{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,5,18]],"date-time":"2026-05-18T18:00:47Z","timestamp":1779127247565,"version":"3.51.4"},"publisher-location":"Cham","reference-count":43,"publisher":"Springer International Publishing","isbn-type":[{"value":"9783319519654","type":"print"},{"value":"9783319519661","type":"electronic"}],"license":[{"start":{"date-parts":[[2016,12,29]],"date-time":"2016-12-29T00:00:00Z","timestamp":1482969600000},"content-version":"unspecified","delay-in-days":0,"URL":"http:\/\/www.springer.com\/tdm"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2017]]},"DOI":"10.1007\/978-3-319-51966-1_17","type":"book-chapter","created":{"date-parts":[[2016,12,28]],"date-time":"2016-12-28T11:11:08Z","timestamp":1482923468000},"page":"256-272","source":"Crossref","is-referenced-by-count":21,"title":["On the Feasibility of Malware Authorship Attribution"],"prefix":"10.1007","author":[{"given":"Saed","family":"Alrabaee","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Paria","family":"Shirani","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Mourad","family":"Debbabi","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Lingyu","family":"Wang","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"297","published-online":{"date-parts":[[2016,12,29]]},"reference":[{"key":"17_CR1","unstructured":"Refactoring tool. https:\/\/www.devexpress.com\/Products\/CodeRush\/"},{"key":"17_CR2","unstructured":"The Google Code Jam (2008\u20132015). http:\/\/code.google.com\/codejam\/"},{"key":"17_CR3","unstructured":"GitHub-Build software better (2011). https:\/\/github.com\/trending\/cpp"},{"key":"17_CR4","unstructured":"IDA pro Fast Library Identification and Recognition Technology (2011). https:\/\/www.hex-rays.com\/products\/ida\/tech\/"},{"key":"17_CR5","unstructured":"The materials supplement for the paper: Who Wrote This Code? Identifying the Authors of Program Binaries (2011). http:\/\/pages.cs.wisc.edu\/~nater\/esorics-supp\/"},{"key":"17_CR6","unstructured":"Hex-Ray decompiler (2015). https:\/\/www.hex-rays.com\/products\/decompiler\/"},{"key":"17_CR7","unstructured":"Microsoft Malware Classification Challenge (BIG 2015) (2015). https:\/\/www.kaggle.com\/c\/malware-classification\/data"},{"key":"17_CR8","unstructured":"Programmer De-anonymization from Binary Executables (2015). https:\/\/github.com\/calaylin\/bda"},{"key":"17_CR9","unstructured":"The Gephi plugin for nneo4j (2015). https:\/\/marketplace.gephi.org\/plugin\/neo4j-graph-database-support\/"},{"key":"17_CR10","unstructured":"The Scalable Native Graph Database (2015). http:\/\/neo4j.com\/"},{"key":"17_CR11","unstructured":"C++ refactoring tools for visual studio (2016). http:\/\/www.wholetomato.com\/"},{"key":"17_CR12","unstructured":"Aiken, A., et al.: Moss: a system for detecting software plagiarism. University of California\u2013Berkeley (2005). www.cs.berkeley.edu\/aiken\/moss.html 9"},{"key":"17_CR13","doi-asserted-by":"crossref","first-page":"S94","DOI":"10.1016\/j.diin.2014.03.012","volume":"11","author":"S Alrabaee","year":"2014","unstructured":"Alrabaee, S., Saleem, N., Preda, S., Wang, L., Debbabi, M.: Oba2: an onion approach to binary code authorship attribution. Digit. Invest. 11, S94\u2013S103 (2014)","journal-title":"Digit. Invest."},{"key":"17_CR14","doi-asserted-by":"crossref","first-page":"S61","DOI":"10.1016\/j.diin.2015.01.011","volume":"12","author":"S Alrabaee","year":"2015","unstructured":"Alrabaee, S., Shirani, P., Wang, L., Debbabi, M.: Sigma: a semantic integrated graph matching approach for identifying reused functions in binary code. Digit. Invest. 12, S61\u2013S71 (2015)","journal-title":"Digit. Invest."},{"key":"17_CR15","doi-asserted-by":"crossref","first-page":"S11","DOI":"10.1016\/j.diin.2016.04.002","volume":"18","author":"S Alrabaee","year":"2016","unstructured":"Alrabaee, S., Wang, L., Debbabi, M.: Bingold: towards robust binary analysis by extracting the semantics of binary code as semantic flow graphs (sfgs). Digit. Invest. 18, S11\u2013S22 (2016)","journal-title":"Digit. Invest."},{"key":"17_CR16","unstructured":"Burrows, S., Tahaghoghi, S.M.: Source code authorship attribution using n-grams. Citeseer (2007)"},{"key":"17_CR17","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"699","DOI":"10.1007\/978-3-642-00887-0_61","volume-title":"Database Systems for Advanced Applications","author":"S Burrows","year":"2009","unstructured":"Burrows, S., Uitdenbogerd, A.L., Turpin, A.: Application of information retrieval techniques for source code authorship attribution. In: Zhou, X., Yokota, H., Deng, K., Liu, Q. (eds.) DASFAA 2009. LNCS, vol. 5463, pp. 699\u2013713. Springer, Heidelberg (2009). doi: 10.1007\/978-3-642-00887-0_61"},{"key":"17_CR18","unstructured":"Caliskan-Islam, A., Harang, R., Liu, A., Narayanan, A., Voss, C., Yamaguchi, F., Greenstadt, R.: De-anonymizing programmers via code stylometry. In: 24th USENIX Security Symposium (USENIX Security 2015) , pp. 255\u2013270 (2015)"},{"key":"17_CR19","unstructured":"Caliskan-Islam, A., Yamaguchi, F., Dauber, E., Harang, R., Rieck, K., Greenstadt, R., Narayanan, A.: When coding style survives compilation: de-anonymizing programmers from executable binaries. arXiv preprint arXiv:1512.08546 (2015)"},{"issue":"1","key":"17_CR20","doi-asserted-by":"crossref","first-page":"61","DOI":"10.1023\/B:CHUM.0000009225.28847.77","volume":"38","author":"F Can","year":"2004","unstructured":"Can, F., Patton, J.M.: Change of writing style with time. Comput. Humanit. 38(1), 61\u201382 (2004)","journal-title":"Comput. Humanit."},{"key":"17_CR21","doi-asserted-by":"crossref","unstructured":"Canali, D., Lanzi, A., Balzarotti, D., Kruegel, C., Christodorescu, M., Kirda, E.: A quantitative study of accuracy in system call-based malware detection. In: Proceedings of the 2012 International Symposium on Software Testing and Analysis, pp. 122\u2013132. ACM (2012)","DOI":"10.1145\/2338965.2336768"},{"key":"17_CR22","doi-asserted-by":"crossref","unstructured":"Chen, R., Hong, L., L\u00fc, C., Deng, W.: Author identification of software source code with program dependence graphs. In: 2010 IEEE 34th Annual Computer Software and Applications Conference Workshops (COMPSACW), pp. 281\u2013286. IEEE (2010)","DOI":"10.1109\/COMPSACW.2010.56"},{"key":"17_CR23","doi-asserted-by":"crossref","unstructured":"Edwards, N., Chen, L.: An historical examination of open source releases and their vulnerabilities. In: Proceedings of the 2012 ACM Conference on Computer and Communications Security, pp. 183\u2013194. ACM (2012)","DOI":"10.1145\/2382196.2382218"},{"issue":"3","key":"17_CR24","doi-asserted-by":"crossref","first-page":"319","DOI":"10.1145\/24039.24041","volume":"9","author":"J Ferrante","year":"1987","unstructured":"Ferrante, J., Ottenstein, K.J., Warren, J.D.: The program dependence graph and its use in optimization. ACM Trans. Program. Lang. Syst. (TOPLAS) 9(3), 319\u2013349 (1987)","journal-title":"ACM Trans. Program. Lang. Syst. (TOPLAS)"},{"key":"17_CR25","volume-title":"Refactoring: Improving the Design of Existing Code","author":"M Fowler","year":"2009","unstructured":"Fowler, M.: Refactoring: Improving the Design of Existing Code. Pearson Education India, New Delhi (2009)"},{"key":"17_CR26","series-title":"IFIP International Federation for Information Processing","doi-asserted-by":"publisher","first-page":"508","DOI":"10.1007\/0-387-34224-9_59","volume-title":"Artificial Intelligence Applications and Innovations","author":"G Frantzeskou","year":"2006","unstructured":"Frantzeskou, G., Stamatatos, E., Gritzalis, S., Katsikas, S.: Source code author identification based on n-gram author profiles. In: Maglogiannis, I., Karpouzis, K., Bramer, M. (eds.) AIAI 2006. IIFIP, vol. 204, pp. 508\u2013515. Springer, Heidelberg (2006). doi: 10.1007\/0-387-34224-9_59"},{"issue":"2","key":"17_CR27","doi-asserted-by":"crossref","first-page":"87","DOI":"10.1007\/BF01830689","volume":"28","author":"DI Holmes","year":"1994","unstructured":"Holmes, D.I.: Authorship attribution. Comput. Humanit. 28(2), 87\u2013106 (1994)","journal-title":"Comput. Humanit."},{"key":"17_CR28","doi-asserted-by":"crossref","unstructured":"Jang, J., Brumley, D., Venkataraman, S.: Bitshred: feature hashing malware for scalable triage and semantic analysis. In: Proceedings of the 18th ACM Conference on Computer and Communications Security, pp. 309\u2013320. ACM (2011)","DOI":"10.1145\/2046707.2046742"},{"key":"17_CR29","doi-asserted-by":"crossref","unstructured":"Junod, P., Rinaldini, J., Wehrli, J., Michielin, J.: Obfuscator-llvm: software protection for the masses. In: Proceedings of the 1st International Workshop on Software Protection, pp. 3\u20139. IEEE Press (2015)","DOI":"10.1109\/SPRO.2015.10"},{"key":"17_CR30","doi-asserted-by":"crossref","unstructured":"Kephart, J.O., et al.: A biologically inspired immune system for computers. In: Artificial Life IV: Proceedings of the Fourth International Workshop on the Synthesis and Simulation of Living Systems, pp. 130\u2013139 (1994)","DOI":"10.7551\/mitpress\/1428.003.0017"},{"key":"17_CR31","doi-asserted-by":"crossref","unstructured":"Khoo, W.M., Mycroft, A., Anderson, R.: Rendezvous: a search engine for binary code. In: Proceedings of the 10th Working Conference on Mining Software Repositories, pp. 329\u2013338. IEEE Press (2013)","DOI":"10.1109\/MSR.2013.6624046"},{"issue":"12","key":"17_CR32","doi-asserted-by":"crossref","first-page":"735","DOI":"10.1145\/355588.365140","volume":"7","author":"DE Knuth","year":"1964","unstructured":"Knuth, D.E.: Backus normal form vs. backus naur form. Commun. ACM 7(12), 735\u2013736 (1964)","journal-title":"Commun. ACM"},{"key":"17_CR33","doi-asserted-by":"crossref","unstructured":"Kothari, J., Shevertalov, M., Stehle, E., Mancoridis, S.: A probabilistic approach to source code authorship identification. In: Fourth International Conference on Information Technology, ITNG 2007, pp. 243\u2013248. IEEE (2007)","DOI":"10.1109\/ITNG.2007.17"},{"issue":"3","key":"17_CR34","doi-asserted-by":"crossref","first-page":"233","DOI":"10.1016\/S0167-4048(97)00005-9","volume":"16","author":"I Krsul","year":"1997","unstructured":"Krsul, I., Spafford, E.H.: Authorship analysis: identifying the author of a program. Comput. Secur. 16(3), 233\u2013257 (1997)","journal-title":"Comput. Secur."},{"key":"17_CR35","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"207","DOI":"10.1007\/11663812_11","volume-title":"Recent Advances in Intrusion Detection","author":"C Kruegel","year":"2006","unstructured":"Kruegel, C., Kirda, E., Mutz, D., Robertson, W., Vigna, G.: Polymorphic worm detection using structural information of executables. In: Valdes, A., Zamboni, D. (eds.) RAID 2005. LNCS, vol. 3858, pp. 207\u2013226. Springer, Heidelberg (2006). doi: 10.1007\/11663812_11"},{"issue":"18","key":"17_CR36","doi-asserted-by":"crossref","first-page":"3508","DOI":"10.1093\/bioinformatics\/bth436","volume":"20","author":"N Pr\u017eulj","year":"2004","unstructured":"Pr\u017eulj, N., Corneil, D.G., Jurisica, I.: Modeling interactome: scale-free or geometric? Bioinformatics 20(18), 3508\u20133515 (2004)","journal-title":"Bioinformatics"},{"key":"17_CR37","doi-asserted-by":"crossref","first-page":"S146","DOI":"10.1016\/j.diin.2015.05.015","volume":"14","author":"A Rahimian","year":"2015","unstructured":"Rahimian, A., Shirani, P., Alrbaee, S., Wang, L., Debbabi, M.: Bincomp: a stratified approach to compiler provenance attribution. Digit. Invest. 14, S146\u2013S155 (2015)","journal-title":"Digit. Invest."},{"key":"17_CR38","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"172","DOI":"10.1007\/978-3-642-23822-2_10","volume-title":"Computer Security \u2013 ESORICS 2011","author":"N Rosenblum","year":"2011","unstructured":"Rosenblum, N., Zhu, X., Miller, B.P.: Who wrote this code? Identifying the authors of program binaries. In: Atluri, V., Diaz, C. (eds.) ESORICS 2011. LNCS, vol. 6879, pp. 172\u2013189. Springer, Heidelberg (2011). doi: 10.1007\/978-3-642-23822-2_10"},{"key":"17_CR39","doi-asserted-by":"crossref","unstructured":"Santos, I., Penya, Y.K., Devesa, J., Bringas, P.G.: N-grams-based file signatures for malware detection. In: Proceedings of the ICEIS, vol. 2(9), pp. 317\u2013320 (2009)","DOI":"10.5220\/0001863603170320"},{"key":"17_CR40","doi-asserted-by":"crossref","unstructured":"Shevertalov, M., Kothari, J., Stehle, E., Mancoridis, S.: On the use of discretized source code metrics for author identification. In: 2009 1st International Symposium on Search Based Software Engineering, pp. 69\u201378. IEEE (2009)","DOI":"10.1109\/SSBSE.2009.18"},{"issue":"6","key":"17_CR41","doi-asserted-by":"crossref","first-page":"585","DOI":"10.1016\/0167-4048(93)90055-A","volume":"12","author":"EH Spafford","year":"1993","unstructured":"Spafford, E.H., Weeber, S.A.: Software forensics: can we track code to its authors? Comput. Secur. 12(6), 585\u2013595 (1993)","journal-title":"Comput. Secur."},{"key":"17_CR42","unstructured":"Weiser, M.: Program slicing. In: Proceedings of the 5th International Conference on Software Engineering, pp. 439\u2013449. IEEE Press (1981)"},{"key":"17_CR43","doi-asserted-by":"crossref","unstructured":"Yang, K.-X., Hu, L., Zhang, N., Huo, Y.-M., Zhao, K.: Improving the defence against web server fingerprinting by eliminating compliance variation. In: 2010 Fifth International Conference on Frontier of Computer Science and Technology (FCST), pp. 227\u2013232. IEEE (2010)","DOI":"10.1109\/FCST.2010.91"}],"container-title":["Lecture Notes in Computer Science","Foundations and Practice of Security"],"original-title":[],"link":[{"URL":"http:\/\/link.springer.com\/content\/pdf\/10.1007\/978-3-319-51966-1_17","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,6,21]],"date-time":"2024-06-21T13:17:46Z","timestamp":1718975866000},"score":1,"resource":{"primary":{"URL":"http:\/\/link.springer.com\/10.1007\/978-3-319-51966-1_17"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2016,12,29]]},"ISBN":["9783319519654","9783319519661"],"references-count":43,"URL":"https:\/\/doi.org\/10.1007\/978-3-319-51966-1_17","relation":{},"ISSN":["0302-9743","1611-3349"],"issn-type":[{"value":"0302-9743","type":"print"},{"value":"1611-3349","type":"electronic"}],"subject":[],"published":{"date-parts":[[2016,12,29]]}}}