{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,2,20]],"date-time":"2026-02-20T02:21:47Z","timestamp":1771554107659,"version":"3.50.1"},"publisher-location":"Berlin, Heidelberg","reference-count":37,"publisher":"Springer Berlin Heidelberg","isbn-type":[{"value":"9783642029172","type":"print"},{"value":"9783642029189","type":"electronic"}],"license":[{"start":{"date-parts":[[2009,1,1]],"date-time":"2009-01-01T00:00:00Z","timestamp":1230768000000},"content-version":"unspecified","delay-in-days":0,"URL":"http:\/\/www.springer.com\/tdm"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2009]]},"DOI":"10.1007\/978-3-642-02918-9_5","type":"book-chapter","created":{"date-parts":[[2009,6,26]],"date-time":"2009-06-26T10:15:11Z","timestamp":1246011311000},"page":"68-87","source":"Crossref","is-referenced-by-count":9,"title":["Yataglass: Network-Level Code Emulation for Analyzing Memory-Scanning Attacks"],"prefix":"10.1007","author":[{"given":"Makoto","family":"Shimamura","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Kenji","family":"Kono","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"297","reference":[{"key":"5_CR1","unstructured":"AlephOne: Smashing stack for fun and profit. Phrack (November 1996)"},{"key":"5_CR2","unstructured":"MITRE: OpenSSL SSLv2 Malformed Client Key Remote Buffer Overflow Vulnerability (2002), http:\/\/www.securityfocus.com\/bid\/5363"},{"key":"5_CR3","unstructured":"Sotirov, A.: Apache openssl heap overflow exploit (September 2002), http:\/\/www.phreedom.org\/research\/exploits\/apache-openssl\/"},{"key":"5_CR4","doi-asserted-by":"crossref","unstructured":"Li, W., cher Chiueh, T.: Automated format string attack prevention for win32\/x86 binaries. In: Proc. of the 23rd Annual Computer Security Applications Conference ACSAC 2007, pp. 398\u2013409 (2007)","DOI":"10.1109\/ACSAC.2007.23"},{"key":"5_CR5","unstructured":"Roesch, M.: Snort: Lightweight intrusion detection for networks. In: Proc. of the 13th USENIX Conference on Systems Administration LISA 1999, pp. 229\u2013238 (1999)"},{"issue":"23-24","key":"5_CR6","doi-asserted-by":"publisher","first-page":"2435","DOI":"10.1016\/S1389-1286(99)00112-7","volume":"31","author":"V. Paxson","year":"1999","unstructured":"Paxson, V.: Bro: a system for detecting network intruders in real-time. Computer Networks\u00a031(23-24), 2435\u20132463 (1999)","journal-title":"Computer Networks"},{"key":"5_CR7","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"284","DOI":"10.1007\/11663812_15","volume-title":"Recent Advances in Intrusion Detection","author":"R. Chinchani","year":"2006","unstructured":"Chinchani, R., van den Berg, E.: A fast static analysis approach to detect exploit code inside network flows. In: Valdes, A., Zamboni, D. (eds.) RAID 2005. LNCS, vol.\u00a03858, pp. 284\u2013308. Springer, Heidelberg (2006)"},{"key":"5_CR8","unstructured":"The Metasploit Project: Metasploit, http:\/\/www.metasploit.com\/"},{"key":"5_CR9","unstructured":"Bania, P.: Tapion (2005), http:\/\/pb.specialised.info\/all\/tapion\/"},{"key":"5_CR10","unstructured":"K2: Admmutate (2007), http:\/\/www.ktwo.ca\/ADMmutate-0.8.4.tar.gz"},{"key":"5_CR11","unstructured":"Sedalo, M.: Jempiscode (2006), http:\/\/goodfellas.shellcode.com.ar\/proyectos.html"},{"key":"5_CR12","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"207","DOI":"10.1007\/11663812_11","volume-title":"Recent Advances in Intrusion Detection","author":"C. Kr\u00fcgel","year":"2006","unstructured":"Kr\u00fcgel, C., Kirda, E., Mutz, D., Robertson, W., Vigna, G.: Polymorphic worm detection using structural information of executables. In: Valdes, A., Zamboni, D. (eds.) RAID 2005. LNCS, vol.\u00a03858, pp. 207\u2013226. Springer, Heidelberg (2006)"},{"key":"5_CR13","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"crossref","first-page":"54","DOI":"10.1007\/11790754_4","volume-title":"Detection of Intrusions and Malware & Vulnerability Assessment","author":"M. Polychronakis","year":"2006","unstructured":"Polychronakis, M., Anagnostakis, K.G., Markatos, E.P.: Network\u2013level polymorphic shellcode detection using emulation. In: B\u00fcschkes, R., Laskov, P. (eds.) DIMVA 2006. LNCS, vol.\u00a04064, pp. 54\u201373. Springer, Heidelberg (2006)"},{"key":"5_CR14","doi-asserted-by":"crossref","unstructured":"Ma, J., Dunagan, J., Wang, H.J., Savage, S., Voelker, G.M.: Finding diversity in remote code injection exploits. In: Proc. of the 6th ACM SIGCOMM on Internet Measurement IMC 2006, October 2006, pp. 53\u201364 (2006)","DOI":"10.1145\/1177080.1177087"},{"key":"5_CR15","doi-asserted-by":"crossref","unstructured":"Zhang, Q., Reeves, D.S., Ning, P.: Analyzing network traffic to detect self-decrypting exploit code. In: Proc. of the 2nd ASIAN ACM Symposium on Information, Computer and Communications Security ASIACCS 2007, March 2007, pp. 4\u201312 (2007)","DOI":"10.1145\/1229285.1229291"},{"key":"5_CR16","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"87","DOI":"10.1007\/978-3-540-74320-0_5","volume-title":"Recent Advances in Intrusion Detection","author":"M. Polychronakis","year":"2007","unstructured":"Polychronakis, M., Anagnostakis, K.G., Markatos, E.P.: Emulation-based detection of non-self-contained polymorphic shellcode. In: Kruegel, C., Lippmann, R., Clark, A. (eds.) RAID 2007. LNCS, vol.\u00a04637, pp. 87\u2013106. Springer, Heidelberg (2007)"},{"key":"5_CR17","doi-asserted-by":"crossref","unstructured":"Borders, K., Prakash, A., Zielinski, M.: Spector: Automatically analyzing shell code. In: Proc. of the 23rd Annual Computer Security Applications Conference ACSAC 2007, pp. 501\u2013514 (2007)","DOI":"10.1109\/ACSAC.2007.11"},{"key":"5_CR18","unstructured":"Linn, C.M., Rajagopalan, M., Baker, S., Collberg, C., Debray, S.K., Hartman, J.: Protecting against unexpected system calls. In: Proc. of the 13th Usenix Security Symposium, August 2005, pp. 239\u2013254 (2005)"},{"key":"5_CR19","unstructured":"Wang, X., Pan, C.C., Liu, P., Zhu, S.: SigFree: A Signature-free Buffer Overflow Attack Blocker. In: Proc. of the 15th Usenix Security Symposium, pp. 225\u2013240 (2006)"},{"key":"5_CR20","doi-asserted-by":"crossref","unstructured":"Cadar, C., Ganesh, V., Pawlowski, P.M., Dill, D.L., Engler, D.R.: EXE: automatically generating inputs of death. In: Proc. of the 13th ACM Conference on Computer and Communications Security CCS 2006, October 2006, pp. 322\u2013335 (2006)","DOI":"10.1145\/1180405.1180445"},{"key":"5_CR21","doi-asserted-by":"crossref","unstructured":"Moser, A., Kruegel, C., Kirda, E.: Exploring multiple execution paths for malware analysis. In: Proc. of the 2007 IEEE Symposium on Security and Privacy S&P 2007, May 2007, pp. 231\u2013245 (2007)","DOI":"10.1109\/SP.2007.17"},{"key":"5_CR22","unstructured":"Brumley, D., Hartwig, C., Kang, M.G., Liang, Z., Newsome, J., Poosankam, P., Song, D., Yin, H.: Bitscope: Automatically dissecting malicious binaries. Technical Report CMU-CS-07-133, Carnegie Mellon University (2007)"},{"key":"5_CR23","unstructured":"SystemV Application Binary Interface Intel 386 Architecture Processor Supplement, http:\/\/www.caldera.com\/developers\/devspecs\/abi386-4.pdf"},{"key":"5_CR24","unstructured":"jt: Libdasm (2006), http:\/\/www.klake.org\/~jt\/misc\/libdasm-1.5.tar.gz"},{"key":"5_CR25","volume-title":"Virtual Machines - Versatile Platforms for Systems and Processes","author":"J.E. Smith","year":"2005","unstructured":"Smith, J.E., Nair, R.: Virtual Machines - Versatile Platforms for Systems and Processes. Elsevier, Amsterdam (2005)"},{"key":"5_CR26","unstructured":"MITRE: ISC Bind 8 Transaction Signatures Buffer Overflow Vulnerability (2001), http:\/\/www.securityfocus.com\/bid\/2302"},{"key":"5_CR27","unstructured":"MITRE: Wu-ftpd file globbing heap corruption vulnerability (2001), http:\/\/securityfocus.com\/bid\/3581"},{"key":"5_CR28","unstructured":"MITRE: rsync Signed Array Index Remote Code Execution Vulnerability (2002), http:\/\/www.securityfocus.com\/bid\/3958"},{"key":"5_CR29","unstructured":"MITRE: Wu-imapd Partial Mailbox Attribute Remote Buffer Overflow Vulnerability (2002), http:\/\/securityfocus.com\/bid\/4713"},{"key":"5_CR30","unstructured":"MITRE: Samba \u2019call_trans2open\u2019 remote buffer overflow vulnerability (2003), http:\/\/securityfocus.com\/bid\/7294"},{"key":"5_CR31","unstructured":"MITRE: Cyrus IMAPD POP3D Remote Buffer Overflow Vulnerability (2006), http:\/\/www.securityfocus.com\/bid\/18506"},{"key":"5_CR32","unstructured":"SecurityFocus: http:\/\/securityfocus.com\/"},{"key":"5_CR33","unstructured":"Milw0rm: http:\/\/www.milw0rm.com\/"},{"key":"5_CR34","unstructured":"PaX Team: PaX address space layout randomization (ASLR), http:\/\/pax.grsecurity.net\/docs\/aslr.txt"},{"key":"5_CR35","unstructured":"Andersson, S., Clark, A., Mohay, G.M.: Network-based buffer overflow detection by exploit code analysis. In: Proc. of the AusCERT Asia Pacific Information Technology Security Conference, pp. 39\u201353 (2004)"},{"key":"5_CR36","doi-asserted-by":"crossref","unstructured":"Dunlap, G.W., King, S.T., Cinar, S., Basrai, M., Chen, P.M.: Revirt: Enabling intrusion analysis through virtual-machine logging and replay. In: Proc. of the 5th Symposium on Operating Systems Design and Implementation OSDI 2002, December 2002, pp. 211\u2013224 (2002)","DOI":"10.1145\/1060289.1060309"},{"key":"5_CR37","doi-asserted-by":"crossref","unstructured":"Andersson, S., Clark, A., Mohay, G.M., Schatz, B., Zimmermann, J.: A Framework for Detecting Network-based Code Injection Attacks Targeting Windows and UNIX. In: Proc. of the 21st Annual Computer Security Applications Conference ACSAC 2005, pp. 49\u201358 (2005)","DOI":"10.1109\/CSAC.2005.5"}],"container-title":["Lecture Notes in Computer Science","Detection of Intrusions and Malware, and Vulnerability Assessment"],"original-title":[],"link":[{"URL":"http:\/\/link.springer.com\/content\/pdf\/10.1007\/978-3-642-02918-9_5","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2019,5,20]],"date-time":"2019-05-20T23:20:32Z","timestamp":1558394432000},"score":1,"resource":{"primary":{"URL":"http:\/\/link.springer.com\/10.1007\/978-3-642-02918-9_5"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2009]]},"ISBN":["9783642029172","9783642029189"],"references-count":37,"URL":"https:\/\/doi.org\/10.1007\/978-3-642-02918-9_5","relation":{},"ISSN":["0302-9743","1611-3349"],"issn-type":[{"value":"0302-9743","type":"print"},{"value":"1611-3349","type":"electronic"}],"subject":[],"published":{"date-parts":[[2009]]}}}