{"id":"https://openalex.org/W2100198871","doi":"https://doi.org/10.1145/1102120.1102152","title":"On deriving unknown vulnerabilities from zero-day polymorphic and metamorphic worm exploits","display_name":"On deriving unknown vulnerabilities from zero-day polymorphic and metamorphic worm exploits","publication_year":2005,"publication_date":"2005-11-07","ids":{"openalex":"https://openalex.org/W2100198871","doi":"https://doi.org/10.1145/1102120.1102152","mag":"2100198871"},"language":"en","primary_location":{"id":"doi:10.1145/1102120.1102152","is_oa":false,"landing_page_url":"https://doi.org/10.1145/1102120.1102152","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 12th ACM conference on Computer and communications security","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5043229300","display_name":"Jedidiah R. Crandall","orcid":"https://orcid.org/0000-0001-7864-2992"},"institutions":[{"id":"https://openalex.org/I84218800","display_name":"University of California, Davis","ror":"https://ror.org/05rrcem69","country_code":"US","type":"education","lineage":["https://openalex.org/I84218800"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Jedidiah R. Crandall","raw_affiliation_strings":["Univ. of Calif., Davis, Davis, CA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Univ. of Calif., Davis, Davis, CA","institution_ids":["https://openalex.org/I84218800"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5077610917","display_name":"Zhendong Su","orcid":"https://orcid.org/0000-0002-2970-1391"},"institutions":[{"id":"https://openalex.org/I84218800","display_name":"University of California, Davis","ror":"https://ror.org/05rrcem69","country_code":"US","type":"education","lineage":["https://openalex.org/I84218800"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Zhendong Su","raw_affiliation_strings":["Univ. of Calif., Davis, Davis, CA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Univ. of Calif., Davis, Davis, CA","institution_ids":["https://openalex.org/I84218800"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5088633029","display_name":"S. Felix Wu","orcid":"https://orcid.org/0000-0003-4644-569X"},"institutions":[{"id":"https://openalex.org/I84218800","display_name":"University of California, Davis","ror":"https://ror.org/05rrcem69","country_code":"US","type":"education","lineage":["https://openalex.org/I84218800"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"S. Felix Wu","raw_affiliation_strings":["Univ. of Calif., Davis, Davis, CA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Univ. of Calif., Davis, Davis, CA","institution_ids":["https://openalex.org/I84218800"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5083979678","display_name":"Frederic T. Chong","orcid":"https://orcid.org/0000-0001-9282-4645"},"institutions":[{"id":"https://openalex.org/I154570441","display_name":"University of California, Santa Barbara","ror":"https://ror.org/02t274463","country_code":"US","type":"education","lineage":["https://openalex.org/I154570441"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Frederic T. Chong","raw_affiliation_strings":["Dept. Comp. Sci. Univ. of Calif., Santa Barbara, Santa Barbara, CA 93106"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Dept. Comp. Sci. Univ. of Calif., Santa Barbara, Santa Barbara, CA 93106","institution_ids":["https://openalex.org/I154570441"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":172,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"235","last_page":"248"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.996999979019165,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/exploit","display_name":"Exploit","score":0.9543255567550659},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.802682638168335},{"id":"https://openalex.org/keywords/byte","display_name":"Byte","score":0.534984290599823},{"id":"https://openalex.org/keywords/string","display_name":"String (physics)","score":0.47442880272865295},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.47358566522598267},{"id":"https://openalex.org/keywords/vulnerability","display_name":"Vulnerability (computing)","score":0.45694810152053833},{"id":"https://openalex.org/keywords/theoretical-computer-science","display_name":"Theoretical computer science","score":0.3493890166282654},{"id":"https://openalex.org/keywords/programming-language","display_name":"Programming language","score":0.14943158626556396}],"concepts":[{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.9543255567550659},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.802682638168335},{"id":"https://openalex.org/C43364308","wikidata":"https://www.wikidata.org/wiki/Q8799","display_name":"Byte","level":2,"score":0.534984290599823},{"id":"https://openalex.org/C157486923","wikidata":"https://www.wikidata.org/wiki/Q1376436","display_name":"String (physics)","level":2,"score":0.47442880272865295},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.47358566522598267},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.45694810152053833},{"id":"https://openalex.org/C80444323","wikidata":"https://www.wikidata.org/wiki/Q2878974","display_name":"Theoretical computer science","level":1,"score":0.3493890166282654},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.14943158626556396},{"id":"https://openalex.org/C121332964","wikidata":"https://www.wikidata.org/wiki/Q413","display_name":"Physics","level":0,"score":0.0},{"id":"https://openalex.org/C62520636","wikidata":"https://www.wikidata.org/wiki/Q944","display_name":"Quantum mechanics","level":1,"score":0.0}],"mesh":[],"locations_count":4,"locations":[{"id":"doi:10.1145/1102120.1102152","is_oa":false,"landing_page_url":"https://doi.org/10.1145/1102120.1102152","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 12th ACM conference on Computer and communications security","raw_type":"proceedings-article"},{"id":"pmh:oai:CiteSeerX.psu:10.1.1.118.6142","is_oa":false,"landing_page_url":"http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.118.6142","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"http://cs.ucsb.edu/~chong/papers/ccs05.pdf","raw_type":"text"},{"id":"pmh:oai:CiteSeerX.psu:10.1.1.137.3809","is_oa":false,"landing_page_url":"http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.137.3809","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"http://www.cs.purdue.edu/~xyzhang/spring07/Papers/su1.pdf","raw_type":"text"},{"id":"pmh:oai:CiteSeerX.psu:10.1.1.295.5377","is_oa":false,"landing_page_url":"http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.295.5377","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"http://www.cs.unm.edu/~crandall/ccsdacoda.pdf","raw_type":"text"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[{"id":"https://openalex.org/F4320306076","display_name":"National Science Foundation","ror":"https://ror.org/021nxhr62"}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":52,"referenced_works":["https://openalex.org/W1112477","https://openalex.org/W29275369","https://openalex.org/W88694106","https://openalex.org/W170643029","https://openalex.org/W343737952","https://openalex.org/W1485086418","https://openalex.org/W1490025813","https://openalex.org/W1509130105","https://openalex.org/W1525958661","https://openalex.org/W1528737752","https://openalex.org/W1544837488","https://openalex.org/W1561880491","https://openalex.org/W1571916075","https://openalex.org/W1574173537","https://openalex.org/W1580559113","https://openalex.org/W1581408521","https://openalex.org/W1587340728","https://openalex.org/W1589263485","https://openalex.org/W1593040835","https://openalex.org/W1595564425","https://openalex.org/W1597305440","https://openalex.org/W1671661096","https://openalex.org/W2002934700","https://openalex.org/W2033811087","https://openalex.org/W2034362794","https://openalex.org/W2036709951","https://openalex.org/W2068789742","https://openalex.org/W2096449544","https://openalex.org/W2101512909","https://openalex.org/W2102970979","https://openalex.org/W2103919170","https://openalex.org/W2116818527","https://openalex.org/W2117058582","https://openalex.org/W2126059122","https://openalex.org/W2131523719","https://openalex.org/W2132461047","https://openalex.org/W2137786570","https://openalex.org/W2142892618","https://openalex.org/W2163762767","https://openalex.org/W2165100126","https://openalex.org/W2168844087","https://openalex.org/W2171264329","https://openalex.org/W2409664136","https://openalex.org/W2743634147","https://openalex.org/W4237492309","https://openalex.org/W4254762831","https://openalex.org/W4285719527","https://openalex.org/W4299301436","https://openalex.org/W6635716266","https://openalex.org/W6635723651","https://openalex.org/W6659393092","https://openalex.org/W6714479779"],"related_works":["https://openalex.org/W17155033","https://openalex.org/W3207760230","https://openalex.org/W1496222301","https://openalex.org/W1590307681","https://openalex.org/W2536018345","https://openalex.org/W2906845177","https://openalex.org/W4200107511","https://openalex.org/W2891427086","https://openalex.org/W1968625315","https://openalex.org/W2347513417"],"abstract_inverted_index":{"Vulnerabilities":[0],"that":[1,12,77,93,187,230,236],"allow":[2],"worms":[3,44,142],"to":[4,15,48,58,61,90,108,118,185,214],"hijack":[5],"the":[6,21,72,81,88,101,109,146,156,177,221],"control":[7],"flow":[8],"of":[9,80,103,135,139,155,166,173,179,206,227,250,259],"each":[10],"host":[11],"they":[13],"spread":[14],"are":[16,25,194,209],"typically":[17,27],"discovered":[18,28],"months":[19],"before":[20],"worm":[22],"outbreak,":[23],"but":[24],"also":[26],"by":[29,149],"third":[30],"party":[31],"researchers.":[32],"A":[33],"determined":[34],"attacker":[35],"could":[36],"discover":[37],"vulnerabilities":[38,46,157],"as":[39],"easily":[40],"and":[41,68,92,105,115,158,200,235,247],"create":[42],"zero-day":[43],"for":[45,54,71,87,169,197,217,243],"unknown":[47],"network":[49,251],"defenses.":[50],"It":[51],"is":[52,231],"important":[53],"an":[55,132],"analysis":[56,120,134,240],"tool":[57,125],"be":[59,85,215],"able":[60],"generalize":[62],"from":[63,145],"a":[64,98,122,164,225,228,254],"new":[65],"exploit":[66,82,89,239],"observed":[67,76,162],"derive":[69],"protection":[70],"vulnerability.Many":[73],"researchers":[74],"have":[75],"certain":[78],"predicates":[79,96],"vector":[83],"must":[84,241],"present":[86],"work":[91],"therefore":[94],"these":[95,180],"place":[97],"limit":[99],"on":[100,256],"amount":[102],"polymorphism":[104],"metamorphism":[106],"available":[107],"attacker.":[110],"We":[111],"formalize":[112],"this":[113],"idea":[114],"subject":[116],"it":[117],"quantitative":[119],"with":[121,151],"symbolic":[123],"execution":[124],"called":[126],"DACODA.":[127],"Using":[128],"DACODA":[129],"we":[130],"provide":[131],"empirical":[133],"14":[136],"exploits":[137],"(seven":[138],"them":[140],"actual":[141],"or":[143],"attacks":[144],"Internet,":[147],"caught":[148],"Minos":[150],"no":[152,159],"prior":[153],"knowledge":[154],"false":[160],"positives":[161],"over":[163],"period":[165],"six":[167],"months)":[168],"four":[170],"operating":[171],"systems.Evaluation":[172],"our":[174],"results":[175],"in":[176,224],"light":[178],"two":[181],"models":[182],"leads":[183],"us":[184],"conclude":[186],"1)":[188],"single":[189],"contiguous":[190],"byte":[191,202],"string":[192,203],"signatures":[193,204],"not":[195,232],"effective":[196,216],"content":[198,218],"filtering,":[199],"token-based":[201],"composed":[205],"smaller":[207],"substrings":[208],"only":[210],"semantically":[211],"rich":[212],"enough":[213],"filtering":[219],"if":[220],"vulnerability":[222],"lies":[223],"part":[226],"protocol":[229],"commonly":[233],"used,":[234],"2)":[237],"practical":[238],"account":[242],"multiple":[244],"processes,":[245],"multithreading,":[246],"kernel":[248],"processing":[249],"data":[252],"necessitating":[253],"focus":[255],"primitives":[257],"instead":[258],"vulnerabilities.":[260]},"counts_by_year":[{"year":2025,"cited_by_count":1},{"year":2024,"cited_by_count":2},{"year":2022,"cited_by_count":1},{"year":2021,"cited_by_count":1},{"year":2019,"cited_by_count":5},{"year":2018,"cited_by_count":5},{"year":2017,"cited_by_count":7},{"year":2016,"cited_by_count":3},{"year":2015,"cited_by_count":4},{"year":2014,"cited_by_count":12},{"year":2013,"cited_by_count":7},{"year":2012,"cited_by_count":5}],"updated_date":"2026-07-14T23:27:15.235271","created_date":"2025-10-10T00:00:00"}