{"id":"https://openalex.org/W2126257232","doi":"https://doi.org/10.1109/ism.2005.49","title":"Differencing Worm Flows and Normal Flows for Automatic Generation of Worm Signatures","display_name":"Differencing Worm Flows and Normal Flows for Automatic Generation of Worm Signatures","publication_year":2006,"publication_date":"2006-01-05","ids":{"openalex":"https://openalex.org/W2126257232","doi":"https://doi.org/10.1109/ism.2005.49","mag":"2126257232"},"language":"en","primary_location":{"id":"doi:10.1109/ism.2005.49","doi":"https://doi.org/10.1109/ism.2005.49","is_oa":false,"landing_page_url":"https://doi.org/10.1109/ism.2005.49","pdf_url":null,"source":{"id":"https://openalex.org/S7407087347","display_name":"IEEE International Symposium on Multimedia (ISM)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Seventh IEEE International Symposium on Multimedia (ISM'05)","raw_type":"proceedings-article"},"volume":null,"type":"conference-paper","is_traditional":true,"indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5079059151","display_name":"Kumar Simkhada","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I201537933","display_name":"Tohoku University","ror":"https://ror.org/01dq60k83","country_code":"JP","type":"education","lineage":["https://openalex.org/I201537933"]}],"countries":["JP"],"is_corresponding":false,"raw_author_name":"K. Simkhada","raw_affiliation_strings":["Graduate School of Information Sciences, University of Tohoku, Japan","[Graduate School of Information Science, Tohoku University, Japan]"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Graduate School of Information Sciences, University of Tohoku, Japan","institution_ids":["https://openalex.org/I201537933"]},{"raw_affiliation_string":"[Graduate School of Information Science, Tohoku University, Japan]","institution_ids":["https://openalex.org/I201537933"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5110658182","display_name":"Hiroshi Tsunoda","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I201537933","display_name":"Tohoku University","ror":"https://ror.org/01dq60k83","country_code":"JP","type":"education","lineage":["https://openalex.org/I201537933"]}],"countries":["JP"],"is_corresponding":false,"raw_author_name":"H. Tsunoda","raw_affiliation_strings":["Graduate School of Information Sciences, University of Tohoku, Japan","[Graduate School of Information Science, Tohoku University, Japan]"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Graduate School of Information Sciences, University of Tohoku, Japan","institution_ids":["https://openalex.org/I201537933"]},{"raw_affiliation_string":"[Graduate School of Information Science, Tohoku University, Japan]","institution_ids":["https://openalex.org/I201537933"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5073647612","display_name":"Yuji Waizumi","orcid":"https://orcid.org/0000-0002-8791-8740","observed_orcids":["https://orcid.org/0000-0002-8791-8740"]},"institutions":[{"id":"https://openalex.org/I201537933","display_name":"Tohoku University","ror":"https://ror.org/01dq60k83","country_code":"JP","type":"education","lineage":["https://openalex.org/I201537933"]}],"countries":["JP"],"is_corresponding":false,"raw_author_name":"Y. Waizumi","raw_affiliation_strings":["Graduate School of Information Sciences, University of Tohoku, Japan","[Graduate School of Information Science, Tohoku University, Japan]"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Graduate School of Information Sciences, University of Tohoku, Japan","institution_ids":["https://openalex.org/I201537933"]},{"raw_affiliation_string":"[Graduate School of Information Science, Tohoku University, Japan]","institution_ids":["https://openalex.org/I201537933"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5103153778","display_name":"Yoshihiro NEMOTO","orcid":"https://orcid.org/0000-0001-8547-4990","observed_orcids":["https://orcid.org/0000-0001-8547-4990"]},"institutions":[{"id":"https://openalex.org/I201537933","display_name":"Tohoku University","ror":"https://ror.org/01dq60k83","country_code":"JP","type":"education","lineage":["https://openalex.org/I201537933"]}],"countries":["JP"],"is_corresponding":false,"raw_author_name":"Y. Nemoto","raw_affiliation_strings":["Graduate School of Information Sciences, University of Tohoku, Japan","[Graduate School of Information Science, Tohoku University, Japan]"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Graduate School of Information Sciences, University of Tohoku, Japan","institution_ids":["https://openalex.org/I201537933"]},{"raw_affiliation_string":"[Graduate School of Information Science, Tohoku University, Japan]","institution_ids":["https://openalex.org/I201537933"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I201537933"],"apc_list":null,"apc_paid":null,"fwci":0.8966,"has_fulltext":false,"cited_by_count":4,"citation_normalized_percentile":{"value":0.69117033,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"57","issue":null,"first_page":"680","last_page":"685"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9926999807357788,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9926999807357788,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12326","display_name":"Network Packet Processing and Optimization","score":0.006200000178068876,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12391","display_name":"Artificial Immune Systems Applications","score":0.0003000000142492354,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/internet-worms","display_name":"Internet worms","score":0.8040000200271606},{"id":"https://openalex.org/keywords/network-flow-analysis","display_name":"network flow analysis","score":0.6330000162124634},{"id":"https://openalex.org/keywords/intrusion-detection","display_name":"intrusion detection","score":0.7639999985694885},{"id":"https://openalex.org/keywords/signature-matching","display_name":"signature matching","score":0.6869999766349792},{"id":"https://openalex.org/keywords/worm-detection","display_name":"worm detection","score":0.4390000104904175},{"id":"https://openalex.org/keywords/network-traffic-traces","display_name":"network traces","score":0.4580000042915344}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7731118202209473},{"id":"https://openalex.org/C2779696439","wikidata":"https://www.wikidata.org/wiki/Q7512811","display_name":"Signature (topology)","level":2,"score":0.5573086738586426},{"id":"https://openalex.org/C77618280","wikidata":"https://www.wikidata.org/wiki/Q1155772","display_name":"Scheme (mathematics)","level":2,"score":0.5525054931640625},{"id":"https://openalex.org/C64869954","wikidata":"https://www.wikidata.org/wiki/Q1859747","display_name":"False positive paradox","level":2,"score":0.5326459407806396},{"id":"https://openalex.org/C177264268","wikidata":"https://www.wikidata.org/wiki/Q1514741","display_name":"Set (abstract data type)","level":2,"score":0.5025246143341064},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.48036107420921326},{"id":"https://openalex.org/C2779960059","wikidata":"https://www.wikidata.org/wiki/Q7113681","display_name":"Overhead (engineering)","level":2,"score":0.47556227445602417},{"id":"https://openalex.org/C2989486834","wikidata":"https://www.wikidata.org/wiki/Q3808900","display_name":"True positive rate","level":2,"score":0.43843671679496765},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.4350971281528473},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.3299611806869507},{"id":"https://openalex.org/C120314980","wikidata":"https://www.wikidata.org/wiki/Q180634","display_name":"Distributed computing","level":1,"score":0.3201502561569214},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.30376672744750977},{"id":"https://openalex.org/C33923547","wikidata":"https://www.wikidata.org/wiki/Q395","display_name":"Mathematics","level":0,"score":0.11732476949691772},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.0},{"id":"https://openalex.org/C2524010","wikidata":"https://www.wikidata.org/wiki/Q8087","display_name":"Geometry","level":1,"score":0.0},{"id":"https://openalex.org/C134306372","wikidata":"https://www.wikidata.org/wiki/Q7754","display_name":"Mathematical analysis","level":1,"score":0.0},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.0},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/ism.2005.49","doi":"https://doi.org/10.1109/ism.2005.49","is_oa":false,"landing_page_url":"https://doi.org/10.1109/ism.2005.49","pdf_url":null,"source":{"id":"https://openalex.org/S7407087347","display_name":"IEEE International Symposium on Multimedia (ISM)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Seventh IEEE International Symposium on Multimedia (ISM'05)","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":15,"referenced_works":["https://openalex.org/W88694106","https://openalex.org/W132371169","https://openalex.org/W1540548505","https://openalex.org/W1597305440","https://openalex.org/W2001831798","https://openalex.org/W2023955403","https://openalex.org/W2033811087","https://openalex.org/W2039390926","https://openalex.org/W2137786570","https://openalex.org/W2145027384","https://openalex.org/W2152374361","https://openalex.org/W2159677016","https://openalex.org/W2743634147","https://openalex.org/W2975360570","https://openalex.org/W2984715838"],"related_works":["https://openalex.org/W2743634147","https://openalex.org/W2139822172","https://openalex.org/W2405889817","https://openalex.org/W2332350050","https://openalex.org/W7095526040","https://openalex.org/W2147799253","https://openalex.org/W2159438919","https://openalex.org/W2053744180","https://openalex.org/W2352032040","https://openalex.org/W2145027384"],"abstract_inverted_index":{"Internet":[0],"worms":[1],"pose":[2],"a":[3,37,47],"serious":[4],"threat":[5],"to":[6,18,57,101],"networks.":[7],"Most":[8],"current":[9],"intrusion":[10],"detection":[11,167],"systems":[12],"(IDSs)":[13],"take":[14],"signature":[15,120],"matching":[16],"approach":[17],"detect":[19],"worms.":[20,157],"Given":[21],"the":[22,108,134,147,162],"fact":[23],"that":[24,155,161],"most":[25],"signatures":[26,32,125],"are":[27],"developed":[28],"manually,":[29],"generating":[30],"new":[31],"for":[33],"each":[34],"variant":[35],"of":[36,94,110,115,129,131,136],"worm":[38,52,60,72,83,95,132,140],"incurs":[39],"significant":[40],"overhead.":[41],"In":[42],"this":[43],"paper,":[44],"we":[45],"propose":[46],"difference-based":[48],"scheme":[49,64,149,164],"which":[50],"differences":[51,107],"flows":[53,56,73,96,117],"and":[54,81,118],"normal":[55,89,116],"generate":[58],"robust":[59],"signatures.":[61],"The":[62],"proposed":[63,148,163],"is":[65],"based":[66],"on":[67],"two":[68],"observational":[69],"facts":[70],"-":[71],"contain":[74],"several":[75],"invariant":[76],"portions":[77],"in":[78,88],"their":[79],"payloads,":[80],"core":[82],"codes":[84],"do":[85],"not":[86],"exist":[87],"flows.":[90],"It":[91,105],"uses":[92],"samples":[93],"detected":[97],"by":[98,139],"available":[99],"means":[100],"extract":[102],"common":[103],"tokens.":[104],"then":[106],"set":[109],"these":[111],"tokens":[112],"with":[113,169],"those":[114],"generates":[119],"candidates.":[121],"By":[122],"using":[123,150],"such":[124],"within":[126],"enterprises,":[127],"out":[128],"reach":[130],"writers,":[133],"possibility":[135],"being":[137],"tricked":[138],"writers":[141],"can":[142],"be":[143],"reduced.":[144],"We":[145],"evaluate":[146],"real":[151],"network":[152],"traffic":[153],"traces":[154],"contains":[156],"Experiment":[158],"results":[159],"show":[160],"exhibits":[165],"high":[166],"rate":[168],"low":[170],"false":[171],"positives.":[172]},"counts_by_year":[],"updated_date":"2026-11-04T10:54:05.112534","created_date":"2016-06-24T00:00:00"}