{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,6,19]],"date-time":"2025-06-19T04:53:05Z","timestamp":1750308785084,"version":"3.41.0"},"publisher-location":"New York, NY, USA","reference-count":22,"publisher":"ACM","license":[{"start":{"date-parts":[[2006,11,3]],"date-time":"2006-11-03T00:00:00Z","timestamp":1162512000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2006,11,3]]},"DOI":"10.1145\/1179542.1179557","type":"proceedings-article","created":{"date-parts":[[2007,1,17]],"date-time":"2007-01-17T01:15:56Z","timestamp":1168996556000},"page":"65-72","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":3,"title":["Signature metrics for accurate and automated worm detection"],"prefix":"10.1145","author":[{"given":"Prem","family":"Gopalan","sequence":"first","affiliation":[{"name":"Mazu Networks"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Kyle","family":"Jamieson","sequence":"additional","affiliation":[{"name":"Massachusetts Institute of Technology"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Panayiotis","family":"Mavrommatis","sequence":"additional","affiliation":[{"name":"Massachusetts Institute of Technology"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Massimiliano","family":"Poletto","sequence":"additional","affiliation":[{"name":"Mazu Networks"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"320","published-online":{"date-parts":[[2006,11,3]]},"reference":[{"key":"e_1_3_2_1_1_1","unstructured":"Inktomi web search faq. Technical report. http:\/\/support.inktomi.com\/Search Engine\/Product Info\/FAQ\/searchfaq.html#slurp.  Inktomi web search faq. Technical report. http:\/\/support.inktomi.com\/Search Engine\/Product Info\/FAQ\/searchfaq.html#slurp."},{"key":"e_1_3_2_1_2_1","unstructured":"Malicious software encyclopedia: Worm:win32\/zotob.a.Technical report. http:\/\/www.microsoft.com\/security\/incident\/zotob.mspx.  Malicious software encyclopedia: Worm:win32\/zotob.a.Technical report. http:\/\/www.microsoft.com\/security\/incident\/zotob.mspx."},{"key":"e_1_3_2_1_3_1","unstructured":"The spread of the witty worm caida. Technical report. http:\/\/www.caida.org\/analysis\/security\/witty.  The spread of the witty worm caida. Technical report. http:\/\/www.caida.org\/analysis\/security\/witty."},{"key":"e_1_3_2_1_4_1","first-page":"143","volume-title":"R. Capocelli et al. eds.","author":"Broder A.","year":"1993","unstructured":"A. Broder . Some applications of Rabin's fingerprinting method . In R. Capocelli et al. eds. , Sequences II : Methods in Communications, Security, and Computer Science , pages 143 -- 152 , 1993 . A. Broder. Some applications of Rabin's fingerprinting method. In R. Capocelli et al. eds., Sequences II: Methods in Communications, Security, and Computer Science, pages 143--152, 1993."},{"key":"e_1_3_2_1_5_1","volume-title":"Proceedings of the Allerton Conference","author":"Broder A.","year":"2002","unstructured":"A. Broder and M. Mitzenmacher . Network applications of bloom filters: A survey . In Proceedings of the Allerton Conference , 2002 . A. Broder and M. Mitzenmacher. Network applications of bloom filters: A survey. In Proceedings of the Allerton Conference, 2002."},{"key":"e_1_3_2_1_6_1","doi-asserted-by":"publisher","DOI":"10.1109\/INFCOM.2003.1209211"},{"key":"e_1_3_2_1_7_1","doi-asserted-by":"publisher","DOI":"10.1145\/1095810.1095824"},{"key":"e_1_3_2_1_8_1","doi-asserted-by":"publisher","DOI":"10.1145\/1029618.1029625"},{"key":"e_1_3_2_1_9_1","doi-asserted-by":"publisher","DOI":"10.1109\/SECPRI.2004.1301325"},{"key":"e_1_3_2_1_10_1","volume-title":"Proceedings of Usenix Security","author":"Kim H. A.","year":"2004","unstructured":"H. A. Kim and B. Karp . Toward automated, distributed worm signature detection . In Proceedings of Usenix Security , San Diego, CA , August 2004 . H. A. Kim and B. Karp. Toward automated, distributed worm signature detection. In Proceedings of Usenix Security, San Diego, CA, August 2004."},{"key":"e_1_3_2_1_11_1","doi-asserted-by":"publisher","DOI":"10.1145\/354871.354874"},{"key":"e_1_3_2_1_12_1","volume-title":"Proceedings of ACM HotNets-II","author":"Kreibich C.","year":"2003","unstructured":"C. Kreibich and J. Crowcroft . Honeycomb-creating intrusion detection signatures using honeypots . In Proceedings of ACM HotNets-II , November 2003 . C. Kreibich and J. Crowcroft. Honeycomb-creating intrusion detection signatures using honeypots. In Proceedings of ACM HotNets-II, November 2003."},{"key":"e_1_3_2_1_13_1","doi-asserted-by":"publisher","DOI":"10.1109\/INFCOM.2003.1209212"},{"key":"e_1_3_2_1_14_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2005.15"},{"key":"e_1_3_2_1_15_1","volume-title":"Proceedings of NDSS 12","author":"Newsome J.","year":"2005","unstructured":"J. Newsome and D. Song . Dynamic taint analysis for automatic detection, analysis, and signature generation of exploits on commodity software . In Proceedings of NDSS 12 , 2005 . J. Newsome and D. Song. Dynamic taint analysis for automatic detection, analysis, and signature generation of exploits on commodity software. In Proceedings of NDSS 12, 2005."},{"key":"e_1_3_2_1_16_1","volume-title":"Proceedings of Usenix LISA","author":"Roesch M.","year":"1999","unstructured":"M. Roesch . Snort : Lightweight intrusion detection for networks . In Proceedings of Usenix LISA , 1999 . M. Roesch. Snort: Lightweight intrusion detection for networks. In Proceedings of Usenix LISA, 1999."},{"key":"e_1_3_2_1_17_1","doi-asserted-by":"crossref","unstructured":"B. Schroder. Ordered Sets - An Introduction. Birkhauser Boston 2003.  B. Schroder. Ordered Sets - An Introduction. Birkhauser Boston 2003.","DOI":"10.1007\/978-1-4612-0053-6"},{"key":"e_1_3_2_1_18_1","volume-title":"Proceedings of ACM SOSP","author":"Singh S.","year":"2004","unstructured":"S. Singh , C. Estan , G. Varghese , and S. Savage . Automated worm fingerprinting . In Proceedings of ACM SOSP , December 2004 . S. Singh, C. Estan, G. Varghese, and S. Savage. Automated worm fingerprinting. In Proceedings of ACM SOSP, December 2004."},{"key":"e_1_3_2_1_19_1","volume-title":"Proceedings of NDSS 12","author":"Venkataraman S.","year":"2005","unstructured":"S. Venkataraman , D. Song , P. Gibbons , and A. Blum . New streaming algorithms for fast detection of superspreaders . In Proceedings of NDSS 12 , 2005 . S. Venkataraman, D. Song, P. Gibbons, and A. Blum. New streaming algorithms for fast detection of superspreaders. In Proceedings of NDSS 12, 2005."},{"key":"e_1_3_2_1_20_1","doi-asserted-by":"publisher","DOI":"10.1145\/948187.948190"},{"key":"e_1_3_2_1_21_1","doi-asserted-by":"publisher","DOI":"10.5555\/956415.956450"},{"key":"e_1_3_2_1_22_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2005.23"}],"event":{"name":"CCS06: 13th ACM Conference on Computer and Communications Security 2006","sponsor":["SIGSAC ACM Special Interest Group on Security, Audit, and Control","ACM Association for Computing Machinery"],"location":"Alexandria Virginia USA","acronym":"CCS06"},"container-title":["Proceedings of the 4th ACM workshop on Recurring malcode"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/1179542.1179557","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/1179542.1179557","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,18]],"date-time":"2025-06-18T20:22:46Z","timestamp":1750278166000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/1179542.1179557"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2006,11,3]]},"references-count":22,"alternative-id":["10.1145\/1179542.1179557","10.1145\/1179542"],"URL":"https:\/\/doi.org\/10.1145\/1179542.1179557","relation":{},"subject":[],"published":{"date-parts":[[2006,11,3]]},"assertion":[{"value":"2006-11-03","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}