{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2025:XWVQGXCE5H3DVI33QGXR2LXVT5","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"1703bd20387bcb53c7ac6de8a4a0b2ff7041a9f1b3e1e21a1c78a42db22d7538","cross_cats_sorted":["cs.LG"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2025-04-29T16:20:28Z","title_canon_sha256":"03f04a037c13325755dc35d1d3e89c6d5fafbedfbb16a33acefb194c31af2548"},"schema_version":"1.0","source":{"id":"2504.20904","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2504.20904","created_at":"2026-07-05T10:55:50Z"},{"alias_kind":"arxiv_version","alias_value":"2504.20904v1","created_at":"2026-07-05T10:55:50Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2504.20904","created_at":"2026-07-05T10:55:50Z"},{"alias_kind":"pith_short_12","alias_value":"XWVQGXCE5H3D","created_at":"2026-07-05T10:55:50Z"},{"alias_kind":"pith_short_16","alias_value":"XWVQGXCE5H3DVI33","created_at":"2026-07-05T10:55:50Z"},{"alias_kind":"pith_short_8","alias_value":"XWVQGXCE","created_at":"2026-07-05T10:55:50Z"}],"graph_snapshots":[{"event_id":"sha256:3a8abc7304e1654a83624e35d9d82e2d12ff8947d3c4d822400e03bafc5da7da","target":"graph","created_at":"2026-07-05T10:55:50Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2504.20904/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Interpretable malware detection is crucial for understanding harmful behaviors and building trust in automated security systems. Traditional explainable methods for Graph Neural Networks (GNNs) often highlight important regions within a graph but fail to associate them with known benign or malicious behavioral patterns. This limitation reduces their utility in security contexts, where alignment with verified prototypes is essential. In this work, we introduce a novel dual prototype-driven explainable framework that interprets GNN-based malware detection decisions. This dual explainable framewo","authors_text":"Ali A. Ghorbani, Griffin Higgins, Hossein Shokouhinejad, Roozbeh Razavi-Far","cross_cats":["cs.LG"],"headline":"","license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2025-04-29T16:20:28Z","title":"Dual Explanations via Subgraph Matching for Malware Detection"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2504.20904","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:bf309b792e412ee726e84275f9baa61aa70d92d666565d9e4e980dd4029a026a","target":"record","created_at":"2026-07-05T10:55:50Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"1703bd20387bcb53c7ac6de8a4a0b2ff7041a9f1b3e1e21a1c78a42db22d7538","cross_cats_sorted":["cs.LG"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2025-04-29T16:20:28Z","title_canon_sha256":"03f04a037c13325755dc35d1d3e89c6d5fafbedfbb16a33acefb194c31af2548"},"schema_version":"1.0","source":{"id":"2504.20904","kind":"arxiv","version":1}},"canonical_sha256":"bdab035c44e9f63aa37b81af1d2ef59f61dfcf3487fb1c7dc45fb1bea204a3c0","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"bdab035c44e9f63aa37b81af1d2ef59f61dfcf3487fb1c7dc45fb1bea204a3c0","first_computed_at":"2026-07-05T10:55:50.669807Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T10:55:50.669807Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"9J7bWfP1HuXKt4xcaSsOj2yr0RrGAahgh5cj+eQJQEjswBtCTBO2iW5CvD0Z+wmmVTk2NDVsjD3JpJSs0LDYBg==","signature_status":"signed_v1","signed_at":"2026-07-05T10:55:50.670266Z","signed_message":"canonical_sha256_bytes"},"source_id":"2504.20904","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:bf309b792e412ee726e84275f9baa61aa70d92d666565d9e4e980dd4029a026a","sha256:3a8abc7304e1654a83624e35d9d82e2d12ff8947d3c4d822400e03bafc5da7da"],"state_sha256":"21ffdb957d2d9c54a0ffe91abf53c832967ec0438f997f1f19fab44aa78209fb"}