{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2025:C2TUQVKA424PZKGXYFZNEMDSFN","short_pith_number":"pith:C2TUQVKA","canonical_record":{"source":{"id":"2508.09801","kind":"arxiv","version":3},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2025-08-13T13:33:02Z","cross_cats_sorted":["cs.AI"],"title_canon_sha256":"3999ab38c09af2653570e7f3fd461db8e7e001f98e6d62ed4e89f6bdd221a10e","abstract_canon_sha256":"7643dcc0c3656e74fd88bfe2128a787cd7adf9ff07afb850b0a8d7b8f1a73e4f"},"schema_version":"1.0"},"canonical_sha256":"16a7485540e6b8fca8d7c172d230722b790d0acfc18f3eae524f0ef77aae39fd","source":{"kind":"arxiv","id":"2508.09801","version":3},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2508.09801","created_at":"2026-05-26T02:03:53Z"},{"alias_kind":"arxiv_version","alias_value":"2508.09801v3","created_at":"2026-05-26T02:03:53Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2508.09801","created_at":"2026-05-26T02:03:53Z"},{"alias_kind":"pith_short_12","alias_value":"C2TUQVKA424P","created_at":"2026-05-26T02:03:53Z"},{"alias_kind":"pith_short_16","alias_value":"C2TUQVKA424PZKGX","created_at":"2026-05-26T02:03:53Z"},{"alias_kind":"pith_short_8","alias_value":"C2TUQVKA","created_at":"2026-05-26T02:03:53Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2025:C2TUQVKA424PZKGXYFZNEMDSFN","target":"record","payload":{"canonical_record":{"source":{"id":"2508.09801","kind":"arxiv","version":3},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2025-08-13T13:33:02Z","cross_cats_sorted":["cs.AI"],"title_canon_sha256":"3999ab38c09af2653570e7f3fd461db8e7e001f98e6d62ed4e89f6bdd221a10e","abstract_canon_sha256":"7643dcc0c3656e74fd88bfe2128a787cd7adf9ff07afb850b0a8d7b8f1a73e4f"},"schema_version":"1.0"},"canonical_sha256":"16a7485540e6b8fca8d7c172d230722b790d0acfc18f3eae524f0ef77aae39fd","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-05-26T02:03:53.532212Z","signature_b64":"RJM7Iaqz5Uhbuioh2hAAK8gOIFvmGl/sOXyvkoBUKbM/asTRyn0vVOR63sS11xJslNnIVstfbgsaEqTfNmkMBQ==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"16a7485540e6b8fca8d7c172d230722b790d0acfc18f3eae524f0ef77aae39fd","last_reissued_at":"2026-05-26T02:03:53.531154Z","signature_status":"signed_v1","first_computed_at":"2026-05-26T02:03:53.531154Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2508.09801","source_version":3,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-05-26T02:03:53Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"a0+sMskHeyUO4Q95hb6jkyqzggbkeETuL/Ic52dqJlPD6mPN42S9QcRBaOnnbALEONU47ckE629QWAcxLHZyDQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-05-29T23:44:45.598461Z"},"content_sha256":"6090b4281840c283a429a171467089606ca895cb3a5a49f76fd595ec48223710","schema_version":"1.0","event_id":"sha256:6090b4281840c283a429a171467089606ca895cb3a5a49f76fd595ec48223710"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2025:C2TUQVKA424PZKGXYFZNEMDSFN","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Explainable Attention-Guided Stacked Graph Neural Networks for Malware Detection","license":"http://creativecommons.org/licenses/by/4.0/","headline":"","cross_cats":["cs.AI"],"primary_cat":"cs.CR","authors_text":"Ali A Ghorbani, Griffin Higgins, Hossein Shokouhinejad, Roozbeh Razavi-Far","submitted_at":"2025-08-13T13:33:02Z","abstract_excerpt":"Malware detection in modern computing environments demands models that are not only accurate but also interpretable and robust to evasive techniques. Graph neural networks (GNNs) have shown promise in this domain by modeling rich structural dependencies in graph-based program representations such as control flow graphs (CFGs). However, single-model approaches may suffer from limited generalization and lack interpretability, especially in high-stakes security applications. In this paper, we propose a novel stacking ensemble framework for graph-based malware detection and explanation. Our method"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2508.09801","kind":"arxiv","version":3},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2508.09801/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-05-26T02:03:53Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"UPoM2DdsbHvCugOhhDC6vQKqfWTF0Z7+DrB8dj41J/S+ZuTNFNuRP+DFVcbMa8seO+FMDhxus4wNakYAr/u4Cw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-05-29T23:44:45.598841Z"},"content_sha256":"a5fdc78f457c140c151630d8a09f055b55a9444c6012fc1e35f11f413fde6f20","schema_version":"1.0","event_id":"sha256:a5fdc78f457c140c151630d8a09f055b55a9444c6012fc1e35f11f413fde6f20"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/C2TUQVKA424PZKGXYFZNEMDSFN/bundle.json","state_url":"https://pith.science/pith/C2TUQVKA424PZKGXYFZNEMDSFN/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/C2TUQVKA424PZKGXYFZNEMDSFN/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-05-29T23:44:45Z","links":{"resolver":"https://pith.science/pith/C2TUQVKA424PZKGXYFZNEMDSFN","bundle":"https://pith.science/pith/C2TUQVKA424PZKGXYFZNEMDSFN/bundle.json","state":"https://pith.science/pith/C2TUQVKA424PZKGXYFZNEMDSFN/state.json","well_known_bundle":"https://pith.science/.well-known/pith/C2TUQVKA424PZKGXYFZNEMDSFN/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2025:C2TUQVKA424PZKGXYFZNEMDSFN","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"7643dcc0c3656e74fd88bfe2128a787cd7adf9ff07afb850b0a8d7b8f1a73e4f","cross_cats_sorted":["cs.AI"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2025-08-13T13:33:02Z","title_canon_sha256":"3999ab38c09af2653570e7f3fd461db8e7e001f98e6d62ed4e89f6bdd221a10e"},"schema_version":"1.0","source":{"id":"2508.09801","kind":"arxiv","version":3}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2508.09801","created_at":"2026-05-26T02:03:53Z"},{"alias_kind":"arxiv_version","alias_value":"2508.09801v3","created_at":"2026-05-26T02:03:53Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2508.09801","created_at":"2026-05-26T02:03:53Z"},{"alias_kind":"pith_short_12","alias_value":"C2TUQVKA424P","created_at":"2026-05-26T02:03:53Z"},{"alias_kind":"pith_short_16","alias_value":"C2TUQVKA424PZKGX","created_at":"2026-05-26T02:03:53Z"},{"alias_kind":"pith_short_8","alias_value":"C2TUQVKA","created_at":"2026-05-26T02:03:53Z"}],"graph_snapshots":[{"event_id":"sha256:a5fdc78f457c140c151630d8a09f055b55a9444c6012fc1e35f11f413fde6f20","target":"graph","created_at":"2026-05-26T02:03:53Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2508.09801/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Malware detection in modern computing environments demands models that are not only accurate but also interpretable and robust to evasive techniques. Graph neural networks (GNNs) have shown promise in this domain by modeling rich structural dependencies in graph-based program representations such as control flow graphs (CFGs). However, single-model approaches may suffer from limited generalization and lack interpretability, especially in high-stakes security applications. In this paper, we propose a novel stacking ensemble framework for graph-based malware detection and explanation. Our method","authors_text":"Ali A Ghorbani, Griffin Higgins, Hossein Shokouhinejad, Roozbeh Razavi-Far","cross_cats":["cs.AI"],"headline":"","license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2025-08-13T13:33:02Z","title":"Explainable Attention-Guided Stacked Graph Neural Networks for Malware Detection"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2508.09801","kind":"arxiv","version":3},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:6090b4281840c283a429a171467089606ca895cb3a5a49f76fd595ec48223710","target":"record","created_at":"2026-05-26T02:03:53Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"7643dcc0c3656e74fd88bfe2128a787cd7adf9ff07afb850b0a8d7b8f1a73e4f","cross_cats_sorted":["cs.AI"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2025-08-13T13:33:02Z","title_canon_sha256":"3999ab38c09af2653570e7f3fd461db8e7e001f98e6d62ed4e89f6bdd221a10e"},"schema_version":"1.0","source":{"id":"2508.09801","kind":"arxiv","version":3}},"canonical_sha256":"16a7485540e6b8fca8d7c172d230722b790d0acfc18f3eae524f0ef77aae39fd","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"16a7485540e6b8fca8d7c172d230722b790d0acfc18f3eae524f0ef77aae39fd","first_computed_at":"2026-05-26T02:03:53.531154Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-05-26T02:03:53.531154Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"RJM7Iaqz5Uhbuioh2hAAK8gOIFvmGl/sOXyvkoBUKbM/asTRyn0vVOR63sS11xJslNnIVstfbgsaEqTfNmkMBQ==","signature_status":"signed_v1","signed_at":"2026-05-26T02:03:53.532212Z","signed_message":"canonical_sha256_bytes"},"source_id":"2508.09801","source_kind":"arxiv","source_version":3}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:6090b4281840c283a429a171467089606ca895cb3a5a49f76fd595ec48223710","sha256:a5fdc78f457c140c151630d8a09f055b55a9444c6012fc1e35f11f413fde6f20"],"state_sha256":"003958cfce2ee206f14db6a8923260743a7088931d30466a4c7a66a84da774c6"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"khFLoZ/I6tLf82OGvhFty4JJZpK8fjemd2TiMSOqjq2M5y39mR409RWekHzVR23yY0rg5NfUtW1fYIJxcl0VAQ==","signed_message":"bundle_sha256_bytes","signed_at":"2026-05-29T23:44:45.601569Z","bundle_sha256":"604b2c8d10fdc2c60a8c0432b429cfa425ed43ce61df26ffde78868cd8fdfa68"}}