{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,6,19]],"date-time":"2025-06-19T04:34:51Z","timestamp":1750307691671,"version":"3.41.0"},"publisher-location":"New York, NY, USA","reference-count":30,"publisher":"ACM","license":[{"start":{"date-parts":[[2008,10,27]],"date-time":"2008-10-27T00:00:00Z","timestamp":1225065600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2008,10,27]]},"DOI":"10.1145\/1456377.1456394","type":"proceedings-article","created":{"date-parts":[[2008,11,6]],"date-time":"2008-11-06T13:49:50Z","timestamp":1225979390000},"page":"61-70","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":4,"title":["A data mining approach for analysis of worm activity through automatic signature generation"],"prefix":"10.1145","author":[{"given":"Urko","family":"Zurutuza","sequence":"first","affiliation":[{"name":"Mondragon University, Mondragon, Spain"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Roberto","family":"Uribeetxeberria","sequence":"additional","affiliation":[{"name":"Mondragon University, Mondragon, Spain"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Diego","family":"Zamboni","sequence":"additional","affiliation":[{"name":"IBM Z\u00fcrich Research Laboratory, R\u00fcschlikon, Switzerland"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"320","published-online":{"date-parts":[[2008,10,27]]},"reference":[{"key":"e_1_3_2_1_1_1","doi-asserted-by":"publisher","DOI":"10.5555\/1361442.1361445"},{"key":"e_1_3_2_1_2_1","doi-asserted-by":"publisher","DOI":"10.5555\/857183.857561"},{"key":"e_1_3_2_1_3_1","volume-title":"Accrue Software","author":"Berkhin P.","year":"2002","unstructured":"P. Berkhin . Survey of clustering data mining techniques. Technical report , Accrue Software , San Jose, CA , 2002 . P. Berkhin. Survey of clustering data mining techniques. Technical report, Accrue Software, San Jose, CA, 2002."},{"key":"e_1_3_2_1_4_1","doi-asserted-by":"publisher","DOI":"10.1109\/GLOCOM.2004.1378411"},{"key":"e_1_3_2_1_5_1","doi-asserted-by":"publisher","DOI":"10.1145\/1162678.1162679"},{"key":"e_1_3_2_1_6_1","doi-asserted-by":"publisher","DOI":"10.1145\/863955.863972"},{"key":"e_1_3_2_1_7_1","doi-asserted-by":"publisher","DOI":"10.1145\/240455.240464"},{"key":"e_1_3_2_1_8_1","first-page":"89","volume-title":"Proceedings of SPIE Conference on Sensors, and Command, Control, Communications, and Intelligence (C3I) Technologies for Homeland Security and Homeland Defense III.","volume":"5403","author":"Gray R. S.","year":"2004","unstructured":"R. S. Gray and V. H. Berk . Rapid detection of worms using ICMP-T3 analysis. In E. M. Carapezza, editor , Proceedings of SPIE Conference on Sensors, and Command, Control, Communications, and Intelligence (C3I) Technologies for Homeland Security and Homeland Defense III. , volume 5403 , pages 89 -- 101 , Orlando, FL, USA , September 2004 . R. S. Gray and V. H. Berk. Rapid detection of worms using ICMP-T3 analysis. In E. M. Carapezza, editor, Proceedings of SPIE Conference on Sensors, and Command, Control, Communications, and Intelligence (C3I) Technologies for Homeland Security and Homeland Defense III., volume 5403, pages 89--101, Orlando, FL, USA, September 2004."},{"key":"e_1_3_2_1_9_1","doi-asserted-by":"crossref","DOI":"10.1017\/CBO9780511574931","volume-title":"Algorithms on Strings, Trees and Sequences: Computer Science and Computational Biology","author":"Gusfield D.","year":"1997","unstructured":"D. Gusfield . Algorithms on Strings, Trees and Sequences: Computer Science and Computational Biology . Cambridge University Press , 1997 . D. Gusfield. Algorithms on Strings, Trees and Sequences: Computer Science and Computational Biology. Cambridge University Press, 1997."},{"key":"e_1_3_2_1_11_1","doi-asserted-by":"publisher","DOI":"10.1007\/11856214_9"},{"key":"e_1_3_2_1_12_1","volume-title":"Algorithms for Clustering Data","author":"Jain A. K.","year":"1988","unstructured":"A. K. Jain and R. C. Dubes . Algorithms for Clustering Data . Prentice-Hall, Inc. , 1988 . A. K. Jain and R. C. Dubes. Algorithms for Clustering Data. Prentice-Hall, Inc., 1988."},{"key":"e_1_3_2_1_13_1","doi-asserted-by":"publisher","DOI":"10.1145\/950191.950192"},{"key":"e_1_3_2_1_15_1","series-title":"Series in Applied Probability and Statistics","doi-asserted-by":"crossref","DOI":"10.1002\/9780470316801","volume-title":"Finding Groups in Data: An Introduction to Cluster Analysis","author":"Kaufman L.","year":"1990","unstructured":"L. Kaufman and P. J. Rousseeuw . Finding Groups in Data: An Introduction to Cluster Analysis . Series in Applied Probability and Statistics . Wiley-Interscience , John Wiley & Sons, Inc, New York, USA, March 1990 . L. Kaufman and P. J. Rousseeuw. Finding Groups in Data: An Introduction to Cluster Analysis. Series in Applied Probability and Statistics. Wiley-Interscience, John Wiley & Sons, Inc, New York, USA, March 1990."},{"key":"e_1_3_2_1_16_1","first-page":"271","volume-title":"Proceedings of the 13th USENIX Security Symposium","author":"Kim H.-A.","year":"2004","unstructured":"H.-A. Kim and B. Karp . Autograph: Toward automated, distributed worm signature detection . In Proceedings of the 13th USENIX Security Symposium , pages 271 -- 286 , San Diego, CA , 2004 . H.-A. Kim and B. Karp. Autograph: Toward automated, distributed worm signature detection. In Proceedings of the 13th USENIX Security Symposium, pages 271--286, San Diego, CA, 2004."},{"key":"e_1_3_2_1_17_1","volume-title":"Proceedings of the Second Workshop on Hot Topics in Networks (Hotnets II)","author":"Kreibich C.","year":"2003","unstructured":"C. Kreibich and J. Crowcroft . Honeycomb -- creating intrusion detection signatures using honeypots . In Proceedings of the Second Workshop on Hot Topics in Networks (Hotnets II) , Boston , November 2003 . C. Kreibich and J. Crowcroft. Honeycomb -- creating intrusion detection signatures using honeypots. In Proceedings of the Second Workshop on Hot Topics in Networks (Hotnets II), Boston, November 2003."},{"key":"e_1_3_2_1_18_1","doi-asserted-by":"publisher","DOI":"10.1145\/1177080.1177123"},{"key":"e_1_3_2_1_19_1","doi-asserted-by":"publisher","DOI":"10.1145\/1064212.1064220"},{"key":"e_1_3_2_1_20_1","doi-asserted-by":"publisher","DOI":"10.5555\/1251327.1251329"},{"key":"e_1_3_2_1_21_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2005.15"},{"key":"e_1_3_2_1_22_1","doi-asserted-by":"publisher","DOI":"10.1023\/A:1022825229661"},{"key":"e_1_3_2_1_24_1","volume-title":"Proceedings of the 10th DFN-CERT Workshop","author":"Provos N.","year":"2003","unstructured":"N. Provos . Honeyd : a virtual honeypot daemon . In Proceedings of the 10th DFN-CERT Workshop , February 2003 . N. Provos. Honeyd: a virtual honeypot daemon. In Proceedings of the 10th DFN-CERT Workshop, February 2003."},{"key":"e_1_3_2_1_25_1","volume-title":"Proceedings of the 13th USENIX Security Symposium","author":"Provos N.","year":"2004","unstructured":"N. Provos . A virtual honeypot framework . In Proceedings of the 13th USENIX Security Symposium , August 2004 . N. Provos. A virtual honeypot framework. In Proceedings of the 13th USENIX Security Symposium, August 2004."},{"key":"e_1_3_2_1_26_1","volume-title":"IBM Zurich Research Laboratory, Saumerstrasse 4, CH--8803","author":"Riordan J.","year":"2005","unstructured":"J. Riordan , D. Zamboni , and Y. Duponchel . Lessons learned from Billy Goat, an accurate worm--detection system. Research Report RZ 3609 (#99619) , IBM Zurich Research Laboratory, Saumerstrasse 4, CH--8803 , Ruschlikon , Zurich, Switzerland , 2005 . J. Riordan, D. Zamboni, and Y. Duponchel. Lessons learned from Billy Goat, an accurate worm--detection system. Research Report RZ 3609 (#99619), IBM Zurich Research Laboratory, Saumerstrasse 4, CH--8803, Ruschlikon, Zurich, Switzerland, 2005."},{"key":"e_1_3_2_1_27_1","doi-asserted-by":"publisher","DOI":"10.5555\/1039834.1039864"},{"key":"e_1_3_2_1_28_1","volume-title":"Proceedings of the 6th Symposium on Operating Systems Design & Implementation (OSDI'04)","author":"Singh S.","year":"2004","unstructured":"S. Singh , C. Estan , G. Varghese , and S. Savage . Automated worm fingerprinting . In Proceedings of the 6th Symposium on Operating Systems Design & Implementation (OSDI'04) . USENIX Association , 2004 . S. Singh, C. Estan, G. Varghese, and S. Savage. Automated worm fingerprinting. In Proceedings of the 6th Symposium on Operating Systems Design & Implementation (OSDI'04). USENIX Association, 2004."},{"key":"e_1_3_2_1_29_1","volume-title":"Proceedings of the 19th National Information Systems Security Conference","author":"Chen S.","year":"1996","unstructured":"S. Staniford-- Chen , S. Cheung , R. Crawford , M. Dilger , J. Frank , J. Hoagland , K. Levitt , C. Wee , R. Yip , and D. Zerkle . GrIDS -- A graph-based intrusion detection system for large networks . In Proceedings of the 19th National Information Systems Security Conference , 1996 . S. Staniford--Chen, S. Cheung, R. Crawford, M. Dilger, J. Frank, J. Hoagland, K. Levitt, C. Wee, R. Yip, and D. Zerkle. GrIDS -- A graph-based intrusion detection system for large networks. In Proceedings of the 19th National Information Systems Security Conference, 1996."},{"key":"e_1_3_2_1_30_1","volume-title":"October","author":"Project The Snort","year":"2007","unstructured":"The Snort Project . Snort users manual 2.6. Web page at http:\/\/www.snort.org\/docs\/snort_manual\/2.8.0\/snort_manual.pdf , October 2007 . The Snort Project. Snort users manual 2.6. Web page at http:\/\/www.snort.org\/docs\/snort_manual\/2.8.0\/snort_manual.pdf, October 2007."},{"key":"e_1_3_2_1_31_1","doi-asserted-by":"publisher","DOI":"10.1007\/11663812_12"},{"key":"e_1_3_2_1_32_1","volume-title":"Proceedings of the 14th USENIX Security Symposium (SSYM'05)","author":"Yegneswaran V.","year":"2005","unstructured":"V. Yegneswaran , J. T. Giffin , P. Barford , and S. Jha . An architecture for generating semantics-aware signatures . In Proceedings of the 14th USENIX Security Symposium (SSYM'05) , Berkeley, CA, USA , 2005 . USENIX Association. V. Yegneswaran, J. T. Giffin, P. Barford, and S. Jha. An architecture for generating semantics-aware signatures. In Proceedings of the 14th USENIX Security Symposium (SSYM'05), Berkeley, CA, USA, 2005. USENIX Association."},{"key":"e_1_3_2_1_33_1","volume-title":"18th Annual FIRST Conference","author":"Zamboni D.","year":"2006","unstructured":"D. Zamboni , J. Riordan , and Y. Duponchel . Building and deploying Billy Goat: a worm-detection system . In 18th Annual FIRST Conference , June 2006 . D. Zamboni, J. Riordan, and Y. Duponchel. Building and deploying Billy Goat: a worm-detection system. In 18th Annual FIRST Conference, June 2006."}],"event":{"name":"CCS08: 15th ACM Conference on Computer and Communications Security 2008","sponsor":["SIGSAC ACM Special Interest Group on Security, Audit, and Control","ACM Association for Computing Machinery"],"location":"Alexandria Virginia USA","acronym":"CCS08"},"container-title":["Proceedings of the 1st ACM workshop on Workshop on AISec"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/1456377.1456394","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/1456377.1456394","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,18]],"date-time":"2025-06-18T13:29:54Z","timestamp":1750253394000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/1456377.1456394"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2008,10,27]]},"references-count":30,"alternative-id":["10.1145\/1456377.1456394","10.1145\/1456377"],"URL":"https:\/\/doi.org\/10.1145\/1456377.1456394","relation":{},"subject":[],"published":{"date-parts":[[2008,10,27]]},"assertion":[{"value":"2008-10-27","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}