{"id":"https://openalex.org/W2243437504","doi":"https://doi.org/10.1145/1168857.1168862","title":"Temporal search","display_name":"Temporal search","publication_year":2006,"publication_date":"2006-10-20","ids":{"openalex":"https://openalex.org/W2243437504","doi":"https://doi.org/10.1145/1168857.1168862","mag":"2243437504"},"language":"en","primary_location":{"id":"doi:10.1145/1168857.1168862","is_oa":false,"landing_page_url":"https://doi.org/10.1145/1168857.1168862","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 12th international conference on Architectural support for programming languages and operating systems","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5043229300","display_name":"Jedidiah R. Crandall","orcid":"https://orcid.org/0000-0001-7864-2992"},"institutions":[{"id":"https://openalex.org/I2803209242","display_name":"University of California System","ror":"https://ror.org/00pjdza24","country_code":"US","type":"education","lineage":["https://openalex.org/I2803209242"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Jedidiah R. Crandall","raw_affiliation_strings":["University of California"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of California","institution_ids":["https://openalex.org/I2803209242"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5055811185","display_name":"Gary Wassermann","orcid":null},"institutions":[{"id":"https://openalex.org/I2803209242","display_name":"University of California System","ror":"https://ror.org/00pjdza24","country_code":"US","type":"education","lineage":["https://openalex.org/I2803209242"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Gary Wassermann","raw_affiliation_strings":["University of California"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of California","institution_ids":["https://openalex.org/I2803209242"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5104071428","display_name":"Daniela A. S. de Oliveira","orcid":null},"institutions":[{"id":"https://openalex.org/I2803209242","display_name":"University of California System","ror":"https://ror.org/00pjdza24","country_code":"US","type":"education","lineage":["https://openalex.org/I2803209242"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Daniela A. S. de Oliveira","raw_affiliation_strings":["University of California"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of California","institution_ids":["https://openalex.org/I2803209242"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5077610917","display_name":"Zhendong Su","orcid":"https://orcid.org/0000-0002-2970-1391"},"institutions":[{"id":"https://openalex.org/I2803209242","display_name":"University of California System","ror":"https://ror.org/00pjdza24","country_code":"US","type":"education","lineage":["https://openalex.org/I2803209242"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Zhendong Su","raw_affiliation_strings":["University of California"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of California","institution_ids":["https://openalex.org/I2803209242"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5088633029","display_name":"S. Felix Wu","orcid":"https://orcid.org/0000-0003-4644-569X"},"institutions":[{"id":"https://openalex.org/I2803209242","display_name":"University of California System","ror":"https://ror.org/00pjdza24","country_code":"US","type":"education","lineage":["https://openalex.org/I2803209242"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"S. Felix Wu","raw_affiliation_strings":["University of California"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of California","institution_ids":["https://openalex.org/I2803209242"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5083979678","display_name":"Frederic T. Chong","orcid":"https://orcid.org/0000-0001-9282-4645"},"institutions":[{"id":"https://openalex.org/I2803209242","display_name":"University of California System","ror":"https://ror.org/00pjdza24","country_code":"US","type":"education","lineage":["https://openalex.org/I2803209242"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Frederic T. Chong","raw_affiliation_strings":["University of California"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of California","institution_ids":["https://openalex.org/I2803209242"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I2803209242"],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":52,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"25","last_page":"36"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9998000264167786,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":0.9954000115394592,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.8848978281021118},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8809393048286438},{"id":"https://openalex.org/keywords/timer","display_name":"Timer","score":0.7517284154891968},{"id":"https://openalex.org/keywords/interrupt","display_name":"Interrupt","score":0.6842364072799683},{"id":"https://openalex.org/keywords/system-call","display_name":"System call","score":0.6355129480361938},{"id":"https://openalex.org/keywords/trace","display_name":"TRACE (psycholinguistics)","score":0.57452392578125},{"id":"https://openalex.org/keywords/virtual-machine","display_name":"Virtual machine","score":0.5618684887886047},{"id":"https://openalex.org/keywords/malware-analysis","display_name":"Malware analysis","score":0.5441896915435791},{"id":"https://openalex.org/keywords/key","display_name":"Key (lock)","score":0.45364758372306824},{"id":"https://openalex.org/keywords/kernel","display_name":"Kernel (algebra)","score":0.4350924491882324},{"id":"https://openalex.org/keywords/component","display_name":"Component (thermodynamics)","score":0.42779237031936646},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.36688098311424255},{"id":"https://openalex.org/keywords/embedded-system","display_name":"Embedded system","score":0.16817918419837952}],"concepts":[{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.8848978281021118},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8809393048286438},{"id":"https://openalex.org/C2776633867","wikidata":"https://www.wikidata.org/wiki/Q186612","display_name":"Timer","level":3,"score":0.7517284154891968},{"id":"https://openalex.org/C41661131","wikidata":"https://www.wikidata.org/wiki/Q220764","display_name":"Interrupt","level":3,"score":0.6842364072799683},{"id":"https://openalex.org/C2778579508","wikidata":"https://www.wikidata.org/wiki/Q722192","display_name":"System call","level":2,"score":0.6355129480361938},{"id":"https://openalex.org/C75291252","wikidata":"https://www.wikidata.org/wiki/Q1315756","display_name":"TRACE (psycholinguistics)","level":2,"score":0.57452392578125},{"id":"https://openalex.org/C25344961","wikidata":"https://www.wikidata.org/wiki/Q192726","display_name":"Virtual machine","level":2,"score":0.5618684887886047},{"id":"https://openalex.org/C2779395397","wikidata":"https://www.wikidata.org/wiki/Q15731404","display_name":"Malware analysis","level":3,"score":0.5441896915435791},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.45364758372306824},{"id":"https://openalex.org/C74193536","wikidata":"https://www.wikidata.org/wiki/Q574844","display_name":"Kernel (algebra)","level":2,"score":0.4350924491882324},{"id":"https://openalex.org/C168167062","wikidata":"https://www.wikidata.org/wiki/Q1117970","display_name":"Component (thermodynamics)","level":2,"score":0.42779237031936646},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.36688098311424255},{"id":"https://openalex.org/C149635348","wikidata":"https://www.wikidata.org/wiki/Q193040","display_name":"Embedded system","level":1,"score":0.16817918419837952},{"id":"https://openalex.org/C41895202","wikidata":"https://www.wikidata.org/wiki/Q8162","display_name":"Linguistics","level":1,"score":0.0},{"id":"https://openalex.org/C555944384","wikidata":"https://www.wikidata.org/wiki/Q249","display_name":"Wireless","level":2,"score":0.0},{"id":"https://openalex.org/C121332964","wikidata":"https://www.wikidata.org/wiki/Q413","display_name":"Physics","level":0,"score":0.0},{"id":"https://openalex.org/C114614502","wikidata":"https://www.wikidata.org/wiki/Q76592","display_name":"Combinatorics","level":1,"score":0.0},{"id":"https://openalex.org/C33923547","wikidata":"https://www.wikidata.org/wiki/Q395","display_name":"Mathematics","level":0,"score":0.0},{"id":"https://openalex.org/C173018170","wikidata":"https://www.wikidata.org/wiki/Q165678","display_name":"Microcontroller","level":2,"score":0.0},{"id":"https://openalex.org/C138885662","wikidata":"https://www.wikidata.org/wiki/Q5891","display_name":"Philosophy","level":0,"score":0.0},{"id":"https://openalex.org/C97355855","wikidata":"https://www.wikidata.org/wiki/Q11473","display_name":"Thermodynamics","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/1168857.1168862","is_oa":false,"landing_page_url":"https://doi.org/10.1145/1168857.1168862","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 12th international conference on Architectural support for programming languages and operating systems","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/16","score":0.5600000023841858,"display_name":"Peace, Justice and strong institutions"}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":66,"referenced_works":["https://openalex.org/W47175211","https://openalex.org/W1480157704","https://openalex.org/W1498585374","https://openalex.org/W1500263346","https://openalex.org/W1540548505","https://openalex.org/W1544837488","https://openalex.org/W1552906779","https://openalex.org/W1558464214","https://openalex.org/W1564075167","https://openalex.org/W1587340728","https://openalex.org/W1593040835","https://openalex.org/W1595564425","https://openalex.org/W1632088469","https://openalex.org/W1641762327","https://openalex.org/W1651936986","https://openalex.org/W1813040609","https://openalex.org/W1973501242","https://openalex.org/W1992644805","https://openalex.org/W2000883815","https://openalex.org/W2033811087","https://openalex.org/W2053680135","https://openalex.org/W2069563322","https://openalex.org/W2083477206","https://openalex.org/W2091579301","https://openalex.org/W2092043296","https://openalex.org/W2100198871","https://openalex.org/W2100673955","https://openalex.org/W2101512909","https://openalex.org/W2101587002","https://openalex.org/W2103919170","https://openalex.org/W2103953153","https://openalex.org/W2108716870","https://openalex.org/W2117882778","https://openalex.org/W2119911743","https://openalex.org/W2127133592","https://openalex.org/W2131523719","https://openalex.org/W2136290019","https://openalex.org/W2142892618","https://openalex.org/W2145904415","https://openalex.org/W2149684006","https://openalex.org/W2150042079","https://openalex.org/W2154933195","https://openalex.org/W2155750598","https://openalex.org/W2166004296","https://openalex.org/W2293069947","https://openalex.org/W2350778671","https://openalex.org/W2409664136","https://openalex.org/W2913459036","https://openalex.org/W3137220996","https://openalex.org/W4206796831","https://openalex.org/W4231945399","https://openalex.org/W4232895233","https://openalex.org/W4245671428","https://openalex.org/W4247239358","https://openalex.org/W4250874986","https://openalex.org/W4299301436","https://openalex.org/W6633127768","https://openalex.org/W6633665954","https://openalex.org/W6635723651","https://openalex.org/W6636397529","https://openalex.org/W6636398258","https://openalex.org/W6664171056","https://openalex.org/W6675350323","https://openalex.org/W6682119614","https://openalex.org/W6684644128","https://openalex.org/W6714479779"],"related_works":["https://openalex.org/W2385735409","https://openalex.org/W2392941422","https://openalex.org/W939935077","https://openalex.org/W2151230378","https://openalex.org/W2765174411","https://openalex.org/W2469346691","https://openalex.org/W3211525895","https://openalex.org/W2965893286","https://openalex.org/W2991580804","https://openalex.org/W2810666735"],"abstract_inverted_index":{"Worms,":[0],"viruses,":[1],"and":[2,76,159,263],"other":[3,56],"malware":[4,103,175,254,325],"can":[5,60,68,80,274],"be":[6,52,69,214],"ticking":[7],"bombs":[8],"counting":[9],"down":[10],"to":[11,38,73,168,176,189,291],"a":[12,27,33,44,100,105,117,122,142,231,234,260,313],"specific":[13],"time,":[14],"when":[15,49],"they":[16],"might,":[17],"for":[18,71,249,300,323],"example,":[19],"delete":[20],"files":[21],"or":[22,48],"download":[23],"new":[24],"instructions":[25],"from":[26],"public":[28],"web":[29],"server.":[30],"We":[31],"propose":[32],"novel":[34],"virtual-machine-based":[35],"analysis":[36,59,239,272,309],"technique":[37,140,273],"automatically":[39],"discover":[40,190,292,320],"the":[41,97,124,132,135,156,178,194,197,218,228,271,295,298,324],"timetable":[42,98,232],"of":[43,46,58,99,102,116,120,126,134,149,180,193,196,204,230,240,270,297],"piece":[45,101],"malware,":[47,75],"events":[50,64],"will":[51,212],"triggered,":[53],"so":[54,225],"that":[55,95,265,283,312],"types":[57],"discern":[61],"what":[62],"those":[63],"are.":[65],"This":[66],"information":[67,84],"invaluable":[70],"responding":[72],"rapid":[74],"automating":[77],"its":[78],"discovery":[79,125],"provide":[81],"more":[82,306,314],"accurate":[83],"with":[85,268,284],"less":[86],"delay":[87],"than":[88],"careful":[89],"human":[90],"analysis.Developing":[91],"an":[92,222,266],"automated":[93],"system":[94],"produces":[96],"is":[104],"challenging":[106],"research":[107],"problem.":[108],"In":[109],"this":[110],"paper,":[111],"we":[112,226,288,310,326],"describe":[113],"our":[114],"implementation":[115,318],"key":[118],"component":[119],"such":[121],"system:":[123],"timers":[127,188],"without":[128],"making":[129],"assumptions":[130],"about":[131],"integrity":[133],"infected":[136],"system's":[137],"kernel.":[138],"Our":[139,238,277],"runs":[141],"virtual":[143,157],"machine":[144],"at":[145],"slightly":[146],"different":[147,202],"rates":[148],"perceived":[150],"time":[151,161],"(time":[152],"as":[153,233],"seen":[154],"by":[155,163],"machine),":[158],"identifies":[160],"counters":[162],"correlating":[164],"memory":[165],"write":[166],"frequency":[167],"timer":[169,219],"interrupt":[170],"frequency.We":[171],"also":[172],"analyze":[173],"real":[174,242,302],"assess":[177],"feasibility":[179],"using":[181],"full-system,":[182],"machine-level":[183],"symbolic":[184,286,316],"execution":[185,287,317],"on":[186,217,246,294],"these":[187,210],"predicates.":[191],"Because":[192],"intricacies":[195],"Gregorian":[198],"calendar":[199],"(leap":[200],"years,":[201],"number":[203],"days":[205],"in":[206,282],"each":[207],"month,":[208],"etc.)":[209],"predicates":[211,293,322],"not":[213,258],"direct":[215],"expressions":[216],"but":[220],"instead":[221],"annotated":[223],"trace;":[224],"formalize":[227],"calculation":[229],"weakest":[235],"precondition":[236],"calculation.":[237],"six":[241],"worms":[243],"sheds":[244],"light":[245],"two":[247],"challenges":[248],"future":[250],"work:":[251],"1)":[252],"time-dependent":[253],"behavior":[255],"often":[256],"does":[257],"follow":[259],"linear":[261],"timetable;":[262],"2)":[264],"attacker":[267],"knowledge":[269],"evade":[275],"analysis.":[276],"current":[278],"results":[279],"are":[280,289],"promising":[281],"simple":[285],"able":[290],"day":[296],"month":[299],"four":[301],"worms.":[303],"Then":[304],"through":[305],"traditional":[307],"manual":[308],"conclude":[311],"control-flow-sensitive":[315],"would":[319],"all":[321],"analyzed.":[327]},"counts_by_year":[{"year":2025,"cited_by_count":1},{"year":2024,"cited_by_count":2},{"year":2021,"cited_by_count":3},{"year":2019,"cited_by_count":4},{"year":2018,"cited_by_count":3},{"year":2017,"cited_by_count":3},{"year":2016,"cited_by_count":7},{"year":2015,"cited_by_count":1},{"year":2014,"cited_by_count":2},{"year":2013,"cited_by_count":6},{"year":2012,"cited_by_count":4}],"updated_date":"2026-07-14T23:27:15.235271","created_date":"2016-06-24T00:00:00"}