{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,6,19]],"date-time":"2025-06-19T04:22:02Z","timestamp":1750306922209,"version":"3.41.0"},"publisher-location":"New York, NY, USA","reference-count":23,"publisher":"ACM","license":[{"start":{"date-parts":[[2013,1,26]],"date-time":"2013-01-26T00:00:00Z","timestamp":1359158400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2013,1,26]]},"DOI":"10.1145\/2430553.2430556","type":"proceedings-article","created":{"date-parts":[[2013,1,29]],"date-time":"2013-01-29T16:21:18Z","timestamp":1359476478000},"page":"1-11","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":2,"title":["Kernel mode API spectroscopy for incident response and digital forensics"],"prefix":"10.1145","author":[{"given":"Viviane","family":"Zwanger","sequence":"first","affiliation":[{"name":"Friedrich-Alexander-University, Erlangen, Germany"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Felix C.","family":"Freiling","sequence":"additional","affiliation":[{"name":"Friedrich-Alexander-University, Erlangen, Germany"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"320","published-online":{"date-parts":[[2013,1,26]]},"reference":[{"key":"e_1_3_2_1_1_1","doi-asserted-by":"publisher","DOI":"10.1109\/CTC.2010.8"},{"key":"e_1_3_2_1_2_1","unstructured":"M. Auty A. Case M. Cohen B. Dolan-Gavitt M. H. Ligh J. Levy and A. Walters. The Volatility Framework. https:\/\/www.volatilesystems.com\/.  M. Auty A. Case M. Cohen B. Dolan-Gavitt M. H. Ligh J. Levy and A. Walters. The Volatility Framework. https:\/\/www.volatilesystems.com\/."},{"key":"e_1_3_2_1_3_1","doi-asserted-by":"publisher","DOI":"10.1007\/s11416-006-0012-2"},{"volume-title":"ACM European Workshop on System Security (EuroSec)","year":"2012","author":"Bencsath B.","key":"e_1_3_2_1_4_1"},{"key":"e_1_3_2_1_5_1","doi-asserted-by":"publisher","DOI":"10.1145\/1653662.1653729"},{"key":"e_1_3_2_1_6_1","doi-asserted-by":"publisher","DOI":"10.1145\/1755913.1755932"},{"key":"e_1_3_2_1_7_1","doi-asserted-by":"publisher","DOI":"10.1145\/2110356.2110358"},{"key":"e_1_3_2_1_9_1","doi-asserted-by":"publisher","DOI":"10.1145\/2089125.2089126"},{"key":"e_1_3_2_1_10_1","unstructured":"I. Guilfanov. The Interactive Disassembler. www.hex-rays.com\/products\/ida\/index.shtm.  I. Guilfanov. The Interactive Disassembler. www.hex-rays.com\/products\/ida\/index.shtm."},{"key":"e_1_3_2_1_11_1","unstructured":"Kaspersky Lab. Technical report on TDL4 (online). http:\/\/www.securelist.com\/en\/analysis\/204792180\/TDL4\\_Top\\_Bot 2011.  Kaspersky Lab. Technical report on TDL4 (online). http:\/\/www.securelist.com\/en\/analysis\/204792180\/TDL4\\_Top\\_Bot 2011."},{"key":"e_1_3_2_1_12_1","unstructured":"Microsoft. The Windows Driver Kit (WDK). http:\/\/msdn.microsoft.com\/en-us\/library\/windows\/hardware\/gg487428.aspx .  Microsoft. The Windows Driver Kit (WDK). http:\/\/msdn.microsoft.com\/en-us\/library\/windows\/hardware\/gg487428.aspx ."},{"key":"e_1_3_2_1_13_1","unstructured":"Microsoft. Memory dump file options for windows. http:\/\/support.microsoft.com\/kb\/254649\/EN-US .  Microsoft. Memory dump file options for windows. http:\/\/support.microsoft.com\/kb\/254649\/EN-US ."},{"key":"e_1_3_2_1_14_1","doi-asserted-by":"publisher","DOI":"10.1109\/ACSAC.2007.21"},{"key":"e_1_3_2_1_15_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2011.08.001"},{"key":"e_1_3_2_1_16_1","doi-asserted-by":"publisher","DOI":"10.1145\/1519065.1519072"},{"key":"e_1_3_2_1_17_1","unstructured":"Seculert. Technical report on ramnit (online). http:\/\/blog.seculert.com\/2012\/01\/ramnit-goes-social.html 2012.  Seculert. Technical report on ramnit (online). http:\/\/blog.seculert.com\/2012\/01\/ramnit-goes-social.html 2012."},{"key":"e_1_3_2_1_18_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-89862-7_1"},{"volume-title":"In NDSS","year":"2011","author":"Srivastava A.","key":"e_1_3_2_1_19_1"},{"key":"e_1_3_2_1_20_1","unstructured":"Symantec. Technical report on stuxnet. http:\/\/www.symantec.com\/content\/en\/us\/enterprise\/media\/security\\_response\/whitepapers\/w32\\_stuxnet\\_dossier.pdf 2011.  Symantec. Technical report on stuxnet. http:\/\/www.symantec.com\/content\/en\/us\/enterprise\/media\/security\\_response\/whitepapers\/w32\\_stuxnet\\_dossier.pdf 2011."},{"key":"e_1_3_2_1_21_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-87403-4_2"},{"key":"e_1_3_2_1_22_1","doi-asserted-by":"publisher","DOI":"10.1109\/MSP.2007.45"},{"volume-title":"NDSS","year":"2008","author":"Yin H.","key":"e_1_3_2_1_24_1"},{"key":"e_1_3_2_1_25_1","unstructured":"O. Yuschuk. The Olly Debugger. http:\/\/www.ollydbg.de.  O. Yuschuk. The Olly Debugger. http:\/\/www.ollydbg.de."}],"event":{"name":"POPL '13: The 40th Annual ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages","sponsor":["SIGPLAN ACM Special Interest Group on Programming Languages","SIGACT ACM Special Interest Group on Algorithms and Computation Theory"],"location":"Rome Italy","acronym":"POPL '13"},"container-title":["Proceedings of the 2nd ACM SIGPLAN Program Protection and Reverse Engineering Workshop"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/2430553.2430556","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/2430553.2430556","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,18]],"date-time":"2025-06-18T08:35:23Z","timestamp":1750235723000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/2430553.2430556"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2013,1,26]]},"references-count":23,"alternative-id":["10.1145\/2430553.2430556","10.1145\/2430553"],"URL":"https:\/\/doi.org\/10.1145\/2430553.2430556","relation":{},"subject":[],"published":{"date-parts":[[2013,1,26]]},"assertion":[{"value":"2013-01-26","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}