{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,17]],"date-time":"2026-03-17T15:29:28Z","timestamp":1773761368243,"version":"3.50.1"},"publisher-location":"Berlin, Heidelberg","reference-count":20,"publisher":"Springer Berlin Heidelberg","isbn-type":[{"value":"9783540317784","type":"print"},{"value":"9783540317791","type":"electronic"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2006]]},"DOI":"10.1007\/11663812_12","type":"book-chapter","created":{"date-parts":[[2006,1,20]],"date-time":"2006-01-20T07:57:08Z","timestamp":1137743828000},"page":"227-246","source":"Crossref","is-referenced-by-count":88,"title":["Anomalous Payload-Based Worm Detection and Signature Generation"],"prefix":"10.1007","author":[{"given":"Ke","family":"Wang","sequence":"first","affiliation":[]},{"given":"Gabriela","family":"Cretu","sequence":"additional","affiliation":[]},{"given":"Salvatore J.","family":"Stolfo","sequence":"additional","affiliation":[]}],"member":"297","reference":[{"key":"12_CR1","unstructured":"Bhatkar, S., DuVarney, D.C., Sekar, R.: Address Obfuscation: an Efficient Approach to Combat a Broad Range of Memory Error Exploits. In: 12th USENIX Security Symposium (2003)"},{"issue":"5199","key":"12_CR2","doi-asserted-by":"publisher","first-page":"843","DOI":"10.1126\/science.267.5199.843","volume":"267","author":"M. Damashek","year":"1995","unstructured":"Damashek, M.: Gauging similarity with n-grams: language independent categorization of text. Science\u00a0267(5199), 843\u2013848 (1995)","journal-title":"Science"},{"key":"12_CR3","doi-asserted-by":"publisher","DOI":"10.1017\/CBO9780511574931","volume-title":"Algorithms on Strings, Trees and Sequences","author":"D. Gusfield","year":"1997","unstructured":"Gusfield, D.: Algorithms on Strings, Trees and Sequences. Cambridge University Press, Cambridge (1997)"},{"key":"12_CR4","doi-asserted-by":"crossref","unstructured":"Kephart, J.O., Arnold, W.C.: Automatic extraction of computer virus signatures. In: Processing of the 4th International Virus Bulletin Conference (September 1994)","DOI":"10.1016\/0142-0496(94)90045-0"},{"key":"12_CR5","unstructured":"Kim, K.-A., Karp, B.: Autograph: Toward Automated Distributed Worm Distribution. In: Proceedings of the USENIX Security Symposium (August 2004)"},{"key":"12_CR6","unstructured":"Kolesnikov, O., Lee, W.: Advanced Polymorphic Worms: Evading IDS by Blending in with Normal Traffic, Tech Report, GIT-CC-05-09 (2005)"},{"key":"12_CR7","unstructured":"Kreibich, C., Crowcroft, J.: Honeycomb-Creating Intrusion Detection Signatures Using Honeypots. In: Proceedings of the 2nd Workshop on Hot Topics in Networks (HotNets-II) (November 2003)"},{"key":"12_CR8","unstructured":"Li, W., Wang, K., Stolfo, S., Herzog, B.: Fileprints: Identifying File Types by N-gram Analysis. In: The Proceedings of the 2005 IEEE Workshop on Information Assurance and Security (June 2005)"},{"issue":"4","key":"12_CR9","doi-asserted-by":"publisher","first-page":"579","DOI":"10.1016\/S1389-1286(00)00139-0","volume":"34","author":"R. Lippmann","year":"2000","unstructured":"Lippmann, R., et al.: The 1999 DARPA Off-Line Intrusion Detection Evaluation. Computer Networks\u00a034(4), 579\u2013595 (2000)","journal-title":"Computer Networks"},{"key":"12_CR10","unstructured":"Locasto, M., Parekh, J., Stolfo, S., Keromytis, A., Malkin, T., Misra, V.: Collaborative Distributed Intrusion Detection, Columbia University Tech Report CUCS-012-04 (2004)"},{"key":"12_CR11","unstructured":"Moore, D., Paxson, V., Savage, S., Shannon, C., Staniford, S., Weaver, N.: The Spread of the Sapphire\/Slammer Worm, http:\/\/www.cs.berkeley.edu\/~nweaver\/sapphire\/"},{"key":"12_CR12","doi-asserted-by":"crossref","unstructured":"Moore, D., Shannon, C.: Code-Red: A Case Study on the Spread and Victims of an Internet Worm. In: Proceeding of the 2002 ACM SIGCOMM Internet Measurement Workshop (IMW 2002) (November 2002)","DOI":"10.1145\/637201.637244"},{"key":"12_CR13","unstructured":"Moore, D., Shannon, C., Voelker, G., Savage, S.: Internet Quarantine: Requirements for Containing Self-Propagating Code. In: IEEE Proceedings of the INFOCOM (April 2003)"},{"key":"12_CR14","doi-asserted-by":"crossref","unstructured":"Sidiroglou, S., Keromytis, A.D.: Countering Network Worms through Automatic Patch Generation. To appear in IEEE Security and Privacy 2005 (2005)","DOI":"10.1109\/MSP.2005.144"},{"key":"12_CR15","unstructured":"Singh, S., Estan, C., Varghese, G., Savage, S.: Automated Worm Fingerprinting. In: Sixth Symposium on Operating Systems Design and Implementation, OSDI (2004)"},{"key":"12_CR16","unstructured":"Staniford, S., Paxson, V., Weaver, N.: How to Own the Internet in Your Spare Time. In: Proceedings of the USENIX Security Symposium (August 2002)"},{"key":"12_CR17","unstructured":"Stolfo, S.: Collaborative Security, The Black Book on Corporate Security, ch 9. Larstan Publishing (2005)"},{"key":"12_CR18","unstructured":"Yegneswaran, V., Barford, P., Jha, S.: Global Intrusion Detection in the DOMINO Overlay System. In: Proceedings of Network and Distributed System Security Symposium (NDSS) (February 2004)"},{"key":"12_CR19","doi-asserted-by":"crossref","unstructured":"Wang, H.J., Guo, C., Simon, D.R., Zugenmaier, A.: Shield: Vulnerability-Driven Network Filter for Preventing Known Vulnerability Exploits. In: Proceedings of the ACM SIGCOMM Conference (August 2004)","DOI":"10.1145\/1015467.1015489"},{"key":"12_CR20","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"203","DOI":"10.1007\/978-3-540-30143-1_11","volume-title":"Recent Advances in Intrusion Detection","author":"K. Wang","year":"2004","unstructured":"Wang, K., Stolfo, S.: Anomalous payload-based network intrusion detection. In: Jonsson, E., Valdes, A., Almgren, M. (eds.) RAID 2004. LNCS, vol.\u00a03224, pp. 203\u2013222. Springer, Heidelberg (2004)"}],"container-title":["Lecture Notes in Computer Science","Recent Advances in Intrusion Detection"],"original-title":[],"link":[{"URL":"http:\/\/link.springer.com\/content\/pdf\/10.1007\/11663812_12.pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2020,11,17]],"date-time":"2020-11-17T15:04:26Z","timestamp":1605625466000},"score":1,"resource":{"primary":{"URL":"http:\/\/link.springer.com\/10.1007\/11663812_12"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2006]]},"ISBN":["9783540317784","9783540317791"],"references-count":20,"URL":"https:\/\/doi.org\/10.1007\/11663812_12","relation":{},"ISSN":["0302-9743","1611-3349"],"issn-type":[{"value":"0302-9743","type":"print"},{"value":"1611-3349","type":"electronic"}],"subject":[],"published":{"date-parts":[[2006]]}}}