{"id":"https://openalex.org/W2119478490","doi":"https://doi.org/10.1145/1162666.1162676","title":"Polymorphic worm detection and defense","display_name":"Polymorphic worm detection and defense","publication_year":2006,"publication_date":"2006-09-11","ids":{"openalex":"https://openalex.org/W2119478490","doi":"https://doi.org/10.1145/1162666.1162676","mag":"2119478490"},"language":"en","primary_location":{"id":"doi:10.1145/1162666.1162676","is_oa":true,"landing_page_url":"https://doi.org/10.1145/1162666.1162676","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/1162666.1162676","source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2006 SIGCOMM workshop on Large-scale attack defense","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://dl.acm.org/doi/pdf/10.1145/1162666.1162676","any_repository_has_fulltext":null},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5101875963","display_name":"Jisheng Wang","orcid":"https://orcid.org/0000-0003-2949-3825"},"institutions":[{"id":"https://openalex.org/I130769515","display_name":"Pennsylvania State University","ror":"https://ror.org/04p491231","country_code":"US","type":"education","lineage":["https://openalex.org/I130769515"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Jisheng Wang","raw_affiliation_strings":["Penn State University, University Park, PA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Penn State University, University Park, PA","institution_ids":["https://openalex.org/I130769515"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5075211619","display_name":"lhab Hamadeh","orcid":null},"institutions":[{"id":"https://openalex.org/I130769515","display_name":"Pennsylvania State University","ror":"https://ror.org/04p491231","country_code":"US","type":"education","lineage":["https://openalex.org/I130769515"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"lhab Hamadeh","raw_affiliation_strings":["Penn State University, University Park, PA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Penn State University, University Park, PA","institution_ids":["https://openalex.org/I130769515"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5063903486","display_name":"George Kesidis","orcid":"https://orcid.org/0000-0001-7947-8127"},"institutions":[{"id":"https://openalex.org/I130769515","display_name":"Pennsylvania State University","ror":"https://ror.org/04p491231","country_code":"US","type":"education","lineage":["https://openalex.org/I130769515"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"George Kesidis","raw_affiliation_strings":["Penn State University, University Park, PA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Penn State University, University Park, PA","institution_ids":["https://openalex.org/I130769515"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5101739086","display_name":"David J. Miller","orcid":"https://orcid.org/0000-0001-8848-1643"},"institutions":[{"id":"https://openalex.org/I130769515","display_name":"Pennsylvania State University","ror":"https://ror.org/04p491231","country_code":"US","type":"education","lineage":["https://openalex.org/I130769515"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"David J. Miller","raw_affiliation_strings":["Penn State University, University Park, PA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Penn State University, University Park, PA","institution_ids":["https://openalex.org/I130769515"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I130769515"],"apc_list":null,"apc_paid":null,"fwci":2.3503,"has_fulltext":true,"cited_by_count":15,"citation_normalized_percentile":{"value":0.89806698,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":89,"max":94},"biblio":{"volume":null,"issue":null,"first_page":"169","last_page":"176"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9998000264167786,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9998000264167786,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.9987999796867371,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9976999759674072,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8045599460601807},{"id":"https://openalex.org/keywords/cluster-analysis","display_name":"Cluster analysis","score":0.6451827883720398},{"id":"https://openalex.org/keywords/header","display_name":"Header","score":0.6438271999359131},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.5855062007904053},{"id":"https://openalex.org/keywords/payload","display_name":"Payload (computing)","score":0.5383220314979553},{"id":"https://openalex.org/keywords/signature","display_name":"Signature (topology)","score":0.5165285468101501},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.4405360221862793},{"id":"https://openalex.org/keywords/trace","display_name":"TRACE (psycholinguistics)","score":0.43369734287261963},{"id":"https://openalex.org/keywords/network-packet","display_name":"Network packet","score":0.4261630177497864},{"id":"https://openalex.org/keywords/exploit","display_name":"Exploit","score":0.4228413999080658},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.28630954027175903},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.24743083119392395},{"id":"https://openalex.org/keywords/computer-network","display_name":"Computer network","score":0.14368662238121033}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8045599460601807},{"id":"https://openalex.org/C73555534","wikidata":"https://www.wikidata.org/wiki/Q622825","display_name":"Cluster analysis","level":2,"score":0.6451827883720398},{"id":"https://openalex.org/C48105269","wikidata":"https://www.wikidata.org/wiki/Q1141160","display_name":"Header","level":2,"score":0.6438271999359131},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.5855062007904053},{"id":"https://openalex.org/C134066672","wikidata":"https://www.wikidata.org/wiki/Q1424639","display_name":"Payload (computing)","level":3,"score":0.5383220314979553},{"id":"https://openalex.org/C2779696439","wikidata":"https://www.wikidata.org/wiki/Q7512811","display_name":"Signature (topology)","level":2,"score":0.5165285468101501},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.4405360221862793},{"id":"https://openalex.org/C75291252","wikidata":"https://www.wikidata.org/wiki/Q1315756","display_name":"TRACE (psycholinguistics)","level":2,"score":0.43369734287261963},{"id":"https://openalex.org/C158379750","wikidata":"https://www.wikidata.org/wiki/Q214111","display_name":"Network packet","level":2,"score":0.4261630177497864},{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.4228413999080658},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.28630954027175903},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.24743083119392395},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.14368662238121033},{"id":"https://openalex.org/C33923547","wikidata":"https://www.wikidata.org/wiki/Q395","display_name":"Mathematics","level":0,"score":0.0},{"id":"https://openalex.org/C41895202","wikidata":"https://www.wikidata.org/wiki/Q8162","display_name":"Linguistics","level":1,"score":0.0},{"id":"https://openalex.org/C138885662","wikidata":"https://www.wikidata.org/wiki/Q5891","display_name":"Philosophy","level":0,"score":0.0},{"id":"https://openalex.org/C2524010","wikidata":"https://www.wikidata.org/wiki/Q8087","display_name":"Geometry","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/1162666.1162676","is_oa":true,"landing_page_url":"https://doi.org/10.1145/1162666.1162676","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/1162666.1162676","source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2006 SIGCOMM workshop on Large-scale attack defense","raw_type":"proceedings-article"}],"best_oa_location":{"id":"doi:10.1145/1162666.1162676","is_oa":true,"landing_page_url":"https://doi.org/10.1145/1162666.1162676","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/1162666.1162676","source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2006 SIGCOMM workshop on Large-scale attack defense","raw_type":"proceedings-article"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W2119478490.pdf","grobid_xml":"https://content.openalex.org/works/W2119478490.grobid-xml"},"referenced_works_count":19,"referenced_works":["https://openalex.org/W88694106","https://openalex.org/W1597305440","https://openalex.org/W2003200876","https://openalex.org/W2069980026","https://openalex.org/W2092682806","https://openalex.org/W2098366185","https://openalex.org/W2100198871","https://openalex.org/W2117610718","https://openalex.org/W2121252285","https://openalex.org/W2130598205","https://openalex.org/W2134006599","https://openalex.org/W2137786570","https://openalex.org/W2146189323","https://openalex.org/W2162945593","https://openalex.org/W2164210932","https://openalex.org/W2169927847","https://openalex.org/W2533248932","https://openalex.org/W2743634147","https://openalex.org/W6635716266"],"related_works":["https://openalex.org/W2171597999","https://openalex.org/W2189136227","https://openalex.org/W1866537546","https://openalex.org/W630850086","https://openalex.org/W3200508093","https://openalex.org/W4372053344","https://openalex.org/W3193978431","https://openalex.org/W2379752180","https://openalex.org/W3044308011","https://openalex.org/W1517497829"],"abstract_inverted_index":{"The":[0],"polymorphic":[1,204],"variety":[2],"of":[3,38,48,80,86,107,146,154,181,214,227],"Internet":[4],"worms":[5],"presents":[6],"a":[7,118,165,185,190,212],"formidable":[8],"challenge":[9],"to":[10,17,40,95,169],"network":[11],"intrusion":[12],"detection":[13],"and":[14,29,104,159,175,235],"methods":[15],"designed":[16],"extract":[18,41],"payload":[19],"signatures":[20,42,83],"for":[21,217],"worm":[22,66,198],"containment.":[23],"Recently,":[24],"several":[25],"systems,":[26],"including":[27],"Earlybird":[28],"Polygraph,":[30],"have":[31,56,75,221],"been":[32],"proposed,":[33],"based":[34,200,231],"on":[35,139,184,201,232],"efficient":[36],"processing":[37],"payloads":[39],"that":[43,77,206],"are":[44,71],"either":[45],"explicitly":[46],"indicative":[47],"an":[49,224],"attack":[50],"(exploit":[51],"code":[52],"strings)":[53],"or":[54],"which":[55,194],"unusual":[57],"statistical":[58],"character":[59],"(content":[60],"prevalence,":[61],"address":[62],"dispersion)":[63],"consistent":[64],"with":[65,131,197],"activity.":[67],"While":[68],"these":[69,73],"works":[70],"seminal,":[72],"systems":[74],"limitations":[76],"affect":[78],"accuracy":[79,106],"the":[81,87,105,143,155],"extracted":[82],"and/or":[84],"practicability":[85],"system's":[88],"deployment.":[89],"Earlybird's":[90],"signature":[91,157,170],"extraction":[92],"is":[93,211],"fragile":[94],"polymorphism,":[96],"while":[97],"Polygraph":[98],"makes":[99],"assumptions":[100],"about":[101],"data":[102,216],"availability":[103],"front-end":[108,129],"flow":[109,126],"classification.":[110],"This":[111],"method":[112,120],"also":[113,160,222],"possesses":[114],"high":[115],"complexity.We":[116],"propose":[117],"new":[119],"which,":[121],"fundamentally,":[122],"integrates":[123],"header-based":[124],"multidimensional":[125],"clustering":[127,151],"as":[128],"processing,":[130],"content":[132],"sifting":[133],"(signature":[134],"extraction)":[135],"performed,":[136],"separately,":[137],"solely":[138],"each":[140],"cluster":[141],"in":[142,192],"(small)":[144],"subset":[145],"identified":[147],"suspicious":[148],"clusters.":[149],"Front-end":[150],"improves":[152],"purity":[153],"(separate)":[156],"pools":[158],"reduces":[161],"complexity.":[162],"We":[163,178],"apply":[164],"\"suffix":[166],"tree\"":[167],"approach":[168,183],"extraction,":[171],"gleaning":[172],"both":[173],"length":[174],"frequency":[176],"information.":[177],"demonstrate":[179],"efficacy":[180],"our":[182],"(background)":[186],"trace":[187,229],"taken":[188],"from":[189],"/24":[191],"Taiwan,":[193],"we":[195,207,220],"salt":[196],"traffic":[199],"two":[202],"realistic":[203],"mechanisms":[205],"propose.":[208],"Since":[209],"there":[210],"dearth":[213],"public":[215],"such":[218],"testing,":[219],"made":[223],"anonymized":[225],"version":[226],"this":[228],"available,":[230],"randomized":[233],"headers":[234],"fingerprinted":[236],"payloads.":[237]},"counts_by_year":[{"year":2018,"cited_by_count":1},{"year":2016,"cited_by_count":1},{"year":2015,"cited_by_count":1},{"year":2014,"cited_by_count":1}],"updated_date":"2026-07-29T14:22:42.915294","created_date":"2025-10-10T00:00:00"}