{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,2,1]],"date-time":"2026-02-01T06:16:53Z","timestamp":1769926613040,"version":"3.49.0"},"publisher-location":"New York, NY, USA","reference-count":29,"publisher":"ACM","license":[{"start":{"date-parts":[[2022,10,26]],"date-time":"2022-10-26T00:00:00Z","timestamp":1666742400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by-nc-sa\/4.0\/"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2022,10,26]]},"DOI":"10.1145\/3545948.3545980","type":"proceedings-article","created":{"date-parts":[[2022,10,17]],"date-time":"2022-10-17T11:21:49Z","timestamp":1666005709000},"page":"214-231","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":6,"title":["Katana: Robust, Automated, Binary-Only Forensic Analysis of Linux Memory Snapshots"],"prefix":"10.1145","author":[{"given":"Fabian","family":"Franzen","sequence":"first","affiliation":[{"name":"Technical University of Munich, Germany"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Tobias","family":"Holl","sequence":"additional","affiliation":[{"name":"Technical University of Munich, Germany"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Manuel","family":"Andreas","sequence":"additional","affiliation":[{"name":"Technical University of Munich, Germany"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Julian","family":"Kirsch","sequence":"additional","affiliation":[{"name":"Technical University of Munich, Germany"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Jens","family":"Grossklags","sequence":"additional","affiliation":[{"name":"Technical University of Munich, Germany"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"320","published-online":{"date-parts":[[2022,10,26]]},"reference":[{"key":"e_1_3_2_1_1_1","doi-asserted-by":"publisher","DOI":"10.1109\/SRDS.2010.39"},{"key":"e_1_3_2_1_2_1","doi-asserted-by":"publisher","DOI":"10.1145\/2775111"},{"key":"e_1_3_2_1_3_1","doi-asserted-by":"publisher","DOI":"10.1109\/HOTOS.2001.990073"},{"key":"e_1_3_2_1_4_1","doi-asserted-by":"publisher","DOI":"10.1145\/2508859.2516697"},{"key":"e_1_3_2_1_5_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2011.11"},{"key":"e_1_3_2_1_6_1","doi-asserted-by":"publisher","DOI":"10.1145\/1653662.1653730"},{"key":"e_1_3_2_1_7_1","volume-title":"Proceedings of the 2007 USENIX Annual Conference (USENIX ATC). USENIX Association, 233\u2013246","author":"Egele Manuel","year":"2007","unstructured":"Manuel Egele , Christopher Kruegel , Engin Kirda , Heng Yin , and Dawn Song . 2007 . Dynamic spyware analysis . In Proceedings of the 2007 USENIX Annual Conference (USENIX ATC). USENIX Association, 233\u2013246 . Manuel Egele, Christopher Kruegel, Engin Kirda, Heng Yin, and Dawn Song. 2007. Dynamic spyware analysis. In Proceedings of the 2007 USENIX Annual Conference (USENIX ATC). USENIX Association, 233\u2013246."},{"key":"e_1_3_2_1_8_1","doi-asserted-by":"publisher","DOI":"10.1145\/2897845.2897850"},{"key":"e_1_3_2_1_9_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2012.40"},{"key":"e_1_3_2_1_10_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.diin.2010.05.005"},{"key":"e_1_3_2_1_11_1","volume-title":"Monitoring of VM-based High-Interaction Honeypots. In International Workshop on Recent Advances in Intrusion Detection. Springer, 198\u2013218","author":"Jiang Xuxian","year":"2007","unstructured":"Xuxian Jiang and Xinyuan Wang . 2007 . \u201c Out-of-the-box \u201d Monitoring of VM-based High-Interaction Honeypots. In International Workshop on Recent Advances in Intrusion Detection. Springer, 198\u2013218 . Xuxian Jiang and Xinyuan Wang. 2007. \u201cOut-of-the-box\u201d Monitoring of VM-based High-Interaction Honeypots. In International Workshop on Recent Advances in Intrusion Detection. Springer, 198\u2013218."},{"key":"e_1_3_2_1_12_1","volume-title":"2015-2021. Diaphora: A Free and Open Source Program Diffing Tool","author":"Koret Joxean","unstructured":"Joxean Koret . 2015-2021. Diaphora: A Free and Open Source Program Diffing Tool . http:\/\/diaphora.re\/. Accessed: 2021-06-08. Joxean Koret. 2015-2021. Diaphora: A Free and Open Source Program Diffing Tool. http:\/\/diaphora.re\/. Accessed: 2021-06-08."},{"key":"e_1_3_2_1_13_1","unstructured":"Joakim Kennedy and Avigayil Mechtinger. 2020. New Linux Backdoor RedXOR Likely Operated by Chinese Nation-State Actor. https:\/\/www.intezer.com\/blog\/malware-analysis\/new-linux-backdoor-redxor-likely-operated-by-chinese-nation-state-actor\/.  Joakim Kennedy and Avigayil Mechtinger. 2020. New Linux Backdoor RedXOR Likely Operated by Chinese Nation-State Actor. https:\/\/www.intezer.com\/blog\/malware-analysis\/new-linux-backdoor-redxor-likely-operated-by-chinese-nation-state-actor\/."},{"key":"e_1_3_2_1_14_1","doi-asserted-by":"publisher","DOI":"10.1145\/1966913.1966941"},{"key":"e_1_3_2_1_15_1","volume-title":"The art of memory forensics: Detecting malware and threats in Windows, Linux, and Mac memory","author":"Ligh Michael\u00a0Hale","unstructured":"Michael\u00a0Hale Ligh , Andrew Case , Jamie Levy , and Aaron Walters . 2014. The art of memory forensics: Detecting malware and threats in Windows, Linux, and Mac memory . John Wiley & Sons . Michael\u00a0Hale Ligh, Andrew Case, Jamie Levy, and Aaron Walters. 2014. The art of memory forensics: Detecting malware and threats in Windows, Linux, and Mac memory. John Wiley & Sons."},{"key":"e_1_3_2_1_16_1","volume-title":"SigGraph: Brute Force Scanning of Kernel Data Structure Instances Using Graph-based Signatures. In Network and Distributed System Security Symposium (NDSS).","author":"Lin Zhiqiang","year":"2011","unstructured":"Zhiqiang Lin , Junghwan Rhee , Xiangyu Zhang , Dongyan Xu , and Xuxian Jiang . 2011 . SigGraph: Brute Force Scanning of Kernel Data Structure Instances Using Graph-based Signatures. In Network and Distributed System Security Symposium (NDSS). Zhiqiang Lin, Junghwan Rhee, Xiangyu Zhang, Dongyan Xu, and Xuxian Jiang. 2011. SigGraph: Brute Force Scanning of Kernel Data Structure Instances Using Graph-based Signatures. In Network and Distributed System Security Symposium (NDSS)."},{"key":"e_1_3_2_1_17_1","doi-asserted-by":"publisher","DOI":"10.14722\/bar.2018.23017"},{"key":"e_1_3_2_1_18_1","volume-title":"Unicorn: Next generation CPU emulator framework. BlackHat USA","author":"Nguyen Anh\u00a0Quynh","year":"2015","unstructured":"Anh\u00a0Quynh Nguyen and Hoang\u00a0Vu Dang . 2015 . Unicorn: Next generation CPU emulator framework. BlackHat USA (2015). Anh\u00a0Quynh Nguyen and Hoang\u00a0Vu Dang. 2015. Unicorn: Next generation CPU emulator framework. BlackHat USA (2015)."},{"key":"e_1_3_2_1_19_1","doi-asserted-by":"publisher","DOI":"10.1145\/3485471"},{"key":"e_1_3_2_1_20_1","doi-asserted-by":"publisher","DOI":"10.1145\/1655148.1655150"},{"key":"e_1_3_2_1_21_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2022.24324"},{"key":"e_1_3_2_1_22_1","doi-asserted-by":"publisher","DOI":"10.1145\/1519065.1519072"},{"key":"e_1_3_2_1_23_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2014.23226"},{"key":"e_1_3_2_1_24_1","volume-title":"2012 European Workshop on Systems Security (EuroSec)","author":"Schneider Christian","year":"2012","unstructured":"Christian Schneider , Jonas Pfoh , and Claudia Eckert . 2012 . Bridging the semantic gap through static code analysis . 2012 European Workshop on Systems Security (EuroSec) (2012). Christian Schneider, Jonas Pfoh, and Claudia Eckert. 2012. Bridging the semantic gap through static code analysis. 2012 European Workshop on Systems Security (EuroSec) (2012)."},{"key":"e_1_3_2_1_25_1","volume-title":"2014 USENIX Annual Technical Conference (USENIX ATC). USENIX Association, 421\u2013432","author":"Tartler Reinhard","year":"2014","unstructured":"Reinhard Tartler , Christian Dietrich , Julio Sincero , Wolfgang Schr\u00f6der-Preikschat , and Daniel Lohmann . 2014 . Static Analysis of Variability in System Software: The 90,000 ifdefs Issue . In 2014 USENIX Annual Technical Conference (USENIX ATC). USENIX Association, 421\u2013432 . Reinhard Tartler, Christian Dietrich, Julio Sincero, Wolfgang Schr\u00f6der-Preikschat, and Daniel Lohmann. 2014. Static Analysis of Variability in System Software: The 90,000 ifdefs Issue. In 2014 USENIX Annual Technical Conference (USENIX ATC). USENIX Association, 421\u2013432."},{"key":"e_1_3_2_1_26_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-87403-4_2"},{"key":"e_1_3_2_1_27_1","doi-asserted-by":"publisher","DOI":"10.1145\/1315245.1315261"},{"key":"e_1_3_2_1_28_1","doi-asserted-by":"publisher","DOI":"10.1186\/s13635-016-0038-z"},{"key":"e_1_3_2_1_29_1","unstructured":"Zynamics. 2021. Bindiff. https:\/\/www.zynamics.com\/bindiff.html. Accessed: 2021-06-08.  Zynamics. 2021. Bindiff. https:\/\/www.zynamics.com\/bindiff.html. Accessed: 2021-06-08."}],"event":{"name":"RAID 2022: 25th International Symposium on Research in Attacks, Intrusions and Defenses","location":"Limassol Cyprus","acronym":"RAID 2022"},"container-title":["Proceedings of the 25th International Symposium on Research in Attacks, Intrusions and Defenses"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3545948.3545980","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3545948.3545980","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,17]],"date-time":"2025-06-17T19:30:17Z","timestamp":1750188617000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3545948.3545980"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,10,26]]},"references-count":29,"alternative-id":["10.1145\/3545948.3545980","10.1145\/3545948"],"URL":"https:\/\/doi.org\/10.1145\/3545948.3545980","relation":{},"subject":[],"published":{"date-parts":[[2022,10,26]]},"assertion":[{"value":"2022-10-26","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}