{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,9,27]],"date-time":"2026-09-27T21:13:04Z","timestamp":1790543584156,"version":"4.1.0"},"publisher-location":"Berlin, Heidelberg","reference-count":26,"publisher":"Springer Berlin Heidelberg","isbn-type":[{"value":"9783642155116","type":"print"},{"value":"9783642155123","type":"electronic"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2010]]},"DOI":"10.1007\/978-3-642-15512-3_13","type":"book-chapter","created":{"date-parts":[[2010,8,31]],"date-time":"2010-08-31T12:27:39Z","timestamp":1283257659000},"page":"238-255","source":"Crossref","is-referenced-by-count":45,"title":["On Challenges in Evaluating Malware Clustering"],"prefix":"10.1007","author":[{"given":"Peng","family":"Li","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Limin","family":"Liu","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Debin","family":"Gao","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Michael K.","family":"Reiter","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"297","reference":[{"key":"13_CR1","unstructured":"Threatexpert3, http:\/\/www.threatexpert.com\/"},{"key":"13_CR2","unstructured":"Norman sandbox center (2008), http:\/\/www.norman.com\/security_center\/security_tools\/en"},{"key":"13_CR3","unstructured":"VX Heavens (2010), http:\/\/vx.netlux.org\/"},{"key":"13_CR4","unstructured":"Aiken, A.: Moss: a system for detecting software plagiarism, http:\/\/theory.stanford.edu\/~aiken\/moss\/"},{"key":"13_CR5","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"178","DOI":"10.1007\/978-3-540-74320-0_10","volume-title":"Recent Advances in Intrusion Detection","author":"M. Bailey","year":"2007","unstructured":"Bailey, M., Oberheide, J., Andersen, J., Mao, Z.M., Jahanian, F., Nazario, J.: Automated classification and analysis of internet malware. In: Kruegel, C., Lippmann, R., Clark, A. (eds.) RAID 2007. LNCS, vol.\u00a04637, pp. 178\u2013197. Springer, Heidelberg (2007)"},{"key":"13_CR6","unstructured":"Bayer, U., Comparetti, P.M., Hlauschek, C., Kruegel, C., Kirda, E.: Scalable, behavior-based malware clustering. In: Proceedings of the Network and Distributed System Security Symposium (2009)"},{"key":"13_CR7","unstructured":"Bayer, U., Kruegel, C., Kirda, E.: Ttanalyze: A tool for analyzing malware. In: 15th European Institute for Computer Antivirus Research (EICAR 2006) Annual Conference (2006)"},{"key":"13_CR8","unstructured":"Commtouch, Inc. Malware outbreak trend report: Bagle\/beagle (March 2007), http:\/\/www.commtouch.com\/documents\/Bagle-Worm_MOTR.pdf"},{"key":"13_CR9","unstructured":"Gheorghescu, M.: An automated virus classification system. In: Proceedings of the Virus Bulletin Conference, VB (1994)"},{"key":"13_CR10","unstructured":"Ha, K.: Keylogger.stawin, http:\/\/www.symantec.com\/security_response\/writeup.jsp?docid=2004-012915-2315-99"},{"key":"13_CR11","doi-asserted-by":"crossref","unstructured":"Hu, X., Chiueh, T., Shin, K.G.: Large-scale malware indexing using function-call graphs. In: Proceedings of 16th ACM Conference on Computer and Communications Security (2009)","DOI":"10.1145\/1653662.1653736"},{"key":"13_CR12","doi-asserted-by":"crossref","unstructured":"Kamiya, T., Kusumoto, S., Inoue, K.: Ccfinder: A multi-linguistic token-based code clone detection system for large scale source code. IEEE Trans. on Software Engineering, 654\u2013670 (2002)","DOI":"10.1109\/TSE.2002.1019480"},{"key":"13_CR13","unstructured":"Lee, T., Mody, J.J.: Behavioral classification. In: 15th European Institute for Computer Antivirus Research (EICAR 2006) Annual Conference (2006)"},{"key":"13_CR14","unstructured":"McAfee. W97m\/opey.c, http:\/\/vil.nai.com\/vil\/content\/v_10290.htm"},{"key":"13_CR15","unstructured":"Perdisci, R., Lee, W., Feamster, N.: Behavioral clustering of http-based malware and signature generation using malicious network traces. In: USENIX Symposium on Networked Systems Design and Implementation, NSDI 2010 (2010)"},{"key":"13_CR16","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"108","DOI":"10.1007\/978-3-540-70542-0_6","volume-title":"Detection of Intrusions and Malware, and Vulnerability Assessment","author":"K. Rieck","year":"2008","unstructured":"Rieck, K., Holz, T., Willems, C., Dussel, P., Laskov, P.: Learning and classification of malware behavior. In: Zamboni, D. (ed.) DIMVA 2008. LNCS, vol.\u00a05137, pp. 108\u2013125. Springer, Heidelberg (2008)"},{"key":"13_CR17","unstructured":"Rieck, K., Trinius, P., Willems, C., Holz, T.: Automatic analysis of malware behavior using machine learning. Technical Report 18-2009, Berlin Institute of Technology (2009)"},{"key":"13_CR18","doi-asserted-by":"crossref","unstructured":"Song, D., Brumley, D., Yin, H., Caballero, J., Jager, I., Kang, M.G., Liang, Z., Newsome, J., Poosankam, P., Saxena, P.: Bitblaze: A new approach to computer security via binary analysis. In: Proceedings of the 4th International Conference on Information Systems Security (December 2008)","DOI":"10.1007\/978-3-540-89862-7_1"},{"key":"13_CR19","unstructured":"Symantec. Spyware.e2give, http:\/\/www.symantec.com\/security_response\/writeup.jsp?docid=2004-102614-1006-99"},{"key":"13_CR20","unstructured":"Symantec. Xeram.1664, http:\/\/www.symantec.com\/security_response\/writeup.jsp?docid=2000-121913-2839-99"},{"key":"13_CR21","unstructured":"Tamada, H., Okamoto, K., Nakamura, M., Monden, A., Matsumoto, K.: Dynamic software birthmarks to detect the theft of windows applications. In: International Symposium on Future Software Technology (2004)"},{"key":"13_CR22","volume-title":"Introduction to Data Mining","author":"P. Tan","year":"2006","unstructured":"Tan, P., Steinbach, M., Kumar, V.: Introduction to Data Mining. Addison-Wesley, Reading (2006)"},{"key":"13_CR23","doi-asserted-by":"crossref","unstructured":"Wang, X., Jhi, Y., Zhu, S., Liu, P.: Detecting software theft via system call based birthmarks. In: Proceedings of 25th Annual Computer Security Applications Conference (2009)","DOI":"10.1109\/ACSAC.2009.24"},{"key":"13_CR24","doi-asserted-by":"crossref","unstructured":"Whale, G.: Identification of program similarity in large populations. Computer Journal, Special Issue on Procedural Programming, 140\u2013146 (1990)","DOI":"10.1093\/comjnl\/33.2.140"},{"key":"13_CR25","doi-asserted-by":"crossref","unstructured":"Willems, C., Holz, T., Freiling, F.: Toward automated dynamic malware analysis using cwsandbox. In: Proceedings of the 2007 IEEE Symposium on Security and Privacy (S&P 2007), pp. 32\u201339 (2007)","DOI":"10.1109\/MSP.2007.45"},{"key":"13_CR26","doi-asserted-by":"crossref","unstructured":"Wise, M.J.: Detection of similarities in student programs: Yaping may be preferable to plagueing. In: Proceedings of the 23rd SIGCSE Technical Symposium (1992)","DOI":"10.1145\/134510.134564"}],"container-title":["Lecture Notes in Computer Science","Recent Advances in Intrusion Detection"],"original-title":[],"link":[{"URL":"http:\/\/link.springer.com\/content\/pdf\/10.1007\/978-3-642-15512-3_13.pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2020,11,24]],"date-time":"2020-11-24T03:09:17Z","timestamp":1606187357000},"score":1,"resource":{"primary":{"URL":"http:\/\/link.springer.com\/10.1007\/978-3-642-15512-3_13"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2010]]},"ISBN":["9783642155116","9783642155123"],"references-count":26,"URL":"https:\/\/doi.org\/10.1007\/978-3-642-15512-3_13","relation":{},"ISSN":["0302-9743","1611-3349"],"issn-type":[{"value":"0302-9743","type":"print"},{"value":"1611-3349","type":"electronic"}],"subject":[],"published":{"date-parts":[[2010]]}}}