{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,6]],"date-time":"2026-06-06T16:33:53Z","timestamp":1780763633630,"version":"3.54.1"},"publisher-location":"Cham","reference-count":40,"publisher":"Springer International Publishing","isbn-type":[{"value":"9783319990729","type":"print"},{"value":"9783319990736","type":"electronic"}],"license":[{"start":{"date-parts":[[2018,1,1]],"date-time":"2018-01-01T00:00:00Z","timestamp":1514764800000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"},{"start":{"date-parts":[[2018,1,1]],"date-time":"2018-01-01T00:00:00Z","timestamp":1514764800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2018]]},"DOI":"10.1007\/978-3-319-99073-6_2","type":"book-chapter","created":{"date-parts":[[2018,8,10]],"date-time":"2018-08-10T18:09:38Z","timestamp":1533924578000},"page":"26-47","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":16,"title":["On Leveraging Coding Habits for Effective Binary Authorship Attribution"],"prefix":"10.1007","author":[{"given":"Saed","family":"Alrabaee","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Paria","family":"Shirani","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Lingyu","family":"Wang","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Mourad","family":"Debbabi","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Aiman","family":"Hanna","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"297","published-online":{"date-parts":[[2018,8,8]]},"reference":[{"key":"2_CR1","unstructured":"The Google Code Jam (2008\u20132015). http:\/\/code.google.com\/codejam\/"},{"key":"2_CR2","unstructured":"GitHub-Build software better (2011). https:\/\/github.com\/trending?l=cpp"},{"key":"2_CR3","unstructured":"Technical report: McAfee (2011). www.mcafee.com\/ca\/resources\/wp-citadel-trojan-summary.pdf"},{"key":"2_CR4","unstructured":"The materials supplement for the paper. Who Wrote This Code? Identifying the Authors of Program Binaries (2011). http:\/\/pages.cs.wisc.edu\/~nater\/esorics-supp\/"},{"key":"2_CR5","unstructured":"Big Game Hunting: Nation-state malware research, BlackHat (2015). https:\/\/www.blackhat.com\/docs\/us-15\/materials\/us-15-MarquisBoire-Big-Game-Hunting-The-Peculiarities-Of-Nation-State-Malware-Research.pdf"},{"key":"2_CR6","unstructured":"Hex-Ray decompiler (2015). https:\/\/www.hex-rays.com\/products\/decompiler\/"},{"key":"2_CR7","unstructured":"Programmer De-anonymization from Binary Executables (2015). https:\/\/github.com\/calaylin\/bda"},{"key":"2_CR8","unstructured":"The Gephi plugin for neo4j (2015). https:\/\/marketplace.gephi.org\/plugin\/neo4j-graph-database-support\/"},{"key":"2_CR9","unstructured":"The planet source code (2015). http:\/\/www.planet-source-code.com\/vb\/default.asp?lngWId=3#ContentWinners"},{"key":"2_CR10","unstructured":"C++ refactoring tools for visual studio (2016). http:\/\/www.wholetomato.com\/"},{"key":"2_CR11","unstructured":"Refactoring tool (2016). https:\/\/www.devexpress.com\/Products\/CodeRush\/"},{"key":"2_CR12","unstructured":"Technical report, Resource 207: Kaspersky Lab Research proves that Stuxnet and Flame developers are connected, May 2012. http:\/\/www.kaspersky.com\/about\/news\/virus\/2012\/"},{"key":"2_CR13","unstructured":"Contagio: malware dump, May 2016. http:\/\/contagiodump.blogspot.ca"},{"key":"2_CR14","unstructured":"VirusSign: Malware Research & Data Center, Virus Free, May 2016. http:\/\/www.virussign.com\/"},{"key":"2_CR15","doi-asserted-by":"publisher","first-page":"S94","DOI":"10.1016\/j.diin.2014.03.012","volume":"11","author":"S Alrabaee","year":"2014","unstructured":"Alrabaee, S., Saleem, N., Preda, S., Wang, L., Debbabi, M.: OBA2: an onion approach to binary code authorship attribution. Digit. Investig. 11, S94\u2013S103 (2014)","journal-title":"Digit. Investig."},{"key":"2_CR16","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"256","DOI":"10.1007\/978-3-319-51966-1_17","volume-title":"Foundations and Practice of Security","author":"S Alrabaee","year":"2017","unstructured":"Alrabaee, S., Shirani, P., Debbabi, M., Wang, L.: On the feasibility of malware authorship attribution. In: Cuppens, F., Wang, L., Cuppens-Boulahia, N., Tawbi, N., Garcia-Alfaro, J. (eds.) FPS 2016. LNCS, vol. 10128, pp. 256\u2013272. Springer, Cham (2017). https:\/\/doi.org\/10.1007\/978-3-319-51966-1_17"},{"key":"2_CR17","doi-asserted-by":"publisher","first-page":"S61","DOI":"10.1016\/j.diin.2015.01.011","volume":"12","author":"S Alrabaee","year":"2015","unstructured":"Alrabaee, S., Shirani, P., Wang, L., Debbabi, M.: SIGMA: a semantic integrated graph matching approach for identifying reused functions in binary code. Digit. Investig. 12, S61\u2013S71 (2015)","journal-title":"Digit. Investig."},{"issue":"2","key":"2_CR18","first-page":"8","volume":"21","author":"S Alrabaee","year":"2018","unstructured":"Alrabaee, S., Shirani, P., Wang, L., Debbabi, M.: FOSSIL: a resilient and efficient system for identifying FOSS functions in malware binaries. ACM Trans. Priv. Secur. (TOPS) 21(2), 8 (2018)","journal-title":"ACM Trans. Priv. Secur. (TOPS)"},{"key":"2_CR19","doi-asserted-by":"crossref","unstructured":"Caliskan-Islam, A., et al.: When coding style survives compilation: de-anonymizing programmers from executable binaries. Netw. Distrib. Syst. Secur. Symp. (NDSS) (2018)","DOI":"10.14722\/ndss.2018.23304"},{"issue":"4","key":"2_CR20","doi-asserted-by":"publisher","first-page":"1523","DOI":"10.1109\/TIT.2005.844059","volume":"51","author":"R Cilibrasi","year":"2005","unstructured":"Cilibrasi, R., Vitanyi, P.: Clustering by compression. IEEE Trans. Inf. Theory 51(4), 1523\u20131545 (2005)","journal-title":"IEEE Trans. Inf. Theory"},{"key":"2_CR21","doi-asserted-by":"crossref","unstructured":"David, Y., Partush, N., Yahav, E.: Similarity of binaries through re-optimization. In: Proceedings of the 38th ACM SIGPLAN Conference on Programming Language Design and Implementation, pp. 79\u201394. ACM (2017)","DOI":"10.1145\/3062341.3062387"},{"key":"2_CR22","doi-asserted-by":"crossref","unstructured":"Junod, P., Rinaldini, J., Wehrli, J., Michielin, J.: Obfuscator-LLVM: software protection for the masses. In: Proceedings of the 1st International Workshop on Software Protection, pp. 3\u20139. IEEE Press (2015)","DOI":"10.1109\/SPRO.2015.10"},{"key":"2_CR23","doi-asserted-by":"crossref","unstructured":"Junttila, T.A., Kaski, P.: Engineering an efficient canonical labeling tool for large and sparse graphs. In: ALENEX, vol. 7, pp. 135\u2013149. SIAM (2007)","DOI":"10.1137\/1.9781611972870.13"},{"issue":"12","key":"2_CR24","doi-asserted-by":"publisher","first-page":"735","DOI":"10.1145\/355588.365140","volume":"7","author":"DE Knuth","year":"1964","unstructured":"Knuth, D.E.: Backus normal form vs. Backus Naur form. Commun. ACM 7(12), 735\u2013736 (1964)","journal-title":"Commun. ACM"},{"issue":"3","key":"2_CR25","doi-asserted-by":"publisher","first-page":"233","DOI":"10.1016\/S0167-4048(97)00005-9","volume":"16","author":"I Krsul","year":"1997","unstructured":"Krsul, I., Spafford, E.H.: Authorship analysis: identifying the author of a program. Comput. Secur. 16(3), 233\u2013257 (1997)","journal-title":"Comput. Secur."},{"key":"2_CR26","first-page":"49","volume":"2","author":"PC Mahalanobis","year":"1936","unstructured":"Mahalanobis, P.C.: On the generalized distance in statistics. Proc. Natl. Inst. Sci. (Calcutta) 2, 49\u201355 (1936)","journal-title":"Proc. Natl. Inst. Sci. (Calcutta)"},{"key":"2_CR27","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"286","DOI":"10.1007\/978-3-319-66399-9_16","volume-title":"Computer Security \u2013 ESORICS 2017","author":"X Meng","year":"2017","unstructured":"Meng, X., Miller, B.P., Jun, K.-S.: Identifying multiple authors in a binary program. In: Foley, S.N., Gollmann, D., Snekkenes, E. (eds.) ESORICS 2017. LNCS, vol. 10493, pp. 286\u2013304. Springer, Cham (2017). https:\/\/doi.org\/10.1007\/978-3-319-66399-9_16"},{"key":"2_CR28","volume-title":"Supply Chain Analysis: From Quartermaster to Sunshop","author":"N Moran","year":"2013","unstructured":"Moran, N., Bennett, J.: Supply Chain Analysis: From Quartermaster to Sunshop, vol. 11. FireEye Labs, Milpitas (2013)"},{"key":"2_CR29","doi-asserted-by":"crossref","unstructured":"Nethercote, N., Seward, J.: Valgrind: a framework for heavyweight dynamic binary instrumentation. In: ACM SIGPLAN Notices, vol. 42, pp. 89\u2013100. ACM (2007)","DOI":"10.1145\/1273442.1250746"},{"key":"2_CR30","unstructured":"Palmer, G., et al.: A road map for digital forensic research. In: First Digital Forensic Research Workshop, Utica, New York, pp. 27\u201330 (2001)"},{"key":"2_CR31","doi-asserted-by":"crossref","unstructured":"Rajlich, V.: Software evolution and maintenance. In: Proceedings of the Future of Software Engineering, pp. 133\u2013144. ACM (2014)","DOI":"10.1145\/2593882.2593893"},{"key":"2_CR32","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"172","DOI":"10.1007\/978-3-642-23822-2_10","volume-title":"Computer Security \u2013 ESORICS 2011","author":"N Rosenblum","year":"2011","unstructured":"Rosenblum, N., Zhu, X., Miller, B.P.: Who wrote this code? Identifying the authors of program binaries. In: Atluri, V., Diaz, C. (eds.) ESORICS 2011. LNCS, vol. 6879, pp. 172\u2013189. Springer, Heidelberg (2011). https:\/\/doi.org\/10.1007\/978-3-642-23822-2_10"},{"key":"2_CR33","doi-asserted-by":"crossref","unstructured":"Schleimer, S., Wilkerson, D.S., Aiken, A.: Winnowing: local algorithms for document fingerprinting. In: Proceedings of the 2003 ACM SIGMOD International Conference on Management of Data, pp. 76\u201385. ACM (2003)","DOI":"10.1145\/872757.872770"},{"key":"2_CR34","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"114","DOI":"10.1007\/978-3-319-93411-2_6","volume-title":"Detection of Intrusions and Malware, and Vulnerability Assessment","author":"P Shirani","year":"2018","unstructured":"Shirani, P., et al.: BINARM: scalable and efficient detection of vulnerabilities in firmware images of intelligent electronic devices. In: Giuffrida, C., Bardin, S., Blanc, G. (eds.) DIMVA 2018. LNCS, vol. 10885, pp. 114\u2013138. Springer, Cham (2018). https:\/\/doi.org\/10.1007\/978-3-319-93411-2_6"},{"key":"2_CR35","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"301","DOI":"10.1007\/978-3-319-60876-1_14","volume-title":"Detection of Intrusions and Malware, and Vulnerability Assessment","author":"P Shirani","year":"2017","unstructured":"Shirani, P., Wang, L., Debbabi, M.: BinShape: scalable and robust binary library function identification using function shape. In: Polychronakis, M., Meier, M. (eds.) DIMVA 2017. LNCS, vol. 10327, pp. 301\u2013324. Springer, Cham (2017). https:\/\/doi.org\/10.1007\/978-3-319-60876-1_14"},{"key":"2_CR36","doi-asserted-by":"crossref","unstructured":"Shoshitaishvili, Y., et al.: SOK: (state of) the art of war: offensive techniques in binary analysis. In: 2016 IEEE Symposium on Security and Privacy, SP, pp. 138\u2013157. IEEE (2016)","DOI":"10.1109\/SP.2016.17"},{"issue":"6","key":"2_CR37","doi-asserted-by":"publisher","first-page":"585","DOI":"10.1016\/0167-4048(93)90055-A","volume":"12","author":"EH Spafford","year":"1993","unstructured":"Spafford, E.H., Weeber, S.A.: Software forensics: can we track code to its authors? Comput. Secur. 12(6), 585\u2013595 (1993)","journal-title":"Comput. Secur."},{"issue":"6","key":"2_CR38","doi-asserted-by":"publisher","first-page":"295","DOI":"10.1145\/1993316.1993533","volume":"46","author":"J-B Tristan","year":"2011","unstructured":"Tristan, J.-B., Govereau, P., Morrisett, G.: Evaluating value-graph translation validation for LLVM. ACM SIGPLAN Not. 46(6), 295\u2013305 (2011)","journal-title":"ACM SIGPLAN Not."},{"issue":"2","key":"2_CR39","doi-asserted-by":"publisher","first-page":"426","DOI":"10.1147\/sj.402.0426","volume":"40","author":"JT-L Wang","year":"2001","unstructured":"Wang, J.T.-L., Ma, Q., Shasha, D., Wu, C.H.: New techniques for extracting features from protein sequences. IBM Syst. J. 40(2), 426\u2013441 (2001)","journal-title":"IBM Syst. J."},{"issue":"6","key":"2_CR40","doi-asserted-by":"publisher","first-page":"1091","DOI":"10.1109\/TPAMI.2007.1078","volume":"29","author":"L Yujian","year":"2007","unstructured":"Yujian, L., Bo, L.: A normalized Levenshtein distance metric. IEEE Trans. Pattern Anal. Mach. Intell. 29(6), 1091\u20131095 (2007)","journal-title":"IEEE Trans. Pattern Anal. Mach. Intell."}],"container-title":["Lecture Notes in Computer Science","Computer Security"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/978-3-319-99073-6_2","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2023,8,12]],"date-time":"2023-08-12T00:02:17Z","timestamp":1691798537000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/978-3-319-99073-6_2"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2018]]},"ISBN":["9783319990729","9783319990736"],"references-count":40,"URL":"https:\/\/doi.org\/10.1007\/978-3-319-99073-6_2","relation":{},"ISSN":["0302-9743","1611-3349"],"issn-type":[{"value":"0302-9743","type":"print"},{"value":"1611-3349","type":"electronic"}],"subject":[],"published":{"date-parts":[[2018]]},"assertion":[{"value":"8 August 2018","order":1,"name":"first_online","label":"First Online","group":{"name":"ChapterHistory","label":"Chapter History"}},{"value":"ESORICS","order":1,"name":"conference_acronym","label":"Conference Acronym","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"European Symposium on Research in Computer Security","order":2,"name":"conference_name","label":"Conference Name","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Barcelona","order":3,"name":"conference_city","label":"Conference City","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Spain","order":4,"name":"conference_country","label":"Conference Country","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"2018","order":5,"name":"conference_year","label":"Conference Year","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"3 September 2018","order":7,"name":"conference_start_date","label":"Conference Start Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"9 September 2018","order":8,"name":"conference_end_date","label":"Conference End Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"23","order":9,"name":"conference_number","label":"Conference Number","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"esorics2018","order":10,"name":"conference_id","label":"Conference ID","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"https:\/\/esorics2018.upc.edu\/","order":11,"name":"conference_url","label":"Conference URL","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"This content has been made available to all.","name":"free","label":"Free to read"}]}}