{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2025:XWVQGXCE5H3DVI33QGXR2LXVT5","short_pith_number":"pith:XWVQGXCE","canonical_record":{"source":{"id":"2504.20904","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2025-04-29T16:20:28Z","cross_cats_sorted":["cs.LG"],"title_canon_sha256":"03f04a037c13325755dc35d1d3e89c6d5fafbedfbb16a33acefb194c31af2548","abstract_canon_sha256":"1703bd20387bcb53c7ac6de8a4a0b2ff7041a9f1b3e1e21a1c78a42db22d7538"},"schema_version":"1.0"},"canonical_sha256":"bdab035c44e9f63aa37b81af1d2ef59f61dfcf3487fb1c7dc45fb1bea204a3c0","source":{"kind":"arxiv","id":"2504.20904","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2504.20904","created_at":"2026-07-05T10:55:50Z"},{"alias_kind":"arxiv_version","alias_value":"2504.20904v1","created_at":"2026-07-05T10:55:50Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2504.20904","created_at":"2026-07-05T10:55:50Z"},{"alias_kind":"pith_short_12","alias_value":"XWVQGXCE5H3D","created_at":"2026-07-05T10:55:50Z"},{"alias_kind":"pith_short_16","alias_value":"XWVQGXCE5H3DVI33","created_at":"2026-07-05T10:55:50Z"},{"alias_kind":"pith_short_8","alias_value":"XWVQGXCE","created_at":"2026-07-05T10:55:50Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2025:XWVQGXCE5H3DVI33QGXR2LXVT5","target":"record","payload":{"canonical_record":{"source":{"id":"2504.20904","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2025-04-29T16:20:28Z","cross_cats_sorted":["cs.LG"],"title_canon_sha256":"03f04a037c13325755dc35d1d3e89c6d5fafbedfbb16a33acefb194c31af2548","abstract_canon_sha256":"1703bd20387bcb53c7ac6de8a4a0b2ff7041a9f1b3e1e21a1c78a42db22d7538"},"schema_version":"1.0"},"canonical_sha256":"bdab035c44e9f63aa37b81af1d2ef59f61dfcf3487fb1c7dc45fb1bea204a3c0","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T10:55:50.670266Z","signature_b64":"9J7bWfP1HuXKt4xcaSsOj2yr0RrGAahgh5cj+eQJQEjswBtCTBO2iW5CvD0Z+wmmVTk2NDVsjD3JpJSs0LDYBg==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"bdab035c44e9f63aa37b81af1d2ef59f61dfcf3487fb1c7dc45fb1bea204a3c0","last_reissued_at":"2026-07-05T10:55:50.669807Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T10:55:50.669807Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2504.20904","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T10:55:50Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"n+rlWZanlIdaYolY3Lbut0XEMakooNon+/zZK09Hu4kStB6rURChgL8lb6M7DHHMGFkIuDB9AdFzrA0E/IYjBg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-10T14:06:22.560221Z"},"content_sha256":"bf309b792e412ee726e84275f9baa61aa70d92d666565d9e4e980dd4029a026a","schema_version":"1.0","event_id":"sha256:bf309b792e412ee726e84275f9baa61aa70d92d666565d9e4e980dd4029a026a"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2025:XWVQGXCE5H3DVI33QGXR2LXVT5","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Dual Explanations via Subgraph Matching for Malware Detection","license":"http://creativecommons.org/licenses/by/4.0/","headline":"","cross_cats":["cs.LG"],"primary_cat":"cs.CR","authors_text":"Ali A. Ghorbani, Griffin Higgins, Hossein Shokouhinejad, Roozbeh Razavi-Far","submitted_at":"2025-04-29T16:20:28Z","abstract_excerpt":"Interpretable malware detection is crucial for understanding harmful behaviors and building trust in automated security systems. Traditional explainable methods for Graph Neural Networks (GNNs) often highlight important regions within a graph but fail to associate them with known benign or malicious behavioral patterns. This limitation reduces their utility in security contexts, where alignment with verified prototypes is essential. In this work, we introduce a novel dual prototype-driven explainable framework that interprets GNN-based malware detection decisions. This dual explainable framewo"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2504.20904","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2504.20904/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T10:55:50Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"VSZcfdTrOuTpJYp+HeCnyR4WLCvas1ikYHsSrtkWdKfqIJ39YHe1xdrvflYATmM/EPJ5KMuKPENKScddiHDRDw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-10T14:06:22.560737Z"},"content_sha256":"3a8abc7304e1654a83624e35d9d82e2d12ff8947d3c4d822400e03bafc5da7da","schema_version":"1.0","event_id":"sha256:3a8abc7304e1654a83624e35d9d82e2d12ff8947d3c4d822400e03bafc5da7da"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/XWVQGXCE5H3DVI33QGXR2LXVT5/bundle.json","state_url":"https://pith.science/pith/XWVQGXCE5H3DVI33QGXR2LXVT5/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/XWVQGXCE5H3DVI33QGXR2LXVT5/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-10T14:06:22Z","links":{"resolver":"https://pith.science/pith/XWVQGXCE5H3DVI33QGXR2LXVT5","bundle":"https://pith.science/pith/XWVQGXCE5H3DVI33QGXR2LXVT5/bundle.json","state":"https://pith.science/pith/XWVQGXCE5H3DVI33QGXR2LXVT5/state.json","well_known_bundle":"https://pith.science/.well-known/pith/XWVQGXCE5H3DVI33QGXR2LXVT5/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2025:XWVQGXCE5H3DVI33QGXR2LXVT5","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"1703bd20387bcb53c7ac6de8a4a0b2ff7041a9f1b3e1e21a1c78a42db22d7538","cross_cats_sorted":["cs.LG"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2025-04-29T16:20:28Z","title_canon_sha256":"03f04a037c13325755dc35d1d3e89c6d5fafbedfbb16a33acefb194c31af2548"},"schema_version":"1.0","source":{"id":"2504.20904","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2504.20904","created_at":"2026-07-05T10:55:50Z"},{"alias_kind":"arxiv_version","alias_value":"2504.20904v1","created_at":"2026-07-05T10:55:50Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2504.20904","created_at":"2026-07-05T10:55:50Z"},{"alias_kind":"pith_short_12","alias_value":"XWVQGXCE5H3D","created_at":"2026-07-05T10:55:50Z"},{"alias_kind":"pith_short_16","alias_value":"XWVQGXCE5H3DVI33","created_at":"2026-07-05T10:55:50Z"},{"alias_kind":"pith_short_8","alias_value":"XWVQGXCE","created_at":"2026-07-05T10:55:50Z"}],"graph_snapshots":[{"event_id":"sha256:3a8abc7304e1654a83624e35d9d82e2d12ff8947d3c4d822400e03bafc5da7da","target":"graph","created_at":"2026-07-05T10:55:50Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2504.20904/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Interpretable malware detection is crucial for understanding harmful behaviors and building trust in automated security systems. Traditional explainable methods for Graph Neural Networks (GNNs) often highlight important regions within a graph but fail to associate them with known benign or malicious behavioral patterns. This limitation reduces their utility in security contexts, where alignment with verified prototypes is essential. In this work, we introduce a novel dual prototype-driven explainable framework that interprets GNN-based malware detection decisions. This dual explainable framewo","authors_text":"Ali A. Ghorbani, Griffin Higgins, Hossein Shokouhinejad, Roozbeh Razavi-Far","cross_cats":["cs.LG"],"headline":"","license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2025-04-29T16:20:28Z","title":"Dual Explanations via Subgraph Matching for Malware Detection"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2504.20904","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:bf309b792e412ee726e84275f9baa61aa70d92d666565d9e4e980dd4029a026a","target":"record","created_at":"2026-07-05T10:55:50Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"1703bd20387bcb53c7ac6de8a4a0b2ff7041a9f1b3e1e21a1c78a42db22d7538","cross_cats_sorted":["cs.LG"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2025-04-29T16:20:28Z","title_canon_sha256":"03f04a037c13325755dc35d1d3e89c6d5fafbedfbb16a33acefb194c31af2548"},"schema_version":"1.0","source":{"id":"2504.20904","kind":"arxiv","version":1}},"canonical_sha256":"bdab035c44e9f63aa37b81af1d2ef59f61dfcf3487fb1c7dc45fb1bea204a3c0","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"bdab035c44e9f63aa37b81af1d2ef59f61dfcf3487fb1c7dc45fb1bea204a3c0","first_computed_at":"2026-07-05T10:55:50.669807Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T10:55:50.669807Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"9J7bWfP1HuXKt4xcaSsOj2yr0RrGAahgh5cj+eQJQEjswBtCTBO2iW5CvD0Z+wmmVTk2NDVsjD3JpJSs0LDYBg==","signature_status":"signed_v1","signed_at":"2026-07-05T10:55:50.670266Z","signed_message":"canonical_sha256_bytes"},"source_id":"2504.20904","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:bf309b792e412ee726e84275f9baa61aa70d92d666565d9e4e980dd4029a026a","sha256:3a8abc7304e1654a83624e35d9d82e2d12ff8947d3c4d822400e03bafc5da7da"],"state_sha256":"21ffdb957d2d9c54a0ffe91abf53c832967ec0438f997f1f19fab44aa78209fb"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"w343EI5LWc0n6Y4N51G/qFztbdtNyN2725JTULMFSR+9px/oWJ3WdybdXeYChF9nZhsalU/i/QmxEqyibWUlDg==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-10T14:06:22.564711Z","bundle_sha256":"db59ec62e55779680311bba607ee6ecbebae8c7c7092a5300f35946fb0317bf6"}}