{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2019:Y6L4IPJ5KN47BQFQB4SJZVE7P2","short_pith_number":"pith:Y6L4IPJ5","canonical_record":{"source":{"id":"1906.11246","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2019-06-26T12:58:57Z","cross_cats_sorted":["cs.LG"],"title_canon_sha256":"d5c9981af1a9d8bbc58173955fce369b1a6b2514a76139dd54b70c9f13d6e25e","abstract_canon_sha256":"8d08d5305fc85a26d10627ba9720234b17ca3f2014c9e35ca4226278fab07e70"},"schema_version":"1.0"},"canonical_sha256":"c797c43d3d5379f0c0b00f249cd49f7e9ca075d0fc8970f4d50de445952d5a78","source":{"kind":"arxiv","id":"1906.11246","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"1906.11246","created_at":"2026-05-17T23:42:07Z"},{"alias_kind":"arxiv_version","alias_value":"1906.11246v1","created_at":"2026-05-17T23:42:07Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.1906.11246","created_at":"2026-05-17T23:42:07Z"},{"alias_kind":"pith_short_12","alias_value":"Y6L4IPJ5KN47","created_at":"2026-05-18T12:33:33Z"},{"alias_kind":"pith_short_16","alias_value":"Y6L4IPJ5KN47BQFQ","created_at":"2026-05-18T12:33:33Z"},{"alias_kind":"pith_short_8","alias_value":"Y6L4IPJ5","created_at":"2026-05-18T12:33:33Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2019:Y6L4IPJ5KN47BQFQB4SJZVE7P2","target":"record","payload":{"canonical_record":{"source":{"id":"1906.11246","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2019-06-26T12:58:57Z","cross_cats_sorted":["cs.LG"],"title_canon_sha256":"d5c9981af1a9d8bbc58173955fce369b1a6b2514a76139dd54b70c9f13d6e25e","abstract_canon_sha256":"8d08d5305fc85a26d10627ba9720234b17ca3f2014c9e35ca4226278fab07e70"},"schema_version":"1.0"},"canonical_sha256":"c797c43d3d5379f0c0b00f249cd49f7e9ca075d0fc8970f4d50de445952d5a78","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-05-17T23:42:07.648644Z","signature_b64":"zVEVEMZEowxRDVM3KUj3V37G+lBR7C55qMcKIBfdMX/7GIv/SQYuVOhdGgYf1jNmyszMTm5dOreOfRZguNtSAQ==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"c797c43d3d5379f0c0b00f249cd49f7e9ca075d0fc8970f4d50de445952d5a78","last_reissued_at":"2026-05-17T23:42:07.647905Z","signature_status":"signed_v1","first_computed_at":"2026-05-17T23:42:07.647905Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"1906.11246","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-05-17T23:42:07Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"N8Mi4KF2oGnqGFrzH0YJGqrAMLGKBYehUFWQyNp0XizIMfoYCzegfguw8tEJTXeq+SlUHyyNmAuI75QJf0EUCw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-06-24T07:50:06.299635Z"},"content_sha256":"6c622f2159819f5577e4f28b78b95e479c8d17330fb8b87820d708f86db9960e","schema_version":"1.0","event_id":"sha256:6c622f2159819f5577e4f28b78b95e479c8d17330fb8b87820d708f86db9960e"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2019:Y6L4IPJ5KN47BQFQB4SJZVE7P2","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Identifying DNS-tunneled traffic with predictive models","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":["cs.LG"],"primary_cat":"cs.CR","authors_text":"Andreas Berg, Daniel Forsberg","submitted_at":"2019-06-26T12:58:57Z","abstract_excerpt":"DNS is a distributed, fault tolerant system that avoids a single point of failure. As such it is an integral part of the internet as we use it today and hence deemed a safe protocol which is let through firewalls and proxies with no or little checks. This can be exploited by malicious agents. Network forensics is effective but struggles due to size of data and manual labour. This paper explores to what extent predictive models can be used to predict network traffic, what protocols are tunneled in the DNS protocol and more specifically whether the predictive performance is enhanced when analyzi"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"1906.11246","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-05-17T23:42:07Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"cAI7AgB1dvFKL2u0ueIaGbHGzt1+TTcdW7EEqi1CcFs2IG/aTa9k3AadHuoh+O3iIkyMN+5HPbfz+lGimkMvDw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-06-24T07:50:06.299981Z"},"content_sha256":"39f772345b062344683752df5518b294bd9f334d0754ba5176f0a9cb6c116ec6","schema_version":"1.0","event_id":"sha256:39f772345b062344683752df5518b294bd9f334d0754ba5176f0a9cb6c116ec6"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/Y6L4IPJ5KN47BQFQB4SJZVE7P2/bundle.json","state_url":"https://pith.science/pith/Y6L4IPJ5KN47BQFQB4SJZVE7P2/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/Y6L4IPJ5KN47BQFQB4SJZVE7P2/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-06-24T07:50:06Z","links":{"resolver":"https://pith.science/pith/Y6L4IPJ5KN47BQFQB4SJZVE7P2","bundle":"https://pith.science/pith/Y6L4IPJ5KN47BQFQB4SJZVE7P2/bundle.json","state":"https://pith.science/pith/Y6L4IPJ5KN47BQFQB4SJZVE7P2/state.json","well_known_bundle":"https://pith.science/.well-known/pith/Y6L4IPJ5KN47BQFQB4SJZVE7P2/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2019:Y6L4IPJ5KN47BQFQB4SJZVE7P2","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"8d08d5305fc85a26d10627ba9720234b17ca3f2014c9e35ca4226278fab07e70","cross_cats_sorted":["cs.LG"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2019-06-26T12:58:57Z","title_canon_sha256":"d5c9981af1a9d8bbc58173955fce369b1a6b2514a76139dd54b70c9f13d6e25e"},"schema_version":"1.0","source":{"id":"1906.11246","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"1906.11246","created_at":"2026-05-17T23:42:07Z"},{"alias_kind":"arxiv_version","alias_value":"1906.11246v1","created_at":"2026-05-17T23:42:07Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.1906.11246","created_at":"2026-05-17T23:42:07Z"},{"alias_kind":"pith_short_12","alias_value":"Y6L4IPJ5KN47","created_at":"2026-05-18T12:33:33Z"},{"alias_kind":"pith_short_16","alias_value":"Y6L4IPJ5KN47BQFQ","created_at":"2026-05-18T12:33:33Z"},{"alias_kind":"pith_short_8","alias_value":"Y6L4IPJ5","created_at":"2026-05-18T12:33:33Z"}],"graph_snapshots":[{"event_id":"sha256:39f772345b062344683752df5518b294bd9f334d0754ba5176f0a9cb6c116ec6","target":"graph","created_at":"2026-05-17T23:42:07Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"paper":{"abstract_excerpt":"DNS is a distributed, fault tolerant system that avoids a single point of failure. As such it is an integral part of the internet as we use it today and hence deemed a safe protocol which is let through firewalls and proxies with no or little checks. This can be exploited by malicious agents. Network forensics is effective but struggles due to size of data and manual labour. This paper explores to what extent predictive models can be used to predict network traffic, what protocols are tunneled in the DNS protocol and more specifically whether the predictive performance is enhanced when analyzi","authors_text":"Andreas Berg, Daniel Forsberg","cross_cats":["cs.LG"],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2019-06-26T12:58:57Z","title":"Identifying DNS-tunneled traffic with predictive models"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"1906.11246","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:6c622f2159819f5577e4f28b78b95e479c8d17330fb8b87820d708f86db9960e","target":"record","created_at":"2026-05-17T23:42:07Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"8d08d5305fc85a26d10627ba9720234b17ca3f2014c9e35ca4226278fab07e70","cross_cats_sorted":["cs.LG"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2019-06-26T12:58:57Z","title_canon_sha256":"d5c9981af1a9d8bbc58173955fce369b1a6b2514a76139dd54b70c9f13d6e25e"},"schema_version":"1.0","source":{"id":"1906.11246","kind":"arxiv","version":1}},"canonical_sha256":"c797c43d3d5379f0c0b00f249cd49f7e9ca075d0fc8970f4d50de445952d5a78","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"c797c43d3d5379f0c0b00f249cd49f7e9ca075d0fc8970f4d50de445952d5a78","first_computed_at":"2026-05-17T23:42:07.647905Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-05-17T23:42:07.647905Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"zVEVEMZEowxRDVM3KUj3V37G+lBR7C55qMcKIBfdMX/7GIv/SQYuVOhdGgYf1jNmyszMTm5dOreOfRZguNtSAQ==","signature_status":"signed_v1","signed_at":"2026-05-17T23:42:07.648644Z","signed_message":"canonical_sha256_bytes"},"source_id":"1906.11246","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:6c622f2159819f5577e4f28b78b95e479c8d17330fb8b87820d708f86db9960e","sha256:39f772345b062344683752df5518b294bd9f334d0754ba5176f0a9cb6c116ec6"],"state_sha256":"b33d932ae90101dd5371106614b5300afefd03d006be929b911adb6f15100cc7"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"HEMz+26Y04OvLPwJfNbFWZUKPpjNHWy4lJ4JCGeOVmyQOLEBCBVaARJQ5hDmaem5WA8O+RJ2MYYZvxbsKCbLAA==","signed_message":"bundle_sha256_bytes","signed_at":"2026-06-24T07:50:06.301971Z","bundle_sha256":"9f0b0d67e644f087b2c3a4861949dda52a8b1c9f05640eec13e97c0255987468"}}