{"record_type":"pith_number_record","schema_url":"https://pith.science/schemas/pith-number/v1.json","pith_number":"pith:2016:X7PVOMHGLMFXDTMK4KQF3465WF","short_pith_number":"pith:X7PVOMHG","schema_version":"1.0","canonical_sha256":"bfdf5730e65b0b71cd8ae2a05df3ddb16bb15c4ed03af1ae29cd97ba1569c90d","source":{"kind":"arxiv","id":"1607.04950","version":2},"attestation_state":"computed","paper":{"title":"Wavelet decomposition of software entropy reveals symptoms of malicious code","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":["stat.AP"],"primary_cat":"cs.CR","authors_text":"Glenn Chisholm, Matt Wolff, Michael Wojnowicz, Xuan Zhao","submitted_at":"2016-07-18T05:12:20Z","abstract_excerpt":"Sophisticated malware authors can sneak hidden malicious code into portable executable files, and this code can be hard to detect, especially if encrypted or compressed. However, when an executable file switches between code regimes (e.g. native, encrypted, compressed, text, and padding), there are corresponding shifts in the file's representation as an entropy signal. In this paper, we develop a method for automatically quantifying the extent to which patterned variations in a file's entropy signal make it \"suspicious.\" In Experiment 1, we use wavelet transforms to define a Suspiciously Struc"},"verification_status":{"content_addressed":true,"pith_receipt":true,"author_attested":false,"weak_author_claims":0,"strong_author_claims":0,"externally_anchored":false,"storage_verified":false,"citation_signatures":0,"replication_records":0,"graph_snapshot":true,"references_resolved":false,"formal_links_present":false},"canonical_record":{"source":{"id":"1607.04950","kind":"arxiv","version":2},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2016-07-18T05:12:20Z","cross_cats_sorted":["stat.AP"],"title_canon_sha256":"de8061f9be27b270c3a1ffb888c01a15be3132e605f0f234c43cc508089e7689","abstract_canon_sha256":"158d25670cf39ef6a30b95075b404ee13ab87cd55b9aed970de7a06e0b5d8764"},"schema_version":"1.0"},"receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-05-18T00:24:35.578083Z","signature_b64":"JHGl8OeEgUckDE4I28mIJN1Jb9Ji/aObs3owEgCZ3fzrU+rGiizwfWAgid+vmpLaEfgrfgm9dYAsOeAkNBH7Bg==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"bfdf5730e65b0b71cd8ae2a05df3ddb16bb15c4ed03af1ae29cd97ba1569c90d","last_reissued_at":"2026-05-18T00:24:35.577448Z","signature_status":"signed_v1","first_computed_at":"2026-05-18T00:24:35.577448Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"graph_snapshot":{"paper":{"title":"Wavelet decomposition of software entropy reveals symptoms of malicious code","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":["stat.AP"],"primary_cat":"cs.CR","authors_text":"Glenn Chisholm, Matt Wolff, Michael Wojnowicz, Xuan Zhao","submitted_at":"2016-07-18T05:12:20Z","abstract_excerpt":"Sophisticated malware authors can sneak hidden malicious code into portable executable files, and this code can be hard to detect, especially if encrypted or compressed. However, when an executable file switches between code regimes (e.g. native, encrypted, compressed, text, and padding), there are corresponding shifts in the file's representation as an entropy signal. In this paper, we develop a method for automatically quantifying the extent to which patterned variations in a file's entropy signal make it \"suspicious.\" In Experiment 1, we use wavelet transforms to define a Suspiciously Struc"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"1607.04950","kind":"arxiv","version":2},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"aliases":[{"alias_kind":"arxiv","alias_value":"1607.04950","created_at":"2026-05-18T00:24:35.577540+00:00"},{"alias_kind":"arxiv_version","alias_value":"1607.04950v2","created_at":"2026-05-18T00:24:35.577540+00:00"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.1607.04950","created_at":"2026-05-18T00:24:35.577540+00:00"},{"alias_kind":"pith_short_12","alias_value":"X7PVOMHGLMFX","created_at":"2026-05-18T12:30:51.357362+00:00"},{"alias_kind":"pith_short_16","alias_value":"X7PVOMHGLMFXDTMK","created_at":"2026-05-18T12:30:51.357362+00:00"},{"alias_kind":"pith_short_8","alias_value":"X7PVOMHG","created_at":"2026-05-18T12:30:51.357362+00:00"}],"events":[],"event_summary":{},"paper_claims":[],"inbound_citations":{"count":0,"internal_anchor_count":0,"sample":[]},"formal_canon":{"evidence_count":0,"sample":[],"anchors":[]},"links":{"html":"https://pith.science/pith/X7PVOMHGLMFXDTMK4KQF3465WF","json":"https://pith.science/pith/X7PVOMHGLMFXDTMK4KQF3465WF.json","graph_json":"https://pith.science/api/pith-number/X7PVOMHGLMFXDTMK4KQF3465WF/graph.json","events_json":"https://pith.science/api/pith-number/X7PVOMHGLMFXDTMK4KQF3465WF/events.json","paper":"https://pith.science/paper/X7PVOMHG"},"agent_actions":{"view_html":"https://pith.science/pith/X7PVOMHGLMFXDTMK4KQF3465WF","download_json":"https://pith.science/pith/X7PVOMHGLMFXDTMK4KQF3465WF.json","view_paper":"https://pith.science/paper/X7PVOMHG","resolve_alias":"https://pith.science/api/pith-number/resolve?arxiv=1607.04950&json=true","fetch_graph":"https://pith.science/api/pith-number/X7PVOMHGLMFXDTMK4KQF3465WF/graph.json","fetch_events":"https://pith.science/api/pith-number/X7PVOMHGLMFXDTMK4KQF3465WF/events.json","actions":{"anchor_timestamp":"https://pith.science/pith/X7PVOMHGLMFXDTMK4KQF3465WF/action/timestamp_anchor","attest_storage":"https://pith.science/pith/X7PVOMHGLMFXDTMK4KQF3465WF/action/storage_attestation","attest_author":"https://pith.science/pith/X7PVOMHGLMFXDTMK4KQF3465WF/action/author_attestation","sign_citation":"https://pith.science/pith/X7PVOMHGLMFXDTMK4KQF3465WF/action/citation_signature","submit_replication":"https://pith.science/pith/X7PVOMHGLMFXDTMK4KQF3465WF/action/replication_record"}},"created_at":"2026-05-18T00:24:35.577540+00:00","updated_at":"2026-05-18T00:24:35.577540+00:00"}