{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2024,9,9]],"date-time":"2024-09-09T15:43:35Z","timestamp":1725896615790},"publisher-location":"Berlin, Heidelberg","reference-count":56,"publisher":"Springer Berlin Heidelberg","isbn-type":[{"type":"print","value":"9783642368820"},{"type":"electronic","value":"9783642368837"}],"license":[{"start":{"date-parts":[[2013,1,1]],"date-time":"2013-01-01T00:00:00Z","timestamp":1356998400000},"content-version":"unspecified","delay-in-days":0,"URL":"http:\/\/www.springer.com\/tdm"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2013]]},"DOI":"10.1007\/978-3-642-36883-7_8","type":"book-chapter","created":{"date-parts":[[2013,2,13]],"date-time":"2013-02-13T00:45:18Z","timestamp":1360716318000},"page":"112-130","source":"Crossref","is-referenced-by-count":3,"title":["JSGuard: Shellcode Detection in JavaScript"],"prefix":"10.1007","author":[{"given":"Boxuan","family":"Gu","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Wenbin","family":"Zhang","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Xiaole","family":"Bai","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Adam C.","family":"Champion","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Feng","family":"Qin","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Dong","family":"Xuan","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"297","reference":[{"key":"8_CR1","unstructured":"Alexa Top Sites, http:\/\/www.alexa.com\/topsites"},{"key":"8_CR2","unstructured":"Bania, P.: TAPiON (2005), http:\/\/pb.specialised.info\/all\/tapion\/"},{"key":"8_CR3","unstructured":"Baratloo, A., Singh, N., Tsai, T.: Transparent Run-Time Defense Against Stack Smashing Attacks. In: USENIX Annual Technical Conf. (2000)"},{"key":"8_CR4","doi-asserted-by":"crossref","unstructured":"Barrantes, E.G., Ackley, D.H., Forrest, S., Palmer, T.S., Stefanovi\u0107, D., Zovi, D.D.: Randomized Instruction Set Emulation to Disrupt Binary Code Injection Attacks. In: CCS (2003)","DOI":"10.1145\/948109.948147"},{"key":"8_CR5","doi-asserted-by":"crossref","unstructured":"Bayer, U., Moser, A., Kruegel, C., Kirda, E.: Dynamic Analysis of Malicious Code. Journal of Computer Virology (2006)","DOI":"10.1007\/s11416-006-0012-2"},{"key":"8_CR6","unstructured":"Bhatkar, S., DuVarney, D.C., Sekar, R.: Address Obfuscation: An Efficient Approach to Combat a Broad Range of Memory Error Exploits. USENIX Security (2003)"},{"key":"8_CR7","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1007\/978-3-540-70542-0_1","volume-title":"Detection of Intrusions and Malware, and Vulnerability Assessment","author":"S. Bhatkar","year":"2008","unstructured":"Bhatkar, S., Sekar, R.: Data Space Randomization. In: Zamboni, D. (ed.) DIMVA 2008. LNCS, vol.\u00a05137, pp. 1\u201322. Springer, Heidelberg (2008)"},{"key":"8_CR8","doi-asserted-by":"crossref","unstructured":"Bouch, A., Kuchinsky, A., Bhatti, N.: Quality is in the Eye of the Beholder: Meeting Users\u2019 Requirements for Internet Quality of Service. In: CHI (2000)","DOI":"10.1145\/332040.332447"},{"key":"8_CR9","doi-asserted-by":"crossref","unstructured":"Canali, D., Cova, M., Kruegel, C., Vigna, G.: Prophiler: A Fast Filter for the Large-Scale Detection of Malicious Web Pages. In: WWW (March 2011)","DOI":"10.1145\/1963405.1963436"},{"key":"8_CR10","unstructured":"Chenette, S.: Toorconx the ultimate deobfuscator (2008), http:\/\/www.toorcon.org\/tcx\/26_Chenette.pdf"},{"key":"8_CR11","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"284","DOI":"10.1007\/11663812_15","volume-title":"Recent Advances in Intrusion Detection","author":"R. Chinchani","year":"2006","unstructured":"Chinchani, R., van den Berg, E.: A Fast Static Analysis Approach to Detect Exploit Code Inside Network Flows. In: Valdes, A., Zamboni, D. (eds.) RAID 2005. LNCS, vol.\u00a03858, pp. 284\u2013308. Springer, Heidelberg (2006)"},{"key":"8_CR12","unstructured":"Christodorescu, M., Jha, S.: Static Analysis of Executables to Detect Malicious Patterns. USENIX Security (2003)"},{"key":"8_CR13","doi-asserted-by":"crossref","unstructured":"Christodorescu, M., Jha, S., Seshia, S., Song, D., Bryant, R.E.: Semantics-Aware Malware Detection. IEEE S&P (2005)","DOI":"10.1109\/SP.2005.20"},{"key":"8_CR14","doi-asserted-by":"crossref","unstructured":"Cova, M., Kruegel, C., Vigna, G.: Detection and Analysis of Drive-by-Download Attacks and Malicious JavaScript Code. In: WWW (2010)","DOI":"10.1145\/1772690.1772720"},{"key":"8_CR15","unstructured":"Curtsinger, C., Livshits, B., Zorn, B., Seifert, C.: Zozzle: Fast and Precise In-Browser JavaScript Malware Detection. USENIX Security (2011)"},{"key":"8_CR16","unstructured":"Detristan, T., Ulenspiegel, T., Malcom, Y., van Underduk, M.S.: Polymorphic Shellcode Engine Using Spectrum Analysis. Phrack (2003), http:\/\/www.phrack.org"},{"key":"8_CR17","doi-asserted-by":"crossref","unstructured":"Ding, Y., Wei, T., Wang, T., Liang, Z., Zou, W.: Heap Taichi: Exploiting Memory Allocation Granularity in Heap-Spraying Attacks. In: ACSAC (2010)","DOI":"10.1145\/1920261.1920310"},{"key":"8_CR18","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"88","DOI":"10.1007\/978-3-642-02918-9_6","volume-title":"Detection of Intrusions and Malware, and Vulnerability Assessment","author":"M. Egele","year":"2009","unstructured":"Egele, M., Wurzinger, P., Kruegel, C., Kirda, E.: Defending Browsers against Drive-by Downloads: Mitigating Heap-Spraying Code Injection Attacks. In: Flegel, U., Bruschi, D. (eds.) DIMVA 2009. LNCS, vol.\u00a05587, pp. 88\u2013106. Springer, Heidelberg (2009)"},{"key":"8_CR19","unstructured":"Feinstein, B., Peck, D.: Caffeine Monkey, http:\/\/www.secureworks.com\/research\/blog\/wp-content\/uploads\/CaffeineMonkey_DEFCON15.pdf"},{"key":"8_CR20","doi-asserted-by":"crossref","unstructured":"Fogie, S., Grossman, J., Hansen, R., Rager, A.: XSS Attacks: Cross Site Scripting Exploits and Defense. Syngress (May 2007)","DOI":"10.1016\/B978-159749154-9\/50005-6"},{"key":"8_CR21","unstructured":"Frei, S., Duebendorfer, T., Ollmann, G., May, M.: Understanding the web browser threat. In: DefCon 16 (August 2008)"},{"key":"8_CR22","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1007\/978-3-642-11747-3_1","volume-title":"Engineering Secure Software and Systems","author":"F. Gadaleta","year":"2010","unstructured":"Gadaleta, F., Younan, Y., Joosen, W.: BuBBle: A Javascript Engine Level Countermeasure against Heap-Spraying Attacks. In: Massacci, F., Wallach, D., Zannone, N. (eds.) ESSoS 2010. LNCS, vol.\u00a05965, pp. 1\u201317. Springer, Heidelberg (2010)"},{"key":"8_CR23","doi-asserted-by":"crossref","unstructured":"Gu, B., Bai, X., Yang, Z., Champion, A.C., Xuan, D.: Malicious Shellcode Detection with Virtual Memory Snapshots. In: INFOCOM, pp. 974\u2013982 (2010)","DOI":"10.1109\/INFCOM.2010.5461950"},{"key":"8_CR24","unstructured":"Ionescu, C.: GetPC code, http:\/\/securityfocus.com\/archive\/82\/327348\/2006-01-03\/1"},{"key":"8_CR25","unstructured":"Kc, G.S., Keromytis, A.D.: e-nexsh: Achieving an Effectively Non-Executable Stack and Heap via System-Call Policing. In: ACSAC (2005)"},{"key":"8_CR26","doi-asserted-by":"crossref","unstructured":"Kc, G.S., Keromytis, A.D., Prevelakis, V.: Countering Code-Injection Attacks with Instruction-Set Randomization. In: CCS (2003)","DOI":"10.1145\/948109.948146"},{"key":"8_CR27","doi-asserted-by":"crossref","unstructured":"Lakhotia, A., Eric, U.: Stack Shape Analysis to Detect Obfuscated Calls in Binaries. In: IEEE Int\u2019l. Conf. on Source Code Analysis and Manipulation (2004)","DOI":"10.1109\/SCAM.2004.2"},{"key":"8_CR28","unstructured":"libemu, http:\/\/libemu.carnivore.it\/"},{"key":"8_CR29","doi-asserted-by":"crossref","unstructured":"Lu, L., Yegneswaran, V., Porras, P., Lee, W.: BLADE: An Attack-Agnostic Approach for Preventing Drive-By Malware Infections. In: CCS (2010)","DOI":"10.1145\/1866307.1866356"},{"key":"8_CR30","unstructured":"Macaulay, S.: ADMMutate: Polymorphic Shellcode Engine, http:\/\/www.ktwo.ca\/security.html"},{"key":"8_CR31","doi-asserted-by":"crossref","unstructured":"Mason, J., Small, S., Monrose, F., MacManus, G.: English Shellcode. In: CCS (2009)","DOI":"10.1145\/1653662.1653725"},{"key":"8_CR32","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1007\/978-3-540-74320-0_1","volume-title":"Recent Advances in Intrusion Detection","author":"D. Mutz","year":"2007","unstructured":"Mutz, D., Robertson, W., Vigna, G., Kemmerer, R.A.: Exploiting Execution Context for the Detection of Anomalous System Calls. In: Kruegel, C., Lippmann, R., Clark, A. (eds.) RAID 2007. LNCS, vol.\u00a04637, pp. 1\u201320. Springer, Heidelberg (2007)"},{"issue":"3","key":"8_CR33","first-page":"153","volume":"23","author":"F.F.-H. Nah","year":"2004","unstructured":"Nah, F.F.-H.: A Study on Tolerable Waiting Time: How Long are Web Users Willing to Wait? Behaviour & IT\u00a023(3), 153\u2013163 (2004)","journal-title":"Behaviour & IT"},{"key":"8_CR34","unstructured":"Newsome, J., Song, D.: Dynamic Taint Analysis for Automatic Detection, Analysis, and Signature Generation of Exploits on Commodity Software. In: NDSS (2005)"},{"key":"8_CR35","unstructured":"Obscou. Building IA32 \u2019Unicode-Proof\u2019 Shellcodes. Phrack (2003), http:\/\/www.phrack.org\/"},{"key":"8_CR36","unstructured":"PaX, http:\/\/pax.grsecurity.net\/docs\/aslr.txt"},{"key":"8_CR37","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"crossref","first-page":"54","DOI":"10.1007\/11790754_4","volume-title":"Detection of Intrusions and Malware & Vulnerability Assessment","author":"M. Polychronakis","year":"2006","unstructured":"Polychronakis, M., Anagnostakis, K.G., Markatos, E.P.: Network\u2013Level Polymorphic Shellcode Detection Using Emulation. In: B\u00fcschkes, R., Laskov, P. (eds.) DIMVA 2006. LNCS, vol.\u00a04064, pp. 54\u201373. Springer, Heidelberg (2006)"},{"key":"8_CR38","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"87","DOI":"10.1007\/978-3-540-74320-0_5","volume-title":"Recent Advances in Intrusion Detection","author":"M. Polychronakis","year":"2007","unstructured":"Polychronakis, M., Anagnostakis, K.G., Markatos, E.P.: Emulation-Based Detection of Non-self-contained Polymorphic Shellcode. In: Kruegel, C., Lippmann, R., Clark, A. (eds.) RAID 2007. LNCS, vol.\u00a04637, pp. 87\u2013106. Springer, Heidelberg (2007)"},{"key":"8_CR39","doi-asserted-by":"crossref","unstructured":"Polychronakis, M., Anagnostakis, K.G., Markatos, E.P.: Comprehensive shellcode detection using runtime heuristics. In: ACSAC (December 2010)","DOI":"10.1145\/1920261.1920305"},{"key":"8_CR40","unstructured":"Provos, N., Mavrommatis, P., Rajab, M.A., Monrose, F.: All Your iFRAMEs Point to Us. USENIX Security (2008)"},{"key":"8_CR41","unstructured":"Provos, N., McNamee, D., Mavrommatis, P., Wang, K., Modadugu, N.: The Ghost In the Browser: Analysis of Web-based Malware. In: HotBots (2007)"},{"key":"8_CR42","doi-asserted-by":"crossref","unstructured":"Qin, F., Wang, C., Li, Z., Kim, H.-S., Zhou, Y., Wu, Y.: LIFT: A Low-Overhead Practical Information Flow Tracking System for Detecting Security Attacks. In: MICRO (2006)","DOI":"10.1109\/MICRO.2006.29"},{"key":"8_CR43","unstructured":"Ratanaworabhan, P., Livshits, B., Zorn, B.: NOZZLE: A Defense Against Heap-spraying Code Injection Attacks. USENIX Security (2009)"},{"key":"8_CR44","doi-asserted-by":"crossref","unstructured":"Rieck, K., Krueger, T., Dewald, A.: Cujo: Efficient Detection and Prevention of Drive-by-Download Attacks. In: ACSAC (December 2010)","DOI":"10.1145\/1920261.1920267"},{"key":"8_CR45","unstructured":"Secunia. Secunia PSI study: 28% of all detected applications are insecure (2007), http:\/\/secunia.com\/blog\/11"},{"key":"8_CR46","unstructured":"Snow, K.Z., Krishnan, S., Monrose, F.: Shellos: Enabling fast detection and forensic analysis of code injection attacks. USENIX Security (2011)"},{"key":"8_CR47","unstructured":"Sotirov, A.: Heap Feng Shui in JavaScript. In: BlackHat Europe (2007)"},{"key":"8_CR48","unstructured":"Sotirov, A., Dowd, M.: Bypassing Browser Memory Protections. In: BlackHat (2008)"},{"key":"8_CR49","unstructured":"SpiderMonkey JavaScript engine, http:\/\/www.mozilla.org\/js\/spidermonkey\/"},{"key":"8_CR50","unstructured":"The Bastard Disassembly Environment, http:\/\/bastard.sourceforge.net"},{"key":"8_CR51","unstructured":"The Metasploit Project, http:\/\/www.metasploit.com"},{"key":"8_CR52","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"274","DOI":"10.1007\/3-540-36084-0_15","volume-title":"Recent Advances in Intrusion Detection","author":"T. T\u00f3th","year":"2002","unstructured":"T\u00f3th, T., Kruegel, C.: Accurate Buffer Overflow Detection via Abstract Payload Execution. In: Wespi, A., Vigna, G., Deri, L. (eds.) RAID 2002. LNCS, vol.\u00a02516, pp. 274\u2013291. Springer, Heidelberg (2002)"},{"key":"8_CR53","unstructured":"Vulnerability Note VU#492515: Microsoft Internet Explorer HTML object memory corruption vulnerability, http:\/\/www.kb.cert.org\/vuls\/id\/492515"},{"key":"8_CR54","doi-asserted-by":"crossref","unstructured":"Wang, X., Jhi, Y.-C., Zhu, S., Liu, P.: STILL: Exploit Code Detection via Static Taint and Initialization Analyses. In: ACSAC (2008)","DOI":"10.1109\/ACSAC.2008.37"},{"key":"8_CR55","unstructured":"Wang, X., Pan, C.-C., Liu, P., Zhu, S.: SigFree: A Signature-Free Buffer Overflow Attack Blocker. USENIX Security (2006)"},{"key":"8_CR56","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"61","DOI":"10.1007\/978-3-642-23644-0_4","volume-title":"Recent Advances in Intrusion Detection","author":"Y. Fratantonio","year":"2011","unstructured":"Fratantonio, Y., Kruegel, C., Vigna, G.: Shellzer: A Tool for the Dynamic Analysis of Malicious Shellcode. In: Sommer, R., Balzarotti, D., Maier, G. (eds.) RAID 2011. LNCS, vol.\u00a06961, pp. 61\u201380. Springer, Heidelberg (2011)"}],"container-title":["Lecture Notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering","Security and Privacy in Communication Networks"],"original-title":[],"link":[{"URL":"http:\/\/link.springer.com\/content\/pdf\/10.1007\/978-3-642-36883-7_8","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2020,7,22]],"date-time":"2020-07-22T07:02:36Z","timestamp":1595401356000},"score":1,"resource":{"primary":{"URL":"http:\/\/link.springer.com\/10.1007\/978-3-642-36883-7_8"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2013]]},"ISBN":["9783642368820","9783642368837"],"references-count":56,"URL":"https:\/\/doi.org\/10.1007\/978-3-642-36883-7_8","relation":{},"ISSN":["1867-8211","1867-822X"],"issn-type":[{"type":"print","value":"1867-8211"},{"type":"electronic","value":"1867-822X"}],"subject":[],"published":{"date-parts":[[2013]]}}}