{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,2]],"date-time":"2026-07-02T07:02:01Z","timestamp":1782975721100,"version":"3.54.5"},"reference-count":35,"publisher":"IEEE","license":[{"start":{"date-parts":[[2026,5,18]],"date-time":"2026-05-18T00:00:00Z","timestamp":1779062400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,5,18]],"date-time":"2026-05-18T00:00:00Z","timestamp":1779062400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"DOI":"10.13039\/100000001","name":"National Science Foundation","doi-asserted-by":"publisher","award":["2339483,2530655"],"award-info":[{"award-number":["2339483,2530655"]}],"id":[{"id":"10.13039\/100000001","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2026,5,18]]},"DOI":"10.1109\/sp63933.2026.00159","type":"proceedings-article","created":{"date-parts":[[2026,7,1]],"date-time":"2026-07-01T19:34:20Z","timestamp":1782934460000},"page":"3528-3547","source":"Crossref","is-referenced-by-count":0,"title":["Catch Me If You Can: Detector-Resistant Evasion via Semantics-Preserving Command Re-Realization"],"prefix":"10.1109","author":[{"given":"Muhammad","family":"Shoaib","sequence":"first","affiliation":[{"name":"University of Virginia"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Hare Sudhan","family":"Muthusamy","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Tareq","family":"Alkhatib","sequence":"additional","affiliation":[{"name":"Fortinet"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Wajih Ul","family":"Hassan","sequence":"additional","affiliation":[{"name":"University of Virginia"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref13","volume-title":"Outsmarting the Watchdog: How can Adversaries evade Sigma Rule Detection during a Kerberos Golden Ticket Attack?"},{"key":"ref39","first-page":"2783","article-title":"99 % false positives: A qualitative study of SOC analysts\u2019 perspectives on security alarms","volume-title":"In 31st USENIX Security Symposium (USENIX Security 22)","author":"Alahmadi","year":"2022"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.3390\/computers11070115"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.14257\/ijgdc.2017.10.2.05"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1109\/MSEC.2019.2913693"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1145\/279943.279962"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.5220\/0011004500003194"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2017.10.007"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1145\/1180405.1180414"},{"key":"ref47","author":"Graeber","year":"2018","journal-title":"Subverting sysmon: Application of a formalized security product evasion methodology"},{"key":"ref48","first-page":"1321","article-title":"On calibration of modern neural networks","volume-title":"International conference on machine learning","author":"Guo","year":"2017"},{"key":"ref49","article-title":"Network intrusion detection: Evasion, traffic normalization, and \\{End-to-End\\} protocol semantics","volume-title":"10th USENIX Security Symposium (USENIX Security 01)","author":"Handley","year":"2001"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2019.23349"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1109\/SP40000.2020.00096"},{"key":"ref52","article-title":"SLEUTH: Real-time attack scenario reconstruction from COTS audit data","volume-title":"USENIX Security Symposium","author":"Hossain","year":"2017"},{"key":"ref53","author":"Huang","year":"2015","journal-title":"Bidirectional lstm-crf models for sequence tagging"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2022.23057"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.1109\/SP46215.2023.10179405"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2022.102872"},{"key":"ref57","article-title":"Agreement-based learning","volume":"20","author":"Liang","year":"2007","journal-title":"Advances in Neural Information Processing Systems"},{"key":"ref58","doi-asserted-by":"publisher","DOI":"10.1109\/tdsc.2026.3689905"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-87403-4_5"},{"key":"ref60","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00026"},{"key":"ref61","author":"Muzammil","year":"2026","journal-title":"Towards small language models for security query generation in soc workflows"},{"key":"ref62","doi-asserted-by":"publisher","DOI":"10.1145\/3471621.3471858"},{"key":"ref63","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2020.24065"},{"key":"ref64","article-title":"Principled and automated approach for investigating ar\/vr attacks","volume-title":"USENIX Security Symposium","author":"Shoaib","year":"2025"},{"key":"ref65","doi-asserted-by":"publisher","DOI":"10.1109\/ICAIQSA64000.2024.10882284"},{"key":"ref66","first-page":"5179","article-title":"You cannot escape me: Detecting evasions of SIEM rules in enterprise networks","volume-title":"33rd USENIX Security Symposium (USENIX Security 24)","author":"Uetz","year":"2024"},{"key":"ref67","doi-asserted-by":"publisher","DOI":"10.1145\/586110.586145"},{"key":"ref68","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2018.23282"},{"key":"ref69","doi-asserted-by":"publisher","DOI":"10.2307\/2276774"},{"key":"ref70","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2021.24549"},{"key":"ref71","doi-asserted-by":"publisher","DOI":"10.1145\/3719027.3765024"},{"key":"ref72","doi-asserted-by":"publisher","DOI":"10.1109\/TKDE.2005.186"}],"event":{"name":"2026 IEEE Symposium on Security and Privacy (SP)","location":"San Francisco, CA, USA","start":{"date-parts":[[2026,5,18]]},"end":{"date-parts":[[2026,5,21]]}},"container-title":["2026 IEEE Symposium on Security and Privacy (SP)"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/11573355\/11573356\/11573368.pdf?arnumber=11573368","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,7,2]],"date-time":"2026-07-02T05:35:39Z","timestamp":1782970539000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11573368\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,5,18]]},"references-count":35,"URL":"https:\/\/doi.org\/10.1109\/sp63933.2026.00159","relation":{},"subject":[],"published":{"date-parts":[[2026,5,18]]}}}