{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,22]],"date-time":"2026-04-22T20:02:47Z","timestamp":1776888167864,"version":"3.51.2"},"publisher-location":"Berlin, Heidelberg","reference-count":28,"publisher":"Springer Berlin Heidelberg","isbn-type":[{"value":"9783540317784","type":"print"},{"value":"9783540317791","type":"electronic"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2006]]},"DOI":"10.1007\/11663812_11","type":"book-chapter","created":{"date-parts":[[2006,1,20]],"date-time":"2006-01-20T12:57:08Z","timestamp":1137761828000},"page":"207-226","source":"Crossref","is-referenced-by-count":160,"title":["Polymorphic Worm Detection Using Structural Information of Executables"],"prefix":"10.1007","author":[{"given":"Christopher","family":"Kruegel","sequence":"first","affiliation":[]},{"given":"Engin","family":"Kirda","sequence":"additional","affiliation":[]},{"given":"Darren","family":"Mutz","sequence":"additional","affiliation":[]},{"given":"William","family":"Robertson","sequence":"additional","affiliation":[]},{"given":"Giovanni","family":"Vigna","sequence":"additional","affiliation":[]}],"member":"297","reference":[{"key":"11_CR1","doi-asserted-by":"crossref","unstructured":"Babai, L., Luks, E.: Canonical Labeling of Graphs. In: 15th ACM Symposium on Theory of Computing (1983)","DOI":"10.1145\/800061.808746"},{"key":"11_CR2","unstructured":"Bailey, M., Cooke, E., Jahanian, F., Nazario, J., Watson, D.: The Internet Motion Sensor: A Distributed Blackhole Monitoring System. In: Network and Distributed Systems Symposium, NDSS (2005)"},{"key":"11_CR3","doi-asserted-by":"crossref","unstructured":"Berk, V., Gray, R., Bakos, G.: Using Sensor Networks and Data Fusion for Early Detection. In: SPIE Aerosense Conference (2003)","DOI":"10.1117\/12.500849"},{"key":"11_CR4","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"39","DOI":"10.1007\/978-3-540-30143-1_3","volume-title":"Recent Advances in Intrusion Detection","author":"D. Dagon","year":"2004","unstructured":"Dagon, D., Qin, X., Gu, G., Lee, W., Grizzard, J., Levin, J.: HoneyStat: Local Worm Detection Using Honeypots. In: Jonsson, E., Valdes, A., Almgren, M. (eds.) RAID 2004. LNCS, vol.\u00a03224, pp. 39\u201358. Springer, Heidelberg (2004)"},{"key":"11_CR5","unstructured":"DeTristan, T., Ulenspiegel, T., Malcom, Y., von Underduk, M.: Polymorphic Shellcode Engine Using Spectrum Analysis, http:\/\/www.phrack.org\/show.php?p=61&a=9"},{"key":"11_CR6","unstructured":"Kim, H.-A., Karp, B.: Autograph: Toward Automated, Distributed Worm Signature Detection. In: 13th Usenix Security Symposium (2004)"},{"key":"11_CR7","unstructured":"Kolesnikov, O., Lee, W.: Advanced Polymorphic Worms: Evading IDS by Blending in with Normal Traffic. Technical report, Georgia Tech. (2004)"},{"key":"11_CR8","unstructured":"Kreibich, C., Crowcroft, J.: Honeycomb - Creating Intrusion Detection Signatures Using Honeypots. In: 2nd Workshop on Hot Topics in Networks (2003)"},{"key":"11_CR9","unstructured":"Kruegel, C., Valeur, F., Robertson, W., Vigna, G.: Static Analysis of Obfuscated Binaries. In: 13th Usenix Security Symposium (2004)"},{"key":"11_CR10","doi-asserted-by":"crossref","unstructured":"Linn, C., Debray, S.: Obfuscation of Executable Code to Improve Resistance to Static Disassembly. In: ACM Conference on Computer and Communications Security, CCS (2003)","DOI":"10.1145\/948109.948149"},{"key":"11_CR11","unstructured":"Macaulay, S.: ADMmutate: Polymorphic Shellcode Engine, http:\/\/www.ktwo.ca\/ttsecurity.html"},{"key":"11_CR12","unstructured":"McKay, B.: Nauty: No AUTomorphisms, Yes?, http:\/\/cs.anu.edu.au\/~bdm\/nauty\/"},{"key":"11_CR13","unstructured":"McKay, B.: Practical graph isomorphism. Congressus Numerantium\u00a030 (1981)"},{"key":"11_CR14","unstructured":"Moore, D., Shannon, C., Voelker, G., Savage, S.: Internet Quarantine: Requirements for Containing Self-Propagating Code. In: IEEE Infocom Conference (2003)"},{"key":"11_CR15","doi-asserted-by":"crossref","unstructured":"Newsome, J., Karp, B., Song, D.: Polygraph: Automatically Generating Signatures for Polymorphic Worms. In: IEEE Symposium on Security and Privacy (2005)","DOI":"10.1109\/SP.2005.15"},{"key":"11_CR16","unstructured":"Paxson, V.: Bro: A System for Detecting Network Intruders in Real-Time. In: 7th Usenix Security Symposium (1998)"},{"key":"11_CR17","unstructured":"Rabin, M.O.: Fingerprinting by Random Polynomials. Technical report, Center for Research in Computing Techonology, Harvard University (1981)"},{"key":"11_CR18","unstructured":"Roesch, M.: Snort - Lightweight Intrusion Detection for Networks. In: Usenix LISA Conference (1999)"},{"key":"11_CR19","unstructured":"Singh, S., Estan, C., Varghese, G., Savage, S.: Automated Worm Fingerprinting. In: 6th Symposium on Operating System Design and Implementation, OSDI (2004)"},{"key":"11_CR20","volume-title":"Implementing Discrete Mathematics: Combinatorics and Graph Theory","author":"S. Skiena","year":"1990","unstructured":"Skiena, S.: Graph Isomorphism. In: Implementing Discrete Mathematics: Combinatorics and Graph Theory. Addison-Wesley, Reading (1990)"},{"key":"11_CR21","unstructured":"Sophos. War of the Worms: Top 10 list of worst virus outbreaks in 2004 (2004), http:\/\/www.sophos.com\/pressoffice\/pressrel\/uk\/20041208yeartopten.html"},{"key":"11_CR22","doi-asserted-by":"crossref","unstructured":"Staniford, S., Moore, D., Paxson, V., Weaver, N.: The Top Speed of Flash Worms. In: 2nd ACM Workshop on Rapid Malcode, WORM (2004)","DOI":"10.1145\/1029618.1029624"},{"key":"11_CR23","unstructured":"Staniford, S., Paxson, V., Weaver, N.: How to 0wn the Internet in Your Spare Time. In: 11th Usenix Security Symposium (2002)"},{"key":"11_CR24","doi-asserted-by":"crossref","unstructured":"Venkataraman, S., Song, D., Gibbons, P., Blum, A.: New Streaming Algorithms for Fast Detection of Superspreaders. In: Network and Distributed Systems Symposium, NDSS (2005)","DOI":"10.21236\/ADA461026"},{"key":"11_CR25","doi-asserted-by":"crossref","unstructured":"Weaver, N., Paxson, V., Staniford, S., Cunningham, R.: A Taxonomy of Computer Worms. In: ACM Workshop on Rapid Malcode (October 2003)","DOI":"10.1145\/948187.948190"},{"key":"11_CR26","unstructured":"Weaver, N., Staniford, S., Paxson, V.: Very Fast Containment of Scanning Worms. In: 13th Usenix Security Symposium (2004)"},{"key":"11_CR27","unstructured":"Whyte, D., Kranakis, E., van Oorschot, P.: DNS-based Detection of Scanning Worms in an Enterprise Network. In: Network and Distributed Systems Symposium, NDSS (2005)"},{"key":"11_CR28","unstructured":"Williamson, M.: Throttling Viruses: Restricting Propagation to Defeat Malicious Mobile Code. In: 18th Annual Computer Security Applications Conference, ACSAC (2002)"}],"container-title":["Lecture Notes in Computer Science","Recent Advances in Intrusion Detection"],"original-title":[],"link":[{"URL":"http:\/\/link.springer.com\/content\/pdf\/10.1007\/11663812_11.pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2020,11,17]],"date-time":"2020-11-17T20:04:26Z","timestamp":1605643466000},"score":1,"resource":{"primary":{"URL":"http:\/\/link.springer.com\/10.1007\/11663812_11"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2006]]},"ISBN":["9783540317784","9783540317791"],"references-count":28,"URL":"https:\/\/doi.org\/10.1007\/11663812_11","relation":{},"ISSN":["0302-9743","1611-3349"],"issn-type":[{"value":"0302-9743","type":"print"},{"value":"1611-3349","type":"electronic"}],"subject":[],"published":{"date-parts":[[2006]]}}}