","event_id":"sha256:1d2daf6e731556d168344f6dcfb13fd5a11b60b14e9adb5c9a1297026f3a2dd2"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/RWAKTWVQQEQHVP7TDZN67SBMEW/bundle.json","state_url":"https://pith.science/pith/RWAKTWVQQEQHVP7TDZN67SBMEW/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/RWAKTWVQQEQHVP7TDZN67SBMEW/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-24T02:39:44Z","links":{"resolver":"https://pith.science/pith/RWAKTWVQQEQHVP7TDZN67SBMEW","bundle":"https://pith.science/pith/RWAKTWVQQEQHVP7TDZN67SBMEW/bundle.json","state":"https://pith.science/pith/RWAKTWVQQEQHVP7TDZN67SBMEW/state.json","well_known_bundle":"https://pith.science/.well-known/pith/RWAKTWVQQEQHVP7TDZN67SBMEW/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2021:RWAKTWVQQEQHVP7TDZN67SBMEW","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"db7b46dfab5eaaacb9420b45e90a1b05e4dfdcf4f79b95414e4e349432247e81","cross_cats_sorted":[],"license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","primary_cat":"cs.CR","submitted_at":"2021-06-08T22:31:12Z","title_canon_sha256":"0ea05706c8241d74986a7ea876605e0cbc233bc32df1608b16700ba1220364e5"},"schema_version":"1.0","source":{"id":"2106.04720","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2106.04720","created_at":"2026-07-05T03:09:30Z"},{"alias_kind":"arxiv_version","alias_value":"2106.04720v1","created_at":"2026-07-05T03:09:30Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2106.04720","created_at":"2026-07-05T03:09:30Z"},{"alias_kind":"pith_short_12","alias_value":"RWAKTWVQQEQH","created_at":"2026-07-05T03:09:30Z"},{"alias_kind":"pith_short_16","alias_value":"RWAKTWVQQEQHVP7T","created_at":"2026-07-05T03:09:30Z"},{"alias_kind":"pith_short_8","alias_value":"RWAKTWVQ","created_at":"2026-07-05T03:09:30Z"}],"graph_snapshots":[{"event_id":"sha256:1d2daf6e731556d168344f6dcfb13fd5a11b60b14e9adb5c9a1297026f3a2dd2","target":"graph","created_at":"2026-07-05T03:09:30Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2106.04720/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Traditional reactive approach of blacklisting botnets fails to adapt to the rapidly evolving landscape of cyberattacks. An automated and proactive approach to detect and block botnet hosts will immensely benefit the industry. Behavioral analysis of botnet is shown to be effective against a wide variety of attack types. Current works, however, focus solely on analyzing network traffic from and to the bots. In this work we take a different approach of analyzing the chain of commands input by attackers in a compromised host. We have deployed several honeypots to simulate Linux shells and allowed ","authors_text":"Farhan Sadique, Shamik Sengupta","cross_cats":[],"headline":"","license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","primary_cat":"cs.CR","submitted_at":"2021-06-08T22:31:12Z","title":"Analysis of Attacker Behavior in Compromised Hosts During Command and Control"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2106.04720","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:1e2b5d516daa3fcee06f929011bdb1e2ef53ceb7888fd2489176c084b4f8bbd9","target":"record","created_at":"2026-07-05T03:09:30Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"db7b46dfab5eaaacb9420b45e90a1b05e4dfdcf4f79b95414e4e349432247e81","cross_cats_sorted":[],"license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","primary_cat":"cs.CR","submitted_at":"2021-06-08T22:31:12Z","title_canon_sha256":"0ea05706c8241d74986a7ea876605e0cbc233bc32df1608b16700ba1220364e5"},"schema_version":"1.0","source":{"id":"2106.04720","kind":"arxiv","version":1}},"canonical_sha256":"8d80a9dab081207abff31e5befc82c25a27cc1ed5ee40fd34c5fa2afbd6cefdf","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"8d80a9dab081207abff31e5befc82c25a27cc1ed5ee40fd34c5fa2afbd6cefdf","first_computed_at":"2026-07-05T03:09:30.709480Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T03:09:30.709480Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"HPT+Tr4jBk82fa+8bZdPaEViP0U3pyapSalxIrUjjWRQlRNpwg2r2k0G3+Olpt3QAxxxxlKFQLxZirVIVWRvCQ==","signature_status":"signed_v1","signed_at":"2026-07-05T03:09:30.709970Z","signed_message":"canonical_sha256_bytes"},"source_id":"2106.04720","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:1e2b5d516daa3fcee06f929011bdb1e2ef53ceb7888fd2489176c084b4f8bbd9","sha256:1d2daf6e731556d168344f6dcfb13fd5a11b60b14e9adb5c9a1297026f3a2dd2"],"state_sha256":"ba7d92c7f3d334a51b628eb5d70f4ff960bf487b04818c1f77c60a35ef81826d"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"x/ZxJZD6nkimSf2X9e9ZPES5FExZ1JOazzOandzLyKXJeXO8+//+iLd/H403G13zMft0d99sjdUVJa7fPtQSBQ==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-24T02:39:44.171672Z","bundle_sha256":"c74f844c39804314f67b4a37cbfd243f0e593b5d7d26840b6893fbbafc91860c"}}