{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,8,28]],"date-time":"2026-08-28T02:02:02Z","timestamp":1787882522795,"version":"build-2784847793"},"reference-count":35,"publisher":"IEEE","license":[{"start":{"date-parts":[[2008,6,1]],"date-time":"2008-06-01T00:00:00Z","timestamp":1212278400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2008,6,1]],"date-time":"2008-06-01T00:00:00Z","timestamp":1212278400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2008,6]]},"DOI":"10.1109\/dsn.2008.4630092","type":"proceedings-article","created":{"date-parts":[[2008,9,26]],"date-time":"2008-09-26T11:10:29Z","timestamp":1222427429000},"page":"237-246","source":"Crossref","is-referenced-by-count":1,"title":["AGIS: Towards automatic generation of infection signatures"],"prefix":"10.1109","author":[{"family":"Zhuowei Li","sequence":"first","affiliation":[{"name":"Indiana University at Bloomington, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"family":"XiaoFeng Wang","sequence":"additional","affiliation":[{"name":"Indiana University at Bloomington, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"family":"Zhenkai Liang","sequence":"additional","affiliation":[{"name":"Carnegie Mellon University, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Michael K.","family":"Reiter","sequence":"additional","affiliation":[{"name":"University of North Carolina at Chapel Hill, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"19","first-page":"296","article-title":"spyshield: preserving privacy from spy add-ons","author":"li","year":"2007","journal-title":"RAID"},{"key":"35","doi-asserted-by":"publisher","DOI":"10.1109\/ACSAC.2007.9"},{"key":"17","doi-asserted-by":"publisher","DOI":"10.1145\/972374.972384"},{"key":"18","doi-asserted-by":"publisher","DOI":"10.1145\/1096000.1096004"},{"key":"33","doi-asserted-by":"publisher","DOI":"10.1145\/1102120.1102151"},{"key":"15","doi-asserted-by":"publisher","DOI":"10.1145\/945465.945467"},{"key":"34","doi-asserted-by":"crossref","DOI":"10.1145\/1315245.1315261","article-title":"panorama: capturing system-wide information flow for malware detection and analysis","author":"yin","year":"2007","journal-title":"Proceedings of the 14th ACM Conferences on Computer and Communication Security (CCS'07)"},{"key":"16","article-title":"behavior-based spyware detection","author":"kirda","year":"2006","journal-title":"Proceedings of USENIX Security Symposium 2006"},{"key":"13","year":"0"},{"key":"14","first-page":"271","article-title":"autograph: toward automated, distributed worm signature detection","author":"kim","year":"2004","journal-title":"Proceedings of 13th USENIX Security Symposium"},{"key":"11","first-page":"135","article-title":"detours: binary interception of win32 functions","author":"hunt","year":"1999","journal-title":"Proceedings of the 3rd USENIX Windows NT Symposium(WIN-NT-99"},{"key":"12","doi-asserted-by":"publisher","DOI":"10.1109\/ICDCS.2006.69"},{"key":"21","article-title":"vulnerabilityspecific execution filtering for exploit prevention on commodity software","author":"newsome","year":"2006","journal-title":"Proceedings of the 13th Annual Network and Distributed Systems Security Symposium"},{"key":"20","doi-asserted-by":"publisher","DOI":"10.1145\/1102120.1102150"},{"key":"22","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2005.15"},{"key":"23","year":"0"},{"key":"24","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2006.09.005"},{"key":"25","doi-asserted-by":"publisher","DOI":"10.1145\/222124.222138"},{"key":"26","first-page":"63","article-title":"synthesizing fast intrusion detection\/prevention systems from highlevel specificationsn","author":"sekar","year":"1999","journal-title":"Proceedings of USENIX Security Symposium"},{"key":"27","doi-asserted-by":"publisher","DOI":"10.1109\/MSP.2005.144"},{"key":"28","first-page":"45","article-title":"automated worm fingerprinting","author":"singh","year":"2004","journal-title":"Proceedings of OSDI"},{"key":"29","year":"0","journal-title":"The digital immune system"},{"key":"3","doi-asserted-by":"publisher","DOI":"10.1145\/1007512.1007518"},{"key":"2","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2006.41"},{"key":"10","doi-asserted-by":"publisher","DOI":"10.1109\/ACSAC.2006.16"},{"key":"1","doi-asserted-by":"publisher","DOI":"10.1145\/1134760.1220164"},{"key":"30","article-title":"defending against internet worms: a signature-based approach","author":"tang","year":"2005","journal-title":"Proceedings of IEEE Infocom"},{"key":"7","doi-asserted-by":"publisher","DOI":"10.1109\/MICRO.2004.26"},{"key":"6","doi-asserted-by":"publisher","DOI":"10.1145\/1095810.1095824"},{"key":"32","article-title":"gatekeeper: monitoring autostart extensibility points (aseps) for spyware management","author":"wang","year":"2004","journal-title":"USENIX USA 2004"},{"key":"5","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2005.20"},{"key":"31","doi-asserted-by":"publisher","DOI":"10.1109\/ACSAC.2006.34"},{"key":"4","article-title":"static analysis of executables to detect malicious patterns","author":"christodorescu","year":"2003","journal-title":"Usenix Sexurity Symposium"},{"key":"9","article-title":"dynamic spyware analysis","author":"egele","year":"0","journal-title":"To appear in the 2007 USENIX Annual Technical Conference"},{"key":"8","doi-asserted-by":"publisher","DOI":"10.1145\/1102120.1102152"}],"event":{"name":"2008 IEEE International Conference on Dependable Systems & Networks With FTCS and DCC (DSN)","location":"Anchorage, AK, USA","start":{"date-parts":[[2008,6,24]]},"end":{"date-parts":[[2008,6,27]]}},"container-title":["2008 IEEE International Conference on Dependable Systems and Networks With FTCS and DCC (DSN)"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx5\/4610267\/4630050\/04630092.pdf?arnumber=4630092","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,8,28]],"date-time":"2025-08-28T18:03:15Z","timestamp":1756404195000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/4630092\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2008,6]]},"references-count":35,"URL":"https:\/\/doi.org\/10.1109\/dsn.2008.4630092","relation":{},"subject":[],"published":{"date-parts":[[2008,6]]}}}