{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,9,25]],"date-time":"2026-09-25T08:42:30Z","timestamp":1790325750511,"version":"4.1.0"},"publisher-location":"Berlin, Heidelberg","reference-count":23,"publisher":"Springer Berlin Heidelberg","isbn-type":[{"value":"9783540354581","type":"print"},{"value":"9783540354598","type":"electronic"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2006]]},"DOI":"10.1007\/11780656_14","type":"book-chapter","created":{"date-parts":[[2006,6,23]],"date-time":"2006-06-23T10:08:16Z","timestamp":1151057296000},"page":"159-170","source":"Crossref","is-referenced-by-count":18,"title":["API Monitoring System for Defeating Worms and Exploits in MS-Windows System"],"prefix":"10.1007","author":[{"given":"Hung-Min","family":"Sun","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Yue-Hsun","family":"Lin","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Ming-Fung","family":"Wu","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"297","reference":[{"key":"14_CR1","unstructured":"Anton, B.: \u201c Process-wide API spying - an ultimate hack\u201d, CodeProject website (February 2005), Available: http:\/\/www.codeproject.com\/system\/api_spying_hack.asp"},{"key":"14_CR2","unstructured":"Anton, B.: Kernel-mode API spying - an ultimate hack, CodeProject website (February 2005), Available: http:\/\/www.codeproject.com\/system\/kernelspying.asp"},{"key":"14_CR3","unstructured":"Michel, B.: Introduction to Shellcoding - How to exploit buffer overflows, Tigerteam\u2019s website (2004), Available: http:\/\/tigerteam.se\/dl\/papers\/intro_to_shellcoding.pdf"},{"key":"14_CR4","doi-asserted-by":"crossref","unstructured":"Jesse, C., Rabek, R., Khazan, I., Scott, M., Robert, L., Cunningham, K.: Detection of Injected, Dynamically Generated, and Obfuscated Malicious Code. In: Proc. of 2003 ACM workshop on Rapid Malcode (October 2003)","DOI":"10.1145\/948187.948201"},{"issue":"4","key":"14_CR5","doi-asserted-by":"publisher","first-page":"46","DOI":"10.1109\/MSP.2004.59","volume":"2","author":"C. Shannon","year":"2004","unstructured":"Shannon, C., Moore, D.: The spread of the Witty worm. Security & Privacy Magazine\u00a02(4), 46\u201350 (2004)","journal-title":"Security & Privacy Magazine"},{"key":"14_CR6","doi-asserted-by":"publisher","first-page":"281","DOI":"10.1145\/948109.948147","volume-title":"Proc. of 10th ACM Conf. Comp. and Comm. Sec.\u2014CCS 2003","author":"E.G. Barrantes","year":"2003","unstructured":"Barrantes, E.G., Ackley, D.H., Palmer, T.S., Stefanovic, D., Zovi, D.D.: Randomized instruction set emulation to disrupt binary code injection attacks. In: Proc. of 10th ACM Conf. Comp. and Comm. Sec.\u2014CCS 2003, pp. 281\u2013289. ACM Press, New York (2003)"},{"issue":"2","key":"14_CR7","doi-asserted-by":"publisher","first-page":"63","DOI":"10.1109\/MSP.2005.57","volume":"3","author":"E. Levy","year":"2005","unstructured":"Levy, E.: Worm propagation and generic attacks. Security & Privacy Magazine\u00a03(2), 63\u201365 (2005)","journal-title":"Security & Privacy Magazine"},{"key":"14_CR8","unstructured":"Hunt, G., Brubacher, D.: Detours: Binary Interception of Win32 Functions, Microsoft corp. research website (1999), Available: ftp:\/\/ftp.research.microsoft.com\/pub\/tr\/tr-98-33.pdf"},{"key":"14_CR9","unstructured":"Ivo, I.: API hooking revealed, CodeProject website (February 2005), Available: http:\/\/www.codeproject.com\/system\/hooksys.asp"},{"key":"14_CR10","unstructured":"Richter, J.: Programming Applications for Microsoft Windows, 4th edn. (2001)"},{"issue":"5","key":"14_CR11","doi-asserted-by":"publisher","first-page":"32","DOI":"10.1109\/MSPEC.2005.1426967","volume":"42","author":"J. Riordan","year":"2005","unstructured":"Riordan, J., Wespi, A., Zamboni, D.: How To Hook Worms. Spectrum\u00a042(5), 32\u201336 (2005)","journal-title":"Spectrum"},{"issue":"4","key":"14_CR12","doi-asserted-by":"publisher","first-page":"20","DOI":"10.1109\/MSP.2004.36","volume":"2","author":"J. Pincus","year":"2004","unstructured":"Pincus, J., Baker, R.: Beyond stack smashing: recent advances in exploiting buffer over runs. Security & Privacy Magazine\u00a02(4), 20\u201327 (2004)","journal-title":"Security & Privacy Magazine"},{"key":"14_CR13","unstructured":"Pietrek, M.: Inside Windows: An In-Depth Look into the Win32 Portable Executable File Format. MSDN Website (2002), Available: http:\/\/www.msdn.microsoft.co"},{"key":"14_CR14","unstructured":"Sachin, R.S.: Need for Rebasing a DLL. Code Project website (March 2005), Available: http:\/\/www.codeproject.com\/dll\/RebaseDll.asp"},{"key":"14_CR15","unstructured":"Sachin, R.S.: Need for Binding an Executable to DLLs. Code Project website (March 2005), Available: http:\/\/www.thecodeproject.com\/dll\/NeedBind.asp"},{"key":"14_CR16","doi-asserted-by":"crossref","unstructured":"Payer, U., Teufl, P., Lamberger, M.: Hybrid Engine for Polymorphic Shellcode Detection. In: Second Int. Conf. of 2005 Intrusion and Malware Detection and Vulnerability Assessment (July 2005)","DOI":"10.1007\/11506881_2"},{"key":"14_CR17","unstructured":"Kaplan, Y.: API Spying Techniques for Windows 9x, NT and 2000. From website of teaching API Hooking and Monitoring (June 2004), Available: http:\/\/www.internals.com\/articles\/apispy\/apispy.htm"},{"key":"14_CR18","unstructured":"The MetaSploit Project, ShellCode Archive, MetaSploit Project official website (November 2004), Available: http:\/\/www.metasploit.com\/ShellCode.html"},{"key":"14_CR19","unstructured":"Microsoft Corp., A detailed description of the Data Execution Prevention (DEP) feature in Windows XP Service Pack 2 and Windows XP Tablet PC Edition 2005, Microsoft Corp\u2019s support website (February 2005), Available: http:\/\/support.microsoft.com\/kb\/875352\/en-us"},{"key":"14_CR20","unstructured":"The NTInternals. net team, Undocumented Functions for Microsoft Windows NT\/2000, NTInternals. net website (November 28, 2004), Available: http:\/\/undocumented.ntinternals.net"},{"key":"14_CR21","unstructured":"Phrack Inc., History and Advances in Windows ShellCode. In Phrack Magazine (November 2004), Available: http:\/\/www.phrack.org\/phrack\/62\/p62-0x07_Advances_in_Windows_ShellCode.tx"},{"key":"14_CR22","unstructured":"Smiler, The Art of Writing ShellCode, FreeGnu\u2019s personal blog (June 2004), Available: http:\/\/blog.codelphi.com\/freegnu\/archive\/2004\/11\/25\/29682.aspx"},{"key":"14_CR23","unstructured":"The ShellCode. org, The ShellCode Writing, ShellCode. org website. (November 2004), Available: http:\/\/ShellCode.org\/"}],"container-title":["Lecture Notes in Computer Science","Information Security and Privacy"],"original-title":[],"link":[{"URL":"http:\/\/link.springer.com\/content\/pdf\/10.1007\/11780656_14.pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2021,4,27]],"date-time":"2021-04-27T03:16:54Z","timestamp":1619493414000},"score":1,"resource":{"primary":{"URL":"http:\/\/link.springer.com\/10.1007\/11780656_14"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2006]]},"ISBN":["9783540354581","9783540354598"],"references-count":23,"URL":"https:\/\/doi.org\/10.1007\/11780656_14","relation":{},"ISSN":["0302-9743","1611-3349"],"issn-type":[{"value":"0302-9743","type":"print"},{"value":"1611-3349","type":"electronic"}],"subject":[],"published":{"date-parts":[[2006]]}}}