{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,9,25]],"date-time":"2026-09-25T08:43:07Z","timestamp":1790325787381,"version":"4.1.0"},"publisher-location":"Cham","reference-count":20,"publisher":"Springer International Publishing","isbn-type":[{"value":"9783319085081","type":"print"},{"value":"9783319085098","type":"electronic"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2014]]},"DOI":"10.1007\/978-3-319-08509-8_3","type":"book-chapter","created":{"date-parts":[[2014,6,13]],"date-time":"2014-06-13T07:04:32Z","timestamp":1402643072000},"page":"41-50","source":"Crossref","is-referenced-by-count":15,"title":["Instruction-Level Steganography for Covert Trigger-Based Malware"],"prefix":"10.1007","author":[{"given":"Dennis","family":"Andriesse","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Herbert","family":"Bos","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"297","reference":[{"key":"3_CR1","unstructured":"CWE-457: Use of Uninitialized Variable. Vulnerability description, \n                    \n                      http:\/\/cwe.mitre.org\/data\/definitions\/457.html"},{"key":"3_CR2","unstructured":"ProFTPD Backdoor (2010), \n                    \n                      http:\/\/www.securityfocus.com\/bid\/45150"},{"key":"3_CR3","unstructured":"Horde Groupware Trojan Horse (2012), \n                    \n                      http:\/\/web.nvd.nist.gov\/view\/vuln\/detail?vulnId=CVE-2012-0209"},{"key":"3_CR4","doi-asserted-by":"crossref","unstructured":"Collberg, C., Thomborson, C., Low, D.: Manufacturing Cheap, Resilient, and Stealthy Opaque Constructs. In: Proceedings of the 25th ACM Symposium on Principles of Programming Languages (PoPL 1998) (1998)","DOI":"10.1145\/268946.268962"},{"key":"3_CR5","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"81","DOI":"10.1007\/11784180_9","volume-title":"Algebraic Methodology and Software Technology","author":"M.D. Preda","year":"2006","unstructured":"Preda, M.D., Madou, M., De Bosschere, K., Giacobazzi, R.: Opaque Predicates Detection by Abstract Interpretation. In: Johnson, M., Vene, V. (eds.) AMAST 2006. LNCS, vol.\u00a04019, pp. 81\u201395. Springer, Heidelberg (2006)"},{"key":"3_CR6","unstructured":"ESET Security. Linux\/SSHDoor: A Backdoored SSH Daemon That Steals Passwords (2013), \n                    \n                      http:\/\/www.welivesecurity.com\/2013\/01\/24\/linux-sshdoor-a-backdoored-ssh-daemon-that-steals-passwords\/"},{"key":"3_CR7","unstructured":"Kaspersky Lab Global Research and Analysis Team. Gauss: Abnormal Distribution, Technical report, Kaspersky Lab (2012)"},{"key":"3_CR8","unstructured":"Lagarias, J.C., Rains, E., Vanderbei, R.J.: The Kruskal Count. In: The Mathematics of Preference, Choice and Order. Springer-Verlag (2009)"},{"key":"3_CR9","unstructured":"Larochelle, D., Evans, D.: Statically Detecting Likely Buffer Overflow Vulnerabilities. In: Proceedings of the 10th USENIX Security Symposium (USENIX Sec 2001) (2001)"},{"key":"3_CR10","doi-asserted-by":"crossref","unstructured":"Linn, C., Debray, S.: Obfuscation of Executable Code to Improve Resistance to Static Disassembly. In: Proceedings of the 10th ACM Conference on Computer and Communications Security (CCS 2003) (2003)","DOI":"10.1145\/948148.948149"},{"key":"3_CR11","doi-asserted-by":"crossref","unstructured":"Moser, A., Kruegel, C., Kirda, E.: Exploring multiple execution paths for malware analysis. In: Proceedings of the 28th IEEE Symposium on Security and Privacy (S&P 2007) (2007)","DOI":"10.1109\/SP.2007.17"},{"key":"3_CR12","doi-asserted-by":"crossref","unstructured":"Roundy, K.A., Miller, B.P.: Binary-Code Obfuscations in Prevalent Packer Tools. ACM Computing Surveys (2012)","DOI":"10.1145\/2522968.2522972"},{"key":"3_CR13","doi-asserted-by":"crossref","unstructured":"Schuster, F., Holz, T.: Towards Reducing the Attack Surface of Software Backdoors. In: Proceedings of the 2013 ACM SIGSAC conference on Computer & Communications Security (CCS 2013) (2013)","DOI":"10.1145\/2508859.2516716"},{"key":"3_CR14","unstructured":"Sharif, M., Lanzi, A., Giffin, J., Lee, W.: Impeding Malware Analysis Using Conditional Code Obfuscation. In: Proceedings of the 16th Network and Distributed System Security Symposium (NDSS 2008) (2008)"},{"key":"3_CR15","doi-asserted-by":"crossref","unstructured":"Sharif, M., Lanzi, A., Giffin, J., Lee, W.: Automatic Reverse Engineering of Malware Emulators. In: Proceedings of the 30th IEEE Symposium on Security and Privacy (S&P 2009) (2009)","DOI":"10.1109\/SP.2009.27"},{"key":"3_CR16","doi-asserted-by":"crossref","unstructured":"Song, C., Royal, P., Lee, W.: Impeding Automated Malware Analysis with Environment-Sensitive Malware. In: the 7th USENIX Workshop on Hot Topics in Security (HotSec 2012) (2012)","DOI":"10.1016\/S1353-4858(12)70109-5"},{"key":"3_CR17","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"86","DOI":"10.1007\/978-3-642-33338-5_5","volume-title":"Research in Attacks, Intrusions, and Defenses","author":"V. Veen van der","year":"2012","unstructured":"van der Veen, V., dutt-Sharma, N., Cavallaro, L., Bos, H.: Memory Errors: The Past, the Present, and the Future. In: Balzarotti, D., Stolfo, S.J., Cova, M. (eds.) RAID 2012. LNCS, vol.\u00a07462, pp. 86\u2013106. Springer, Heidelberg (2012)"},{"key":"3_CR18","unstructured":"Wang, C.: A Security Architecture for Survivability Mechanisms. PhD thesis, University of Virginia (2001)"},{"key":"3_CR19","unstructured":"Wang, T., Lu, K., Lu, L., Chung, S., Lee, W.: Jekyll on iOS: When Benign Apps Become Evil. In: Proceedings of the 22nd USENIX Security Symposium (USENIX Sec 2013) (2013)"},{"key":"3_CR20","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"219","DOI":"10.1007\/978-3-540-74320-0_12","volume-title":"Recent Advances in Intrusion Detection","author":"J. Wilhelm","year":"2007","unstructured":"Wilhelm, J., Chiueh, T.-c.: A Forced Sampled Execution Approach to Kernel Rootkit Identification. In: Kruegel, C., Lippmann, R., Clark, A. (eds.) RAID 2007. LNCS, vol.\u00a04637, pp. 219\u2013235. Springer, Heidelberg (2007)"}],"container-title":["Lecture Notes in Computer Science","Detection of Intrusions and Malware, and Vulnerability Assessment"],"original-title":[],"link":[{"URL":"http:\/\/link.springer.com\/content\/pdf\/10.1007\/978-3-319-08509-8_3","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2019,5,27]],"date-time":"2019-05-27T02:11:38Z","timestamp":1558923098000},"score":1,"resource":{"primary":{"URL":"http:\/\/link.springer.com\/10.1007\/978-3-319-08509-8_3"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2014]]},"ISBN":["9783319085081","9783319085098"],"references-count":20,"URL":"https:\/\/doi.org\/10.1007\/978-3-319-08509-8_3","relation":{},"ISSN":["0302-9743","1611-3349"],"issn-type":[{"value":"0302-9743","type":"print"},{"value":"1611-3349","type":"electronic"}],"subject":[],"published":{"date-parts":[[2014]]}}}