{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,2]],"date-time":"2026-07-02T16:40:57Z","timestamp":1783010457342,"version":"3.54.6"},"publisher-location":"New York, NY, USA","reference-count":24,"publisher":"ACM","license":[{"start":{"date-parts":[[2009,11,9]],"date-time":"2009-11-09T00:00:00Z","timestamp":1257724800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2009,11,9]]},"DOI":"10.1145\/1653662.1653730","type":"proceedings-article","created":{"date-parts":[[2009,11,11]],"date-time":"2009-11-11T13:02:08Z","timestamp":1257944528000},"page":"566-577","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":90,"title":["Robust signatures for kernel data structures"],"prefix":"10.1145","author":[{"given":"Brendan","family":"Dolan-Gavitt","sequence":"first","affiliation":[{"name":"Georgia Institute of Technology, Atlanta, GA, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Abhinav","family":"Srivastava","sequence":"additional","affiliation":[{"name":"Georgia Institute of Technology, Atlanta, GA, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Patrick","family":"Traynor","sequence":"additional","affiliation":[{"name":"Georgia Institute of Technology, Atlanta, GA, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Jonathon","family":"Giffin","sequence":"additional","affiliation":[{"name":"Georgia Institute of Technology, Atlanta, GA, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2009,11,9]]},"reference":[{"key":"e_1_3_2_1_1_1","unstructured":"90210. Bypassing Klister 0.4 with no hooks or running a controlled thread scheduler. https:\/\/www.rootkit.com\/newsread.php?newsid=235.  90210. Bypassing Klister 0.4 with no hooks or running a controlled thread scheduler. https:\/\/www.rootkit.com\/newsread.php?newsid=235."},{"key":"e_1_3_2_1_2_1","doi-asserted-by":"publisher","DOI":"10.1109\/ACSAC.2008.29"},{"key":"e_1_3_2_1_3_1","doi-asserted-by":"publisher","DOI":"10.1145\/945445.945462"},{"key":"e_1_3_2_1_5_1","unstructured":"C. Betz. MemParser. http:\/\/sourceforge.net\/projects\/memparser.  C. Betz. MemParser. http:\/\/sourceforge.net\/projects\/memparser."},{"key":"e_1_3_2_1_6_1","first-page":"4","year":"2006","unstructured":"bugcheck. GREPEXEC: Grepping executive objects from pool memory. Uninformed Journal , 4 , 2006 . bugcheck. GREPEXEC: Grepping executive objects from pool memory. Uninformed Journal, 4, 2006.","journal-title":"Uninformed Journal"},{"key":"e_1_3_2_1_7_1","unstructured":"J. Butler. FU rootkit. http:\/\/www.rootkit.com\/project.php?id=12.  J. Butler. FU rootkit. http:\/\/www.rootkit.com\/project.php?id=12."},{"key":"e_1_3_2_1_8_1","doi-asserted-by":"publisher","DOI":"10.1145\/301618.301635"},{"key":"e_1_3_2_1_9_1","doi-asserted-by":"publisher","DOI":"10.1145\/1007512.1007518"},{"key":"e_1_3_2_1_10_1","volume-title":"Proceedings of the 8th USENIX Symposium on Operating Systems Design and Implementation (OSDI)","author":"Cozzie A.","year":"2008","unstructured":"A. Cozzie , F. Stratton , H. Xue , and S. T. King . Digging for data structures . In Proceedings of the 8th USENIX Symposium on Operating Systems Design and Implementation (OSDI) , 2008 . A. Cozzie, F. Stratton, H. Xue, and S. T. King. Digging for data structures. In Proceedings of the 8th USENIX Symposium on Operating Systems Design and Implementation (OSDI), 2008."},{"key":"e_1_3_2_1_11_1","unstructured":"T. Detristan T. Ulenspiegel Y. Malcom and M. S. von Underduk. Polymorphic shellcode engine using spectrum analysis. http:\/\/www.phrack.com\/issues.html?issue=61&id=9 2003.  T. Detristan T. Ulenspiegel Y. Malcom and M. S. von Underduk. Polymorphic shellcode engine using spectrum analysis. http:\/\/www.phrack.com\/issues.html?issue=61&id=9 2003."},{"key":"e_1_3_2_1_12_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.scico.2007.01.015"},{"key":"e_1_3_2_1_13_1","unstructured":"F-Secure. A different twist on the path to the kernel. http:\/\/www.f-secure.com\/weblog\/archives\/00001507.html 2008.  F-Secure. A different twist on the path to the kernel. http:\/\/www.f-secure.com\/weblog\/archives\/00001507.html 2008."},{"key":"e_1_3_2_1_14_1","doi-asserted-by":"publisher","DOI":"10.1145\/1180405.1180414"},{"key":"e_1_3_2_1_15_1","doi-asserted-by":"publisher","DOI":"10.5555\/1267102.1267108"},{"key":"e_1_3_2_1_16_1","doi-asserted-by":"publisher","DOI":"10.1109\/ACSAC.2007.42"},{"key":"e_1_3_2_1_17_1","doi-asserted-by":"publisher","DOI":"10.1145\/1315245.1315262"},{"key":"e_1_3_2_1_18_1","volume-title":"Proceedings of the USENIX Annual Technical Conference (ATEC)","author":"Jones S. T.","year":"2006","unstructured":"S. T. Jones , A. C. Arpaci-Dusseau , and R. H. Arpaci-Dusseau . Antfarm: tracking processes in a virtual machine environment . In Proceedings of the USENIX Annual Technical Conference (ATEC) , Boston, MA , 2006 . S. T. Jones, A. C. Arpaci-Dusseau, and R. H. Arpaci-Dusseau. Antfarm: tracking processes in a virtual machine environment. In Proceedings of the USENIX Annual Technical Conference (ATEC), Boston, MA, 2006."},{"key":"e_1_3_2_1_19_1","doi-asserted-by":"publisher","DOI":"10.1145\/1346256.1346269"},{"key":"e_1_3_2_1_20_1","volume-title":"Proceedings of the 4th International Virus Bulletin Conference (VB)","author":"Kephart J.","year":"1994","unstructured":"J. Kephart and W. Arnold . Automatic extraction of computer virus signatures . In Proceedings of the 4th International Virus Bulletin Conference (VB) , Jersey, Channel Islands, UK , 1994 . J. Kephart and W. Arnold. Automatic extraction of computer virus signatures. In Proceedings of the 4th International Virus Bulletin Conference (VB), Jersey, Channel Islands, UK, 1994."},{"key":"e_1_3_2_1_21_1","volume-title":"Proceedings of the 13th conference on USENIX Security Symposium","volume":"13","author":"Kim H.-A.","year":"2004","unstructured":"H.-A. Kim and B. Karp . Autograph: Toward automated, distributed worm signature detection . In Proceedings of the 13th conference on USENIX Security Symposium , volume 13 , San Diego, CA , 2004 . H.-A. Kim and B. Karp. Autograph: Toward automated, distributed worm signature detection. In Proceedings of the 13th conference on USENIX Security Symposium, volume 13, San Diego, CA, 2004."},{"key":"e_1_3_2_1_22_1","doi-asserted-by":"publisher","DOI":"10.1145\/972374.972384"},{"key":"e_1_3_2_1_23_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2006.18"},{"key":"e_1_3_2_1_24_1","doi-asserted-by":"publisher","DOI":"10.1145\/96267.96279"},{"key":"e_1_3_2_1_25_1","volume-title":"Fuzz revisited: A re-examination of the reliability of UNIX utilities and services. Technical report","author":"Miller B. P.","year":"1995","unstructured":"B. P. Miller , D. Koski , C. Pheow , and L. V. Maganty . Fuzz revisited: A re-examination of the reliability of UNIX utilities and services. Technical report , 1995 . B. P. Miller, D. Koski, C. Pheow, and L. V. Maganty. Fuzz revisited: A re-examination of the reliability of UNIX utilities and services. Technical report, 1995."}],"event":{"name":"CCS '09: 16th ACM Conference on Computer and Communications Security 2009","location":"Chicago Illinois USA","acronym":"CCS '09","sponsor":["SIGSAC ACM Special Interest Group on Security, Audit, and Control"]},"container-title":["Proceedings of the 16th ACM conference on Computer and communications security"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/1653662.1653730","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/1653662.1653730","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,18]],"date-time":"2025-06-18T13:38:53Z","timestamp":1750253933000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/1653662.1653730"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2009,11,9]]},"references-count":24,"alternative-id":["10.1145\/1653662.1653730","10.1145\/1653662"],"URL":"https:\/\/doi.org\/10.1145\/1653662.1653730","relation":{},"subject":[],"published":{"date-parts":[[2009,11,9]]},"assertion":[{"value":"2009-11-09","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}