{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,2,27]],"date-time":"2026-02-27T03:46:05Z","timestamp":1772163965885,"version":"3.50.1"},"publisher-location":"New York, NY, USA","reference-count":32,"publisher":"ACM","license":[{"start":{"date-parts":[[2005,10,20]],"date-time":"2005-10-20T00:00:00Z","timestamp":1129766400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2005,10,20]]},"DOI":"10.1145\/1095810.1095820","type":"proceedings-article","created":{"date-parts":[[2005,11,7]],"date-time":"2005-11-07T12:34:39Z","timestamp":1131366879000},"page":"91-104","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":137,"title":["Detecting past and present intrusions through vulnerability-specific predicates"],"prefix":"10.1145","author":[{"given":"Ashlesha","family":"Joshi","sequence":"first","affiliation":[{"name":"University of Michigan, Ann Arbor, MI"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Samuel T.","family":"King","sequence":"additional","affiliation":[{"name":"University of Michigan, Ann Arbor, MI"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"George W.","family":"Dunlap","sequence":"additional","affiliation":[{"name":"University of Michigan, Ann Arbor, MI"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Peter M.","family":"Chen","sequence":"additional","affiliation":[{"name":"University of Michigan, Ann Arbor, MI"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"320","published-online":{"date-parts":[[2005,10,20]]},"reference":[{"key":"e_1_3_2_1_2_1","doi-asserted-by":"publisher","DOI":"10.1109\/2.889093"},{"key":"e_1_3_2_1_3_1","doi-asserted-by":"publisher","DOI":"10.1145\/945445.945462"},{"key":"e_1_3_2_1_4_1","volume-title":"Proceedings of the 2002 USENIX Systems Administration Conference (LISA)","author":"Beattie S.","year":"2002","unstructured":"S. Beattie , S. Arnold , C. Cowan , P. Wagle , C. Wright , and A. Shostack . Timing the Application of Security Patches for Optimal Uptime . In Proceedings of the 2002 USENIX Systems Administration Conference (LISA) , November 2002 .]] S. Beattie, S. Arnold, C. Cowan, P. Wagle, C. Wright, and A. Shostack. Timing the Application of Security Patches for Optimal Uptime. In Proceedings of the 2002 USENIX Systems Administration Conference (LISA), November 2002.]]"},{"key":"e_1_3_2_1_5_1","doi-asserted-by":"publisher","DOI":"10.1145\/225535.225538"},{"key":"e_1_3_2_1_6_1","volume-title":"Proceedings of the 2003 USENIX Technical Conference","author":"Brown A. B.","year":"2003","unstructured":"A. B. Brown and D. A. Patterson . Undo for Operators: Building an Undoable E-mail Store . In Proceedings of the 2003 USENIX Technical Conference , June 2003 .]] A. B. Brown and D. A. Patterson. Undo for Operators: Building an Undoable E-mail Store. In Proceedings of the 2003 USENIX Technical Conference, June 2003.]]"},{"key":"e_1_3_2_1_7_1","doi-asserted-by":"publisher","DOI":"10.5555\/882495.884446"},{"key":"e_1_3_2_1_8_1","unstructured":"M. Costa July 2005. personal communication.]]  M. Costa July 2005. personal communication.]]"},{"key":"e_1_3_2_1_9_1","doi-asserted-by":"publisher","DOI":"10.1145\/1095810.1095824"},{"key":"e_1_3_2_1_10_1","first-page":"195","volume-title":"Proceedings of the 2004 USENIX Security Symposium","author":"Dean D.","year":"2004","unstructured":"D. Dean and A. J. Hu . Fixing Races for Fun and Profit: How to use access(2) . In Proceedings of the 2004 USENIX Security Symposium , pages 195 -- 206 , August 2004 .]] D. Dean and A. J. Hu. Fixing Races for Fun and Profit: How to use access(2). In Proceedings of the 2004 USENIX Security Symposium, pages 195--206, August 2004.]]"},{"key":"e_1_3_2_1_11_1","volume-title":"Proceedings of the 2000 Linux Showcase and Conference","author":"Dike J.","year":"2000","unstructured":"J. Dike . A user-mode port of the Linux kernel . In Proceedings of the 2000 Linux Showcase and Conference , October 2000 .]] J. Dike. A user-mode port of the Linux kernel. In Proceedings of the 2000 Linux Showcase and Conference, October 2000.]]"},{"key":"e_1_3_2_1_12_1","volume-title":"Execution Replay for Intrusion Analysis. Technical report","author":"Dunlap G. W.","year":"2005","unstructured":"G. W. Dunlap . Execution Replay for Intrusion Analysis. Technical report , University of Michigan , January 2005 . PhD thesis proposal.]] G. W. Dunlap. Execution Replay for Intrusion Analysis. Technical report, University of Michigan, January 2005. PhD thesis proposal.]]"},{"key":"e_1_3_2_1_13_1","doi-asserted-by":"publisher","DOI":"10.5555\/1060289.1060309"},{"key":"e_1_3_2_1_14_1","doi-asserted-by":"publisher","DOI":"10.1145\/945445.945464"},{"key":"e_1_3_2_1_15_1","volume-title":"Proceedings of the 2003 Network and Distributed System Security Symposium (NDSS)","author":"Garfinkel T.","year":"2003","unstructured":"T. Garfinkel and M. Rosenblum . A Virtual Machine Introspection Based Architecture for Intrusion Detection . In Proceedings of the 2003 Network and Distributed System Security Symposium (NDSS) , February 2003 .]] T. Garfinkel and M. Rosenblum. A Virtual Machine Introspection Based Architecture for Intrusion Detection. In Proceedings of the 2003 Network and Distributed System Security Symposium (NDSS), February 2003.]]"},{"key":"e_1_3_2_1_16_1","doi-asserted-by":"publisher","DOI":"10.1145\/378795.378798"},{"key":"e_1_3_2_1_17_1","volume-title":"Proceedings of the 2005 USENIX Technical Conference","author":"King S. T.","year":"2005","unstructured":"S. T. King , G. W. Dunlap , and P. M. Chen . Debugging operating systems with time-traveling virtual machines . In Proceedings of the 2005 USENIX Technical Conference , April 2005 .]] S. T. King, G. W. Dunlap, and P. M. Chen. Debugging operating systems with time-traveling virtual machines. In Proceedings of the 2005 USENIX Technical Conference, April 2005.]]"},{"key":"e_1_3_2_1_18_1","author":"Lhee K.","year":"2005","unstructured":"K. Lhee and S. J. Chapin . Detection of file-based race conditions. International Journal of Information Security, pages 105--119 , February 2005 .]] K. Lhee and S. J. Chapin. Detection of file-based race conditions. International Journal of Information Security, pages 105--119, February 2005.]]","journal-title":"Detection of file-based race conditions. International Journal of Information Security, pages 105--119"},{"key":"e_1_3_2_1_19_1","doi-asserted-by":"publisher","DOI":"10.1109\/2.982916"},{"key":"e_1_3_2_1_20_1","doi-asserted-by":"publisher","DOI":"10.5555\/822075.822409"},{"key":"e_1_3_2_1_21_1","volume-title":"September","author":"Meushaw R.","year":"2000","unstructured":"R. Meushaw and D. Simard . NetTop: Commercial Technology in High Assurance Applications. Tech Trend Notes: Preview of Tomorrow's Information Technologies, 9(4) , September 2000 .]] R. Meushaw and D. Simard. NetTop: Commercial Technology in High Assurance Applications. Tech Trend Notes: Preview of Tomorrow's Information Technologies, 9(4), September 2000.]]"},{"key":"e_1_3_2_1_22_1","volume-title":"Proceedings of the 2002 USENIX Security Symposium","author":"Rescorla E.","year":"2003","unstructured":"E. Rescorla . Security Holes ... Who Cares? In Proceedings of the 2002 USENIX Security Symposium , August 2003 .]] E. Rescorla. Security Holes...Who Cares? In Proceedings of the 2002 USENIX Security Symposium, August 2003.]]"},{"key":"e_1_3_2_1_23_1","doi-asserted-by":"publisher","DOI":"10.1145\/502034.502037"},{"key":"e_1_3_2_1_24_1","doi-asserted-by":"publisher","DOI":"10.1145\/244804.244807"},{"key":"e_1_3_2_1_25_1","doi-asserted-by":"publisher","DOI":"10.1145\/238721.238779"},{"key":"e_1_3_2_1_26_1","volume-title":"Proceedings of the 2000 USENIX Security Symposium","author":"Somayaji A.","year":"2000","unstructured":"A. Somayaji and S. Forrest . Automated response using system-call delays . In Proceedings of the 2000 USENIX Security Symposium , August 2000 .]] A. Somayaji and S. Forrest. Automated response using system-call delays. In Proceedings of the 2000 USENIX Security Symposium, August 2000.]]"},{"key":"e_1_3_2_1_27_1","volume-title":"Proceedings of the 2003 USENIX Technical Conference","author":"Soules C. A. N.","year":"2003","unstructured":"C. A. N. Soules , J. Appavoo , K. Hui , R. W. Wisniewski , D. D. Silva , G. R. Ganger , O. Krieger , M. Stumm , M. Auslander , M. Ostrowski , B. Rosenburg , and J. Xenidis . System Support for Online Reconfiguration . In Proceedings of the 2003 USENIX Technical Conference , June 2003 .]] C. A. N. Soules, J. Appavoo, K. Hui, R. W. Wisniewski, D. D. Silva, G. R. Ganger, O. Krieger, M. Stumm, M. Auslander, M. Ostrowski, B. Rosenburg, and J. Xenidis. System Support for Online Reconfiguration. In Proceedings of the 2003 USENIX Technical Conference, June 2003.]]"},{"key":"e_1_3_2_1_28_1","volume-title":"Proceedings of the 1999 Symposium on Operating Systems Design and Implementation (OSDI)","author":"Tamches A.","year":"1999","unstructured":"A. Tamches and B. P. Miller . Fine-Grained Dynamic Instrumentation of Commodity Operating System Kernels . In Proceedings of the 1999 Symposium on Operating Systems Design and Implementation (OSDI) , February 1999 .]] A. Tamches and B. P. Miller. Fine-Grained Dynamic Instrumentation of Commodity Operating System Kernels. In Proceedings of the 1999 Symposium on Operating Systems Design and Implementation (OSDI), February 1999.]]"},{"key":"e_1_3_2_1_29_1","doi-asserted-by":"publisher","DOI":"10.1109\/MC.2005.163"},{"key":"e_1_3_2_1_30_1","doi-asserted-by":"publisher","DOI":"10.1145\/1015467.1015489"},{"key":"e_1_3_2_1_31_1","volume-title":"Proceedings of the 2004 Symposium on Network System Design and Implementation (NSDI)","author":"Whitaker A.","year":"2004","unstructured":"A. Whitaker , R. Cox , M. Shaw , and S. D. Gribble . Constructing Services With Interposable Virtual Hardware . In Proceedings of the 2004 Symposium on Network System Design and Implementation (NSDI) , March 2004 .]] A. Whitaker, R. Cox, M. Shaw, and S. D. Gribble. Constructing Services With Interposable Virtual Hardware. In Proceedings of the 2004 Symposium on Network System Design and Implementation (NSDI), March 2004.]]"},{"key":"e_1_3_2_1_32_1","volume-title":"Proceedings of the 2004 Symposium on Operating Systems Design and Implementation (OSDI)","author":"Whitaker A.","year":"2004","unstructured":"A. Whitaker , R. S. Cox , and S. D. Gribble . Configuration Debugging as Search: Finding the Needle in the Haystack . In Proceedings of the 2004 Symposium on Operating Systems Design and Implementation (OSDI) , December 2004 .]] A. Whitaker, R. S. Cox, and S. D. Gribble. Configuration Debugging as Search: Finding the Needle in the Haystack. In Proceedings of the 2004 Symposium on Operating Systems Design and Implementation (OSDI), December 2004.]]"},{"key":"e_1_3_2_1_33_1","doi-asserted-by":"publisher","DOI":"10.1145\/859618.859633"}],"event":{"name":"SOSP05: ACM SIGOPS 20th Symposium on Operating Systems Principles 2005","location":"Brighton United Kingdom","acronym":"SOSP05","sponsor":["SIGOPS ACM Special Interest Group on Operating Systems","ACM Association for Computing Machinery"]},"container-title":["Proceedings of the twentieth ACM symposium on Operating systems principles"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/1095810.1095820","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/1095810.1095820","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,18]],"date-time":"2025-06-18T12:08:27Z","timestamp":1750248507000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/1095810.1095820"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2005,10,20]]},"references-count":32,"alternative-id":["10.1145\/1095810.1095820","10.1145\/1095810"],"URL":"https:\/\/doi.org\/10.1145\/1095810.1095820","relation":{"is-identical-to":[{"id-type":"doi","id":"10.1145\/1095809.1095820","asserted-by":"object"}]},"subject":[],"published":{"date-parts":[[2005,10,20]]},"assertion":[{"value":"2005-10-20","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}