{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,4]],"date-time":"2026-03-04T16:37:50Z","timestamp":1772642270432,"version":"3.50.1"},"reference-count":41,"publisher":"IEEE","content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2009,10]]},"DOI":"10.1109\/lcn.2009.5355037","type":"proceedings-article","created":{"date-parts":[[2009,12,24]],"date-time":"2009-12-24T13:26:49Z","timestamp":1261661209000},"page":"891-898","source":"Crossref","is-referenced-by-count":20,"title":["Measuring similarity of malware behavior"],"prefix":"10.1109","author":[{"given":"Martin","family":"Apel","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Christian","family":"Bockermann","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Michael","family":"Meier","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"263","reference":[{"key":"ref39","author":"sneath","year":"1973","journal-title":"Numerical Taxonomy"},{"key":"ref38","first-page":"23","article-title":"Linear-time computation of similarity measures for sequential data","volume":"9","author":"rieck","year":"2008","journal-title":"Journal of Machine Learning Research (JMLR)"},{"key":"ref33","first-page":"244","article-title":"Feature-based and feature-free textual cbr: A comparison in spam filtering","author":"delany","year":"2006","journal-title":"Proc of AICS'06"},{"key":"ref32","first-page":"2673","article-title":"Spam filtering using statistical data compression models","volume":"7","author":"bratko","year":"2006","journal-title":"Journal of Machine Learning Research"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1145\/1014052.1014077"},{"key":"ref30","author":"cilibrasi","year":"2004","journal-title":"Clustering by Compression"},{"key":"ref37","doi-asserted-by":"crossref","first-page":"367","DOI":"10.4310\/CIS.2005.v5.n4.a1","article-title":"Common pitfalls using the normalized compression distance: what to watch out for in a compressor","volume":"5","author":"cebri\u00e1n","year":"2005","journal-title":"Communications in Information and Systems"},{"key":"ref36","doi-asserted-by":"crossref","first-page":"1545","DOI":"10.1109\/TIT.2004.830793","article-title":"Shared information and program plagiarism detection","volume":"50","author":"brent","year":"2004","journal-title":"IEEE Trans on Information Theory"},{"key":"ref35","article-title":"Normalized compression distance for gene expression analysis","author":"nykter","year":"2005","journal-title":"Proceedings of GENSIPS"},{"key":"ref34","first-page":"252","article-title":"R.: Genre classification via an lz78-based string kernel","author":"li","year":"2005","journal-title":"Proc of ISMIR 2005"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1109\/MSP.2007.45"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1007\/BF01206331"},{"key":"ref11","year":"0","journal-title":"Anubis Analyzing Unknown Binaries"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1007\/s11416-005-0002-9"},{"key":"ref13","article-title":"Analyzing worms and network traffic using compression","volume":"abs cs 504045","author":"wehner","year":"2005","journal-title":"CoRR"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1109\/MSP.2007.31"},{"key":"ref15","first-page":"49","article-title":"An implementation of morphological malware detection","author":"bonfante","year":"0","journal-title":"Proc of EICAR 2008"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1109\/ACSAC.2007.21"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1109\/SECPRI.1996.502675"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1016\/j.scico.2007.01.015"},{"key":"ref19","article-title":"Automated classification and analysis of internet malware","author":"bailey","year":"2007","journal-title":"Proc RAID 2007"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1007\/978-1-4757-2606-0"},{"key":"ref4","article-title":"Graph-based comparison of executable objects","author":"dullien","year":"2005","journal-title":"Proc SSTIC"},{"key":"ref27","year":"0","journal-title":"Fuzzy Hashing and Ssdeep"},{"key":"ref3","first-page":"161","article-title":"Structural comparison of executable objects","volume":"46","author":"flake","year":"2004","journal-title":"Proc of Dimva 2004 ser LNI"},{"key":"ref6","first-page":"129","article-title":"Detecting self-mutating malware using control-flow graph matching","volume":"4064","author":"bruschi","year":"2006","journal-title":"Proc of Dimva 2006 ser LNCS"},{"key":"ref29","first-page":"863","article-title":"The similarity metric","author":"li","year":"2003","journal-title":"Proc Annu ACM-SIAM Symp Discrete Algorithm"},{"key":"ref5","first-page":"207","article-title":"Polymorphic worm detection using structural information of executables","volume":"3858","author":"kruegel","year":"2005","journal-title":"Proc of RAID 2005 ser LNCS"},{"key":"ref8","year":"0","journal-title":"Amun Python Honeypot"},{"key":"ref7","first-page":"165","article-title":"The Nepenthes platform: An efficient approach to collect malware","author":"baecher","year":"2006","journal-title":"RAID ser LNCS"},{"key":"ref2","first-page":"130","article-title":"What a waste - the anti-virus industrie dosing itself","author":"gryaznov","year":"2007","journal-title":"Proceedings of Virus Bulletin Conference 2007"},{"key":"ref9","year":"0","journal-title":"Capture-hpc client honeypot \/ honeyclient"},{"key":"ref1","year":"0","journal-title":"Admmutate"},{"key":"ref20","article-title":"Behavioral classification","author":"lee","year":"2006","journal-title":"Proceedings of EICAR 2006"},{"key":"ref22","author":"oliner","year":"0","journal-title":"Community epidemic detection with syzygy"},{"key":"ref21","first-page":"108","article-title":"Learning and classification of malware behavior","author":"rieck","year":"2008","journal-title":"Proc of DIMVA 2008"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1145\/360825.360861"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1109\/T-C.1971.223083"},{"key":"ref23","year":"0","journal-title":"Amsel project"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1016\/j.diin.2006.06.015"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1145\/322033.322044"}],"event":{"name":"2009 IEEE 34th Conference on Local Computer Networks (LCN 2009)","location":"Zurich, Switzerland","start":{"date-parts":[[2009,10,20]]},"end":{"date-parts":[[2009,10,23]]}},"container-title":["2009 IEEE 34th Conference on Local Computer Networks"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx5\/5347306\/5354999\/05355037.pdf?arnumber=5355037","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2017,6,18]],"date-time":"2017-06-18T23:13:13Z","timestamp":1497827593000},"score":1,"resource":{"primary":{"URL":"http:\/\/ieeexplore.ieee.org\/document\/5355037\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2009,10]]},"references-count":41,"URL":"https:\/\/doi.org\/10.1109\/lcn.2009.5355037","relation":{},"subject":[],"published":{"date-parts":[[2009,10]]}}}