{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,4,19]],"date-time":"2025-04-19T05:08:23Z","timestamp":1745039303299},"reference-count":45,"publisher":"IEEE","content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2010,3]]},"DOI":"10.1109\/infcom.2010.5461950","type":"proceedings-article","created":{"date-parts":[[2010,5,12]],"date-time":"2010-05-12T20:54:40Z","timestamp":1273697680000},"page":"1-9","source":"Crossref","is-referenced-by-count":13,"title":["Malicious Shellcode Detection with Virtual Memory Snapshots"],"prefix":"10.1109","author":[{"given":"Boxuan","family":"Gu","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Xiaole","family":"Bai","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Zhimin","family":"Yang","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Adam C.","family":"Champion","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Dong","family":"Xuan","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"263","reference":[{"year":"0","key":"ref39"},{"key":"ref38","article-title":"Exploiting Execution Contexts for the Detection of Anomalous System Calls","author":"mutz","year":"2007","journal-title":"Proc RAID"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1145\/948109.948147"},{"key":"ref32","article-title":"Swarm Attacks against Network-Level Emulation\/Analysis","author":"chung","year":"2008","journal-title":"Proc RAID"},{"journal-title":"Shellcode text encoding utility for 7bit shellcode","year":"0","key":"ref31"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1007\/s11416-006-0012-2"},{"journal-title":"Getpc code","year":"0","author":"ionescu","key":"ref37"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1109\/ACSAC.2008.37"},{"key":"ref35","article-title":"Data Space Randomization","author":"bhatkar","year":"2008","journal-title":"Proc DIMVA"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1145\/948109.948146"},{"year":"0","key":"ref10"},{"journal-title":"The Metasploit Project","year":"0","key":"ref40"},{"key":"ref11","article-title":"RAD: A Compile-Time Solution to Buffer Overflow Attacks","author":"chiueh","year":"2001","journal-title":"Proc IEEE ICDCS"},{"key":"ref12","article-title":"PointGuard™: Protecting Pointers from Buffer Overflow Vulnerabilities","author":"cowan","year":"2003","journal-title":"Proc Usenix Security"},{"key":"ref13","article-title":"DIRA: Automatic Detection, Identification, and Repair of Control Hijacking Attacks","author":"smirnov","year":"2005","journal-title":"Proc NDSS"},{"key":"ref14","article-title":"Transparent Run-Time Defense Against Stack Smashing Attacks","author":"baratloo","year":"2000","journal-title":"Proc Usenix Annual Technical Conf"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1109\/CSAC.2005.22"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1109\/ITRE.2003.1270612"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1145\/1352592.1352622"},{"key":"ref18","article-title":"Accurate Buffer Overflow Detection via Abstract Payload Execution","author":"toth","year":"2002","journal-title":"Proc RAID"},{"key":"ref19","article-title":"Static Analysis of Executables to Detect Malicious Patterns","author":"christodorescu","year":"2003","journal-title":"Proc Usenix Security"},{"journal-title":"ADMmutate Polymorphic Shellcode Engine","year":"0","author":"macaulay","key":"ref28"},{"key":"ref4","article-title":"LIFT: A Low-Overhead Practical Information Flow Tracking System for Detecting Security Attacks","author":"qin","year":"2006","journal-title":"Proc IEEE\/ACM Int Symp Microarchitecture (MICRO)"},{"key":"ref27","article-title":"Polymorphic Shellcode Engine Using Spectrum Analysis","author":"detristan","year":"2003","journal-title":"Phrack"},{"key":"ref3","article-title":"Vulnerability-Specific Execution Filtering for Exploit Prevention on Commodity Software","author":"brumley","year":"2006","journal-title":"Proc NDSS"},{"journal-title":"Pax","year":"0","key":"ref6"},{"key":"ref29","article-title":"SigFree: A Signature-Free Buffer Overflow Attack Blocker","author":"wang","year":"2006","journal-title":"Proc Usenix Security"},{"key":"ref5","article-title":"Transparent Runtime Randomization for Security","author":"xu","year":"2003","journal-title":"Proc Symp Reliable Distributed Systems"},{"key":"ref8","article-title":"StackGuard: Automatic Adaptive Detection and Prevention of Buffer-Overflow Attacks","author":"cowan","year":"1998","journal-title":"Proc Usenix Security"},{"key":"ref7","article-title":"Address Obfuscation: An Efficient Approach to Combat a Broad Range of Memory Error Exploits","author":"bhatkar","year":"2003","journal-title":"Proc Usenix Security"},{"key":"ref2","article-title":"Dynamic Taint Analysis for Automatic Detection, Analysis, and Signature Generation of Exploits on Commodity Software","author":"newsome","year":"2005","journal-title":"Proc NDSS"},{"journal-title":"Protecting from stack-smashing attacks","year":"0","author":"etoh","key":"ref9"},{"journal-title":"US-CERT Vulnerability Notes Database","year":"0","key":"ref1"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2005.20"},{"key":"ref45","article-title":"The Geometry of Innocent Flesh on the Bone: Return-intolibc without Function Calls (on the x86)","author":"shacham","year":"2007","journal-title":"Proc ACM CCS"},{"key":"ref22","article-title":"Network-level Polymorphic Shellcode Detection Using Emulation","author":"polychronakis","year":"2006","journal-title":"Proc DIMVA"},{"key":"ref21","doi-asserted-by":"crossref","DOI":"10.1109\/SCAM.2004.2","article-title":"Stack Shape Analysis to Detect Obfuscated Calls in Binaries","author":"lakhotia","year":"2004","journal-title":"IEEE Int Conf on Source Code Analysis and Manipulation"},{"year":"0","key":"ref42"},{"year":"0","key":"ref24"},{"journal-title":"Tapion","year":"2005","author":"bania","key":"ref41"},{"key":"ref23","article-title":"Emulation-Based Detection of Non-Self-Contained Polymorphic Shellcode","author":"lakhotia","year":"2007","journal-title":"Proc RAID"},{"year":"0","key":"ref44"},{"key":"ref26","article-title":"A Fast Static Analysis Approach to Detect Exploit Code Inside Network Flows","author":"chinchani","year":"2005","journal-title":"Proc RAID"},{"year":"0","key":"ref43"},{"year":"0","key":"ref25"}],"event":{"name":"IEEE INFOCOM 2010 - IEEE Conference on Computer Communications","start":{"date-parts":[[2010,3,14]]},"location":"San Diego, CA, USA","end":{"date-parts":[[2010,3,19]]}},"container-title":["2010 Proceedings IEEE INFOCOM"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx5\/5461675\/5461899\/05461950.pdf?arnumber=5461950","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2019,5,29]],"date-time":"2019-05-29T04:13:32Z","timestamp":1559103212000},"score":1,"resource":{"primary":{"URL":"http:\/\/ieeexplore.ieee.org\/document\/5461950\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2010,3]]},"references-count":45,"URL":"https:\/\/doi.org\/10.1109\/infcom.2010.5461950","relation":{},"subject":[],"published":{"date-parts":[[2010,3]]}}}