{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,4]],"date-time":"2026-03-04T00:12:37Z","timestamp":1772583157603,"version":"3.50.1"},"publisher-location":"Berlin, Heidelberg","reference-count":33,"publisher":"Springer Berlin Heidelberg","isbn-type":[{"value":"9783642154966","type":"print"},{"value":"9783642154973","type":"electronic"}],"license":[{"start":{"date-parts":[[2010,1,1]],"date-time":"2010-01-01T00:00:00Z","timestamp":1262304000000},"content-version":"tdm","delay-in-days":0,"URL":"http:\/\/www.springer.com\/tdm"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2010]]},"DOI":"10.1007\/978-3-642-15497-3_42","type":"book-chapter","created":{"date-parts":[[2010,9,1]],"date-time":"2010-09-01T10:51:46Z","timestamp":1283338306000},"page":"698-715","source":"Crossref","is-referenced-by-count":11,"title":["Expressive, Efficient and Obfuscation Resilient Behavior Based IDS"],"prefix":"10.1007","author":[{"given":"Arnur G.","family":"Tokhtabayev","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Victor A.","family":"Skormin","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Andrey M.","family":"Dolgikh","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"297","reference":[{"key":"42_CR1","doi-asserted-by":"crossref","unstructured":"Parampalli, C., Sekar, R., Johnson, R.: A practical mimicry attack against powerful system-call monitors. In: Proc. ACM Symposium on Information, Computer and Communications Security, ASIACCS 2008 (2008)","DOI":"10.1145\/1368310.1368334"},{"key":"42_CR2","volume-title":"Microsoft Windows Internals","author":"M.E. Russinovich","year":"2005","unstructured":"Russinovich, M.E., Solomon, D.A.: Microsoft Windows Internals, 4th edn. Microsoft Press, Redmond (2005)","edition":"4"},{"key":"42_CR3","doi-asserted-by":"crossref","unstructured":"Christodorescu, M., Jha, S., Kruegel, C.: Mining specications of malicious behavior. In: Proc. ACM SIGSOFT Symposium on the Foundations of Software Engineering (August 2007)","DOI":"10.1145\/1287624.1287628"},{"key":"42_CR4","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"78","DOI":"10.1007\/978-3-540-87403-4_5","volume-title":"Recent Advances in Intrusion Detection","author":"L. Martignoni","year":"2008","unstructured":"Martignoni, L., et al.: A Layered Architecture for Detecting Malicious Behaviors. In: Lippmann, R., Kirda, E., Trachtenberg, A. (eds.) RAID 2008. LNCS, vol.\u00a05230, pp. 78\u201397. Springer, Heidelberg (2008)"},{"key":"42_CR5","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"143","DOI":"10.1007\/978-3-540-70542-0_8","volume-title":"Detection of Intrusions and Malware, and Vulnerability Assessment","author":"L. Cavallaro","year":"2008","unstructured":"Cavallaro, L., Saxena, P., Sekar, R.: On the Limits of Information Flow Techniques for Malware Analysis and Containment. In: Zamboni, D. (ed.) DIMVA 2008. LNCS, vol.\u00a05137, pp. 143\u2013163. Springer, Heidelberg (2008)"},{"key":"42_CR6","unstructured":"UML (2010), \n                    \n                      http:\/\/www.uml.org\/"},{"key":"#cr-split#-42_CR7.1","doi-asserted-by":"crossref","unstructured":"Filiol, E.: Formalization and Implementation Aspects of K-ary (malicious) Codes. In: Brouck, V. (ed.) EICAR 2007 Special Issue (2007)","DOI":"10.1007\/s11416-007-0044-2"},{"key":"#cr-split#-42_CR7.2","doi-asserted-by":"crossref","unstructured":"Journal in Computer Virology 3(2) (2007)","DOI":"10.1007\/s11416-007-0049-x"},{"key":"42_CR8","unstructured":"Visual Paradigm for UML (2009), \n                    \n                      http:\/\/www.visual-paradigm.com\/"},{"key":"42_CR9","volume-title":"An Introduction to Formal Language and Automata","author":"P. Linz","year":"2006","unstructured":"Linz, P.: An Introduction to Formal Language and Automata, 4th edn. Jones & Bartlett Pub., USA (2006)","edition":"4"},{"key":"42_CR10","doi-asserted-by":"publisher","first-page":"277","DOI":"10.1016\/0304-3975(77)90014-7","volume":"4","author":"N.D. Jones","year":"1977","unstructured":"Jones, N.D., et al.: Complexity of Some Problems in Petri Nets. Theoretical Computer Science\u00a04, 277\u2013299 (1977)","journal-title":"Theoretical Computer Science"},{"key":"42_CR11","doi-asserted-by":"crossref","DOI":"10.1007\/978-3-662-03241-1","volume-title":"Coloured Petri nets (2nd ed.): basic concepts, analysis methods and practical use","author":"K. Jensen","year":"1996","unstructured":"Jensen, K.: Coloured Petri nets (2nd ed.): basic concepts, analysis methods and practical use, 2nd edn., vol.\u00a01. Springer, Berlin (1996)","edition":"2"},{"key":"42_CR12","unstructured":"Newsome, J., Song, D.: Dynamic taint analysis for automatic detection, analysis, and signature generation of exploits on commodity software. In: Proc. 12th Annual Network and Distributed System Security Symposium, NDSS (2005)"},{"key":"42_CR13","unstructured":"Egele, M., Kruegel, C., Kirda, E., Yin, H., Song, D.: Dynamic spyware analysis. In: Proc. USENIX Annual Technical Conference (June 2007)"},{"key":"42_CR14","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"303","DOI":"10.1007\/3-540-48294-6_20","volume-title":"Static Analysis","author":"D.M. Volpano","year":"1999","unstructured":"Volpano, D.M.: Safety versus secrecy. In: Cortesi, A., Fil\u00e9, G. (eds.) SAS 1999. LNCS, vol.\u00a01694, p. 303. Springer, Heidelberg (1999)"},{"key":"42_CR15","unstructured":"Bayer, U., Comparetti, P.M., Hlauschek, C., Kruegel, C., Kirda, E.: Scalable, Behavior-Based Malware Clustering. In: Proc. NDSS (2009)"},{"key":"42_CR16","doi-asserted-by":"crossref","unstructured":"Moser, A., Kruegel, C., Kirda, E.: Exploring multiple execution paths for malware analysis. In: Proc. IEEE Security and Privacy (2007)","DOI":"10.1109\/SP.2007.17"},{"issue":"2","key":"42_CR17","doi-asserted-by":"crossref","first-page":"273","DOI":"10.3233\/JCS-2007-15203","volume":"15","author":"V. Skormin","year":"2007","unstructured":"Skormin, V., Volynkin, A., Summerville, D., Moronski, J.: Run-Time Detection of Malicious Self-Replication in Binary Executables. Journal of Computer Security\u00a015(2), 273\u2013301 (2007)","journal-title":"Journal of Computer Security"},{"key":"42_CR18","volume-title":"Subverting the Windows Kernel \u2013 Rootkits","author":"G. Hoglund","year":"2006","unstructured":"Hoglund, G., Butler, J.: Subverting the Windows Kernel \u2013 Rootkits. Addison Wesley, Reading (2006)"},{"key":"42_CR19","doi-asserted-by":"crossref","unstructured":"Tokhtabayev, A.G., Skormin, V.A., Dolgikh, A.M.: Detection of Worm Propagation Engines in the System Call Domain using Colored Petri Nets. In: Proc. 27th IEEE International Performance Computing and Communications Conference (IPCCC), Austin, TX (December 2008)","DOI":"10.1109\/PCCC.2008.4745108"},{"key":"42_CR20","doi-asserted-by":"crossref","unstructured":"Volynkin, A., Skormin, V.: Large-scale Reconfigurable Virtual Testbed for Information Security Experiments. In: Proc. of the 3rd International Conference on Testbeds and Research Infrastructures for the Development of Networks and Communities, Orlando, FL, May 21-23 (2007)","DOI":"10.1109\/TRIDENTCOM.2007.4444663"},{"key":"42_CR21","unstructured":"Tokhtabayev, A., Skormin, V., Dolgikh, A., Beisenbi, M., Kargaldayeva, M.: Detection of Specific Semantic Functionalities, such as Self-Replication Mechanism, in Malware Using Colored Petri Nets. In: Proc. SAM 2009, Las Vegas, NV (July 2009)"},{"key":"42_CR22","unstructured":"TestComplete (2010), \n                    \n                      http:\/\/www.automatedqa.com\/"},{"key":"42_CR23","unstructured":"PCMark 2005, Peacekeeper (2010), \n                    \n                      http:\/\/www.futuremark.com\/"},{"key":"42_CR24","unstructured":"Kumar, S., Spafford, E.H.: A Pattern Matching Model for Misuse Intrusion Detection Approach. In: Proc. of the 17th National Computer Security Conference (1994)"},{"issue":"1\/2","key":"42_CR25","doi-asserted-by":"publisher","first-page":"109","DOI":"10.1504\/IJICS.2007.012246","volume":"1","author":"G. Helmer","year":"2007","unstructured":"Helmer, G., Wong, J., Slagell, M., Honavar, V., Miller, L., Wang, Y., Wang, X., Stakhanova, N.: A Software Fault Tree and Colored Petri Nets based specification, Design and Implementation of Agent Based Intrusion Detection Systems. International Journal of Information and Computer Security\u00a01(1\/2), 109\u2013142 (2007)","journal-title":"International Journal of Information and Computer Security"},{"key":"42_CR26","unstructured":"Ho, Y., Frincke, D., Tobin Jr., D.: Planning, Petri Nets, and Intrusion Detection. In: Proceedings of the 21st National Information Systems Security Conference, Crystal City, Virginia (October 1998)"},{"key":"42_CR27","unstructured":"Eckmann, S., Vigna, G., Kemmerer, R.: STATL: an Attack Language for State-based Intrusion Detection. In: Proc. of the ACM Workshop on Intrusion Detection, Athens, Greece (November 2000)"},{"key":"42_CR28","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"197","DOI":"10.1007\/3-540-39945-3_13","volume-title":"Recent Advances in Intrusion Detection","author":"F. Cuppens","year":"2000","unstructured":"Cuppens, F., Ortalo, R.: LAMBDA: A Language to Model a Database for Detection of Attacks. In: Debar, H., M\u00e9, L., Wu, S.F. (eds.) RAID 2000. LNCS, vol.\u00a01907, p. 197. Springer, Heidelberg (2000)"},{"key":"42_CR29","volume-title":"Proc. International Conference on Information Security","author":"C. Michel","year":"2001","unstructured":"Michel, C., Me, L.: ADeLe: An Attack Description Language for Knowledge-based Intrusion Detection. In: Proc. International Conference on Information Security, June 2001, Kluwer, Dordrecht (2001)"},{"key":"42_CR30","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1007\/3-540-45474-8_1","volume-title":"Recent Advances in Intrusion Detection","author":"J.-P. Pouzol","year":"2001","unstructured":"Pouzol, J.-P., Ducass\u00e9, M.: From Declarative Signatures to Misuse IDS. In: Lee, W., M\u00e9, L., Wespi, A. (eds.) RAID 2001. LNCS, vol.\u00a02212, pp. 1\u201321. Springer, Heidelberg (2001)"},{"issue":"4","key":"42_CR31","doi-asserted-by":"publisher","first-page":"407","DOI":"10.1145\/503339.503342","volume":"4","author":"P. Ning","year":"2001","unstructured":"Ning, P., Jajodia, S., Wang, X.S.: Abstraction-Based Intrusion Detection In Distributed Environments. ACM Transactions on Information and System Security\u00a04(4), 407\u2013452 (2001)","journal-title":"ACM Transactions on Information and System Security"},{"key":"42_CR32","first-page":"559","volume-title":"Proc. 17th International Conference on Information Security","author":"M. Meier","year":"2002","unstructured":"Meier, M., Bischof, N., Holz, T.: SHEDEL - A Simple Hierarchical Event Description Language for Specifying Attack Signatures. In: Proc. 17th International Conference on Information Security, pp. 559\u2013571. Kluwer, Dordrecht (2002)"}],"container-title":["Lecture Notes in Computer Science","Computer Security \u2013 ESORICS 2010"],"original-title":[],"language":"en","link":[{"URL":"http:\/\/link.springer.com\/content\/pdf\/10.1007\/978-3-642-15497-3_42","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2019,6,2]],"date-time":"2019-06-02T20:28:54Z","timestamp":1559507334000},"score":1,"resource":{"primary":{"URL":"http:\/\/link.springer.com\/10.1007\/978-3-642-15497-3_42"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2010]]},"ISBN":["9783642154966","9783642154973"],"references-count":33,"URL":"https:\/\/doi.org\/10.1007\/978-3-642-15497-3_42","relation":{},"ISSN":["0302-9743","1611-3349"],"issn-type":[{"value":"0302-9743","type":"print"},{"value":"1611-3349","type":"electronic"}],"subject":[],"published":{"date-parts":[[2010]]}}}