{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,2,21]],"date-time":"2026-02-21T18:52:17Z","timestamp":1771699937251,"version":"3.50.1"},"publisher-location":"New York, NY, USA","reference-count":30,"publisher":"ACM","license":[{"start":{"date-parts":[[2008,2,19]],"date-time":"2008-02-19T00:00:00Z","timestamp":1203379200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2008,2,19]]},"DOI":"10.1145\/1342211.1342215","type":"proceedings-article","created":{"date-parts":[[2009,9,28]],"date-time":"2009-09-28T17:33:43Z","timestamp":1254159223000},"page":"5-14","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":66,"title":["Mining specifications of malicious behavior"],"prefix":"10.1145","author":[{"given":"Mihai","family":"Christodorescu","sequence":"first","affiliation":[{"name":"IBM Research, Hawthorne, NY"}]},{"given":"Somesh","family":"Jha","sequence":"additional","affiliation":[{"name":"University of Wisconsin, Madison, WI"}]},{"given":"Christopher","family":"Kruegel","sequence":"additional","affiliation":[{"name":"Technical University, Vienna, Austria"}]}],"member":"320","published-online":{"date-parts":[[2008,2,19]]},"reference":[{"key":"e_1_3_2_1_1_1","doi-asserted-by":"publisher","DOI":"10.1145\/503272.503275"},{"key":"e_1_3_2_1_2_1","doi-asserted-by":"publisher","DOI":"10.5555\/1025115.1025202"},{"key":"e_1_3_2_1_3_1","doi-asserted-by":"publisher","DOI":"10.1145\/1081706.1081733"},{"key":"e_1_3_2_1_4_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2006.12"},{"key":"e_1_3_2_1_5_1","volume-title":"Strace for NT. Published online at http:\/\/www.bindview.com\/Services\/RAZOR\/Utilities\/Windows\/strace_readme.cfm (accessed","year":"2006","unstructured":"BindView. Strace for NT. Published online at http:\/\/www.bindview.com\/Services\/RAZOR\/Utilities\/Windows\/strace_readme.cfm (accessed 9 Sep. 2006 ). BindView. Strace for NT. Published online at http:\/\/www.bindview.com\/Services\/RAZOR\/Utilities\/Windows\/strace_readme.cfm (accessed 9 Sep. 2006)."},{"key":"e_1_3_2_1_6_1","doi-asserted-by":"publisher","DOI":"10.1145\/1007512.1007518"},{"key":"e_1_3_2_1_7_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2005.20"},{"key":"e_1_3_2_1_8_1","volume-title":"Proc. 11th Network and Distributed System Security Symposium (NDSS'04)","author":"Giffin J. T.","year":"2004","unstructured":"J. T. Giffin , S. Jha , and B. P. Miller . Efficient context-sensitive intrusion detection . In Proc. 11th Network and Distributed System Security Symposium (NDSS'04) , 2004 . J. T. Giffin, S. Jha, and B. P. Miller. Efficient context-sensitive intrusion detection. In Proc. 11th Network and Distributed System Security Symposium (NDSS'04), 2004."},{"key":"e_1_3_2_1_9_1","doi-asserted-by":"publisher","DOI":"10.1145\/93542.93574"},{"key":"e_1_3_2_1_10_1","doi-asserted-by":"publisher","DOI":"10.5555\/645543.655704"},{"key":"e_1_3_2_1_11_1","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.2002.1019480"},{"key":"e_1_3_2_1_12_1","doi-asserted-by":"publisher","DOI":"10.1007\/11506881_11"},{"key":"e_1_3_2_1_13_1","doi-asserted-by":"publisher","DOI":"10.5555\/647170.718283"},{"key":"e_1_3_2_1_14_1","volume-title":"AusCERT Asia Pacific IT Security Conference","author":"Kruegel C.","year":"2005","unstructured":"C. Kruegel , D. Mutz , W. Robertson , G. Vigna , and R. Kemmerer . Reverse engineering of network signatures . In AusCERT Asia Pacific IT Security Conference , 2005 . C. Kruegel, D. Mutz, W. Robertson, G. Vigna, and R. Kemmerer. Reverse engineering of network signatures. In AusCERT Asia Pacific IT Security Conference, 2005."},{"key":"e_1_3_2_1_15_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-39650-5_19"},{"key":"e_1_3_2_1_16_1","doi-asserted-by":"publisher","DOI":"10.1109\/CSAC.2004.19"},{"key":"e_1_3_2_1_17_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICSM.1992.242533"},{"key":"e_1_3_2_1_18_1","doi-asserted-by":"publisher","DOI":"10.1145\/1081706.1081755"},{"issue":"8","key":"e_1_3_2_1_19_1","first-page":"7","article-title":"Russian doll","volume":"15","author":"Marinescu A.","year":"2003","unstructured":"A. Marinescu . Russian doll . Virus Bulletin , 15 ( 8 ): 7 - 9 , Aug. 2003 . A. Marinescu. Russian doll. Virus Bulletin, 15(8):7-9, Aug. 2003.","journal-title":"Virus Bulletin"},{"key":"e_1_3_2_1_20_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2007.17"},{"key":"e_1_3_2_1_21_1","volume-title":"Advanced Compiler Design and Implementation. Morgan Kaufmann","author":"Muchnick S.","year":"1997","unstructured":"S. Muchnick . Advanced Compiler Design and Implementation. Morgan Kaufmann , 1997 . S. Muchnick. Advanced Compiler Design and Implementation. Morgan Kaufmann, 1997."},{"key":"e_1_3_2_1_22_1","doi-asserted-by":"publisher","DOI":"10.1145\/242857.242869"},{"key":"e_1_3_2_1_23_1","doi-asserted-by":"publisher","DOI":"10.5555\/882495.884433"},{"key":"e_1_3_2_1_24_1","volume-title":"Expanded threat list and virus encyclopedia. Published online at http:\/\/www.symantec.com\/enterprise\/security_response\/threatexplorer\/index.jsp (accessed","author":"Symantec Antivirus Research Center","year":"2006","unstructured":"Symantec Antivirus Research Center . Expanded threat list and virus encyclopedia. Published online at http:\/\/www.symantec.com\/enterprise\/security_response\/threatexplorer\/index.jsp (accessed 9 Sep. 2006 ). Symantec Antivirus Research Center. Expanded threat list and virus encyclopedia. Published online at http:\/\/www.symantec.com\/enterprise\/security_response\/threatexplorer\/index.jsp (accessed 9 Sep. 2006)."},{"key":"e_1_3_2_1_25_1","first-page":"123","volume-title":"Virus Bulletin Conference","author":"Szor P.","year":"2001","unstructured":"P. Szor and P. Ferrie . Hunting for metamorphic . In Virus Bulletin Conference , pages 123 -- 144 , 2001 . P. Szor and P. Ferrie. Hunting for metamorphic. In Virus Bulletin Conference, pages 123--144, 2001."},{"key":"e_1_3_2_1_26_1","doi-asserted-by":"publisher","DOI":"10.1137\/1.9781611972764.76"},{"key":"e_1_3_2_1_27_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-31980-1_30"},{"key":"e_1_3_2_1_28_1","volume-title":"Virus Bulletin Conference","author":"Whalley I.","year":"2000","unstructured":"I. Whalley , B. Arnold , D. Chess , J. Morar , and A. Segal . An environment for controlled worm replication & analysis (Internet-inna-Box) . In Virus Bulletin Conference , 2000 . I. Whalley, B. Arnold, D. Chess, J. Morar, and A. Segal. An environment for controlled worm replication & analysis (Internet-inna-Box). In Virus Bulletin Conference, 2000."},{"key":"e_1_3_2_1_29_1","unstructured":"z0mbie. z0mbie's homepage. Published online at http:\/\/z0mbie.host.sk (accessed 16 Jan.all2004).  z0mbie. z0mbie's homepage. Published online at http:\/\/z0mbie.host.sk (accessed 16 Jan.all2004)."},{"key":"e_1_3_2_1_30_1","doi-asserted-by":"publisher","DOI":"10.1145\/1081706.1081738"}],"event":{"name":"ISEC08: India Software Engineering Conference","location":"Hyderabad India","acronym":"ISEC08","sponsor":["ACM Association for Computing Machinery","SIGSOFT ACM Special Interest Group on Software Engineering"]},"container-title":["Proceedings of the 1st India software engineering conference"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/1342211.1342215","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/1342211.1342215","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,18]],"date-time":"2025-06-18T13:39:20Z","timestamp":1750253960000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/1342211.1342215"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2008,2,19]]},"references-count":30,"alternative-id":["10.1145\/1342211.1342215","10.1145\/1342211"],"URL":"https:\/\/doi.org\/10.1145\/1342211.1342215","relation":{},"subject":[],"published":{"date-parts":[[2008,2,19]]},"assertion":[{"value":"2008-02-19","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}