{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2023:SHKGJSFI3USWGQFKGWAGRH4FOS","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"f65fc760854f9754a2612743fa6441c26a8553f84776f419cf6acfd2d1c68f98","cross_cats_sorted":["cs.LG"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2023-12-06T12:04:28Z","title_canon_sha256":"5727073ea74ec8c309a7fdd0112eac4f7823d8381b9b5d5e00e5eadbeb46ba37"},"schema_version":"1.0","source":{"id":"2312.04596","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2312.04596","created_at":"2026-07-05T07:21:48Z"},{"alias_kind":"arxiv_version","alias_value":"2312.04596v1","created_at":"2026-07-05T07:21:48Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2312.04596","created_at":"2026-07-05T07:21:48Z"},{"alias_kind":"pith_short_12","alias_value":"SHKGJSFI3USW","created_at":"2026-07-05T07:21:48Z"},{"alias_kind":"pith_short_16","alias_value":"SHKGJSFI3USWGQFK","created_at":"2026-07-05T07:21:48Z"},{"alias_kind":"pith_short_8","alias_value":"SHKGJSFI","created_at":"2026-07-05T07:21:48Z"}],"graph_snapshots":[{"event_id":"sha256:1e3861d26ab03ab3ffeca5c027b6d67d19ac3e54a0091e4a600ce4c9f3c04767","target":"graph","created_at":"2026-07-05T07:21:48Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2312.04596/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"In recent years there has been a dramatic increase in the number of malware attacks that use encrypted HTTP traffic for self-propagation or communication. Antivirus software and firewalls typically will not have access to encryption keys, and therefore direct detection of malicious encrypted data is unlikely to succeed. However, previous work has shown that traffic analysis can provide indications of malicious intent, even in cases where the underlying data remains encrypted. In this paper, we apply three machine learning techniques to the problem of distinguishing malicious encrypted HTTP tra","authors_text":"Anish Singh Shekhawat, Fabio Di Troia, Mark Stamp","cross_cats":["cs.LG"],"headline":"","license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2023-12-06T12:04:28Z","title":"Feature Analysis of Encrypted Malicious Traffic"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2312.04596","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:4b5b81d55c24db55602b310fa346fa356e8c47ea9a0ebaabe1d54b831474e358","target":"record","created_at":"2026-07-05T07:21:48Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"f65fc760854f9754a2612743fa6441c26a8553f84776f419cf6acfd2d1c68f98","cross_cats_sorted":["cs.LG"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2023-12-06T12:04:28Z","title_canon_sha256":"5727073ea74ec8c309a7fdd0112eac4f7823d8381b9b5d5e00e5eadbeb46ba37"},"schema_version":"1.0","source":{"id":"2312.04596","kind":"arxiv","version":1}},"canonical_sha256":"91d464c8a8dd256340aa3580689f857491b7e539cbf1f40febe5457a2fa9ce2f","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"91d464c8a8dd256340aa3580689f857491b7e539cbf1f40febe5457a2fa9ce2f","first_computed_at":"2026-07-05T07:21:48.285583Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T07:21:48.285583Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"WRqGG0VGLrklcxMlIUXhxLvknjJs+mRc7svQAXR6yXF1DcFzR/frbtloxGey/63vvjO5qxpqMCMf02AADrVfAA==","signature_status":"signed_v1","signed_at":"2026-07-05T07:21:48.286041Z","signed_message":"canonical_sha256_bytes"},"source_id":"2312.04596","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:4b5b81d55c24db55602b310fa346fa356e8c47ea9a0ebaabe1d54b831474e358","sha256:1e3861d26ab03ab3ffeca5c027b6d67d19ac3e54a0091e4a600ce4c9f3c04767"],"state_sha256":"91c9a52f0aa1b04d34293147ad0584a9bcc8993f5ca70e14d5f018e85151b713"}