{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,11]],"date-time":"2026-03-11T01:30:54Z","timestamp":1773192654993,"version":"3.50.1"},"publisher-location":"New York, NY, USA","reference-count":30,"publisher":"ACM","license":[{"start":{"date-parts":[[2007,9,7]],"date-time":"2007-09-07T00:00:00Z","timestamp":1189123200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2007,9,7]]},"DOI":"10.1145\/1287624.1287628","type":"proceedings-article","created":{"date-parts":[[2007,9,26]],"date-time":"2007-09-26T17:32:33Z","timestamp":1190827953000},"page":"5-14","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":194,"title":["Mining specifications of malicious behavior"],"prefix":"10.1145","author":[{"given":"Mihai","family":"Christodorescu","sequence":"first","affiliation":[{"name":"University of Wisconsin: Madison, Madison, WI"}]},{"given":"Somesh","family":"Jha","sequence":"additional","affiliation":[{"name":"University of Wisconsin: Madison, Madison, WI"}]},{"given":"Christopher","family":"Kruegel","sequence":"additional","affiliation":[{"name":"Technical University Vienna, Vienna, Austria"}]}],"member":"320","published-online":{"date-parts":[[2007,9,7]]},"reference":[{"key":"e_1_3_2_1_1_1","doi-asserted-by":"publisher","DOI":"10.1145\/503272.503275"},{"key":"e_1_3_2_1_2_1","doi-asserted-by":"publisher","DOI":"10.5555\/1025115.1025202"},{"key":"e_1_3_2_1_3_1","doi-asserted-by":"publisher","DOI":"10.1145\/1081706.1081733"},{"key":"e_1_3_2_1_4_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2006.12"},{"key":"e_1_3_2_1_5_1","volume-title":"Strace for NT. Published online at http:\/\/www.bindview.com\/Services\/RAZOR\/Utilities\/Windows\/strace_readme.cfm (accessed","year":"2006","unstructured":"BindView. Strace for NT. Published online at http:\/\/www.bindview.com\/Services\/RAZOR\/Utilities\/Windows\/strace_readme.cfm (accessed 9 Sep. 2006 ). BindView. Strace for NT. Published online at http:\/\/www.bindview.com\/Services\/RAZOR\/Utilities\/Windows\/strace_readme.cfm (accessed 9 Sep. 2006)."},{"key":"e_1_3_2_1_6_1","doi-asserted-by":"publisher","DOI":"10.1145\/1007512.1007518"},{"key":"e_1_3_2_1_7_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2005.20"},{"key":"e_1_3_2_1_8_1","volume-title":"Proc. 11th Network and Distributed System Security Symposium (NDSS'04)","author":"Giffin J. T.","year":"2004","unstructured":"J. T. Giffin , S. Jha , and B. P. Miller . Efficient context-sensitive intrusion detection . In Proc. 11th Network and Distributed System Security Symposium (NDSS'04) , 2004 . J. T. Giffin, S. Jha, and B. P. Miller. Efficient context-sensitive intrusion detection. In Proc. 11th Network and Distributed System Security Symposium (NDSS'04), 2004."},{"key":"e_1_3_2_1_9_1","doi-asserted-by":"publisher","DOI":"10.1145\/93542.93574"},{"key":"e_1_3_2_1_10_1","doi-asserted-by":"publisher","DOI":"10.5555\/645543.655704"},{"key":"e_1_3_2_1_11_1","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.2002.1019480"},{"key":"e_1_3_2_1_12_1","doi-asserted-by":"publisher","DOI":"10.1007\/11506881_11"},{"key":"e_1_3_2_1_13_1","doi-asserted-by":"publisher","DOI":"10.5555\/647170.718283"},{"key":"e_1_3_2_1_14_1","volume-title":"AusCERT Asia Pacific IT Security Conference","author":"Kruegel C.","year":"2005","unstructured":"C. Kruegel , D. Mutz , W. Robertson , G. Vigna , and R. Kemmerer . Reverse engineering of network signatures . In AusCERT Asia Pacific IT Security Conference , 2005 . C. Kruegel, D. Mutz, W. Robertson, G. Vigna, and R. Kemmerer. Reverse engineering of network signatures. In AusCERT Asia Pacific IT Security Conference, 2005."},{"key":"e_1_3_2_1_15_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-39650-5_19"},{"key":"e_1_3_2_1_16_1","doi-asserted-by":"publisher","DOI":"10.1109\/CSAC.2004.19"},{"key":"e_1_3_2_1_17_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICSM.1992.242533"},{"key":"e_1_3_2_1_18_1","doi-asserted-by":"publisher","DOI":"10.1145\/1081706.1081755"},{"issue":"8","key":"e_1_3_2_1_19_1","first-page":"7","volume":"15","author":"Marinescu A.","year":"2003","unstructured":"A. Marinescu . Russian doll. Virus Bulletin , 15 ( 8 ): 7 -- 9 , Aug. 2003 . A. Marinescu. Russian doll. Virus Bulletin, 15(8):7--9, Aug. 2003.","journal-title":"Virus Bulletin"},{"key":"e_1_3_2_1_20_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2007.17"},{"key":"e_1_3_2_1_21_1","volume-title":"Morgan Kaufmann","author":"Muchnick S.","year":"1997","unstructured":"S. Muchnick . Advanced Compiler Design and Implementation . Morgan Kaufmann , 1997 . S. Muchnick. Advanced Compiler Design and Implementation. Morgan Kaufmann, 1997."},{"key":"e_1_3_2_1_22_1","doi-asserted-by":"publisher","DOI":"10.1145\/242857.242869"},{"key":"e_1_3_2_1_23_1","doi-asserted-by":"publisher","DOI":"10.5555\/882495.884433"},{"key":"e_1_3_2_1_24_1","volume-title":"Expanded threat list and virus encyclopedia. Published online at http:\/\/www.symantec.com\/enterprise\/security_response\/threatexplorer\/index.jsp (accessed","author":"Symantec Antivirus Research Center","year":"2006","unstructured":"Symantec Antivirus Research Center . Expanded threat list and virus encyclopedia. Published online at http:\/\/www.symantec.com\/enterprise\/security_response\/threatexplorer\/index.jsp (accessed 9 Sep. 2006 ). Symantec Antivirus Research Center. Expanded threat list and virus encyclopedia. Published online at http:\/\/www.symantec.com\/enterprise\/security_response\/threatexplorer\/index.jsp (accessed 9 Sep. 2006)."},{"key":"e_1_3_2_1_25_1","first-page":"123","volume-title":"Virus Bulletin Conference","author":"Szor P.","year":"2001","unstructured":"P. Szor and P. Ferrie . Hunting for metamorphic . In Virus Bulletin Conference , pages 123 -- 1144 , 2001 . P. Szor and P. Ferrie. Hunting for metamorphic. In Virus Bulletin Conference, pages 123 -- 144, 2001."},{"key":"e_1_3_2_1_26_1","doi-asserted-by":"publisher","DOI":"10.1137\/1.9781611972764.76"},{"key":"e_1_3_2_1_27_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-31980-1_30"},{"key":"e_1_3_2_1_28_1","volume-title":"Virus Bulletin Conference","author":"Whalley I.","year":"2000","unstructured":"I. Whalley , B. Arnold , D. Chess , J. Morar , and A. Segal . An environment for controlled worm replication & analysis (Internet-inna-Box) . In Virus Bulletin Conference , 2000 . I. Whalley, B. Arnold, D. Chess, J. Morar, and A. Segal. An environment for controlled worm replication & analysis (Internet-inna-Box). In Virus Bulletin Conference, 2000."},{"key":"e_1_3_2_1_29_1","volume-title":"z0mbie's homepage. Published online at http:\/\/z0mbie.host.sk (accessed","year":"2004","unstructured":"z0mbie. z0mbie's homepage. Published online at http:\/\/z0mbie.host.sk (accessed 16 Jan. 2004 ). z0mbie. z0mbie's homepage. Published online at http:\/\/z0mbie.host.sk (accessed 16 Jan. 2004)."},{"key":"e_1_3_2_1_30_1","doi-asserted-by":"publisher","DOI":"10.1145\/1081706.1081738"}],"event":{"name":"ESEC\/FSE07: Joint 11th European Software Engineering Conference 2007","location":"Dubrovnik Croatia","acronym":"ESEC\/FSE07","sponsor":["ACM Association for Computing Machinery","SIGSOFT ACM Special Interest Group on Software Engineering"]},"container-title":["Proceedings of the the 6th joint meeting of the European software engineering conference and the ACM SIGSOFT symposium on The foundations of software engineering"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/1287624.1287628","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/1287624.1287628","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,18]],"date-time":"2025-06-18T14:57:50Z","timestamp":1750258670000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/1287624.1287628"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2007,9,7]]},"references-count":30,"alternative-id":["10.1145\/1287624.1287628","10.1145\/1287624"],"URL":"https:\/\/doi.org\/10.1145\/1287624.1287628","relation":{},"subject":[],"published":{"date-parts":[[2007,9,7]]},"assertion":[{"value":"2007-09-07","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}