{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,6,26]],"date-time":"2025-06-26T16:09:11Z","timestamp":1750954151109,"version":"3.28.0"},"reference-count":32,"publisher":"IEEE","content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2013,10]]},"DOI":"10.1109\/cns.2013.6682722","type":"proceedings-article","created":{"date-parts":[[2013,12,17]],"date-time":"2013-12-17T19:48:17Z","timestamp":1387309697000},"page":"323-331","source":"Crossref","is-referenced-by-count":3,"title":["Using instruction sequence abstraction for shellcode detection and attribution"],"prefix":"10.1109","author":[{"family":"Ziming Zhao","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"family":"Gail-Joon Ahn","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"263","reference":[{"key":"19","article-title":"Hamsa: Fast signature generation for zero-day polymorphicworms with provable attack resilience","author":"li","year":"0","journal-title":"S&P'06"},{"key":"17","first-page":"207","article-title":"Polymorphic worm detection using structural information of executables","author":"kruegel","year":"2006","journal-title":"RAID'06"},{"key":"18","doi-asserted-by":"publisher","DOI":"10.1145\/161494.161501"},{"key":"15","first-page":"2721","article-title":"Learning to detect and classify malicious executables in the wild","volume":"7","author":"zico","year":"2006","journal-title":"Journal of Machine Learning Research"},{"key":"16","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-31909-9_11"},{"key":"13","first-page":"241","article-title":"Polymorphic blending attacks","author":"fogla","year":"2006","journal-title":"USENIX Security'06"},{"key":"14","doi-asserted-by":"publisher","DOI":"10.1093\/comjnl\/23.3.223"},{"key":"11","doi-asserted-by":"publisher","DOI":"10.1007\/BF00994018"},{"key":"12","article-title":"Polymorphic shellcode engine using spectrum analysis","author":"detristan","year":"2003","journal-title":"Phrack Magazine"},{"key":"21","doi-asserted-by":"publisher","DOI":"10.1145\/948148.948149"},{"key":"20","doi-asserted-by":"publisher","DOI":"10.1109\/ICNP.2007.4375847"},{"key":"22","doi-asserted-by":"publisher","DOI":"10.1145\/1653662.1653725"},{"journal-title":"The Metasploit Project","year":"2009","author":"moore","key":"23"},{"key":"24","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2005.15"},{"key":"25","doi-asserted-by":"publisher","DOI":"10.1145\/1806672.1806678"},{"key":"26","doi-asserted-by":"publisher","DOI":"10.1007\/s10994-009-5143-5"},{"key":"27","first-page":"274","article-title":"Accurate buffer overflow detection via abstract payload execution","author":"toth","year":"0","journal-title":"RAID'02"},{"key":"28","first-page":"227","article-title":"Anomalous payload-based worm detection and signature generation","author":"wang","year":"0","journal-title":"RAID'06"},{"key":"29","doi-asserted-by":"publisher","DOI":"10.1109\/ACSAC.2008.37"},{"key":"3","first-page":"375","article-title":"Stride: Polymorphic sled detection through instruction sequence analysis","author":"akritidis","year":"0","journal-title":"SECON'05"},{"journal-title":"Intel 8086 Family User's Manual","year":"1979","key":"2"},{"key":"10","doi-asserted-by":"publisher","DOI":"10.1109\/ICSM.1997.624245"},{"journal-title":"IDA Pro Disassembler","year":"0","key":"1"},{"key":"30","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2008.30"},{"key":"7","doi-asserted-by":"publisher","DOI":"10.1007\/11663812_15"},{"key":"6","doi-asserted-by":"publisher","DOI":"10.1145\/1961189.1961199"},{"key":"32","doi-asserted-by":"publisher","DOI":"10.1145\/1866307.1866368"},{"key":"5","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2006.41"},{"key":"31","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-23808-6_34"},{"key":"4","doi-asserted-by":"publisher","DOI":"10.1145\/130385.130401"},{"key":"9","first-page":"236","article-title":"Advanced allergy attacks: Does a corpus really help?","author":"chung","year":"0","journal-title":"RAID 07"},{"key":"8","first-page":"32","article-title":"Semanticsaware malware detection","author":"christodorescu","year":"0","journal-title":"S&P'05"}],"event":{"name":"2013 IEEE Conference on Communications and Network Security (CNS)","start":{"date-parts":[[2013,10,14]]},"location":"National Harbor, MD, USA","end":{"date-parts":[[2013,10,16]]}},"container-title":["2013 IEEE Conference on Communications and Network Security (CNS)"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/6675898\/6682673\/06682722.pdf?arnumber=6682722","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2017,3,23]],"date-time":"2017-03-23T00:21:51Z","timestamp":1490228511000},"score":1,"resource":{"primary":{"URL":"http:\/\/ieeexplore.ieee.org\/document\/6682722\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2013,10]]},"references-count":32,"URL":"https:\/\/doi.org\/10.1109\/cns.2013.6682722","relation":{},"subject":[],"published":{"date-parts":[[2013,10]]}}}