Publications
Conferences
136048
JUUEUA7U
apa
50
1
1
639
http://ulsrl.org/wp-content/plugins/zotpress/
%7B%22status%22%3A%22success%22%2C%22updateneeded%22%3Afalse%2C%22instance%22%3A%22zotpress-b6f5242c013764cce0de69e6f42779dc%22%2C%22meta%22%3A%7B%22request_last%22%3A0%2C%22request_next%22%3A0%2C%22used_cache%22%3Atrue%7D%2C%22data%22%3A%5B%7B%22key%22%3A%22QQ637Q49%22%2C%22library%22%3A%7B%22id%22%3A136048%7D%2C%22meta%22%3A%7B%22creatorSummary%22%3A%22Dalla%20Preda%20et%20al.%22%2C%22parsedDate%22%3A%222012-01-01%22%2C%22numChildren%22%3A1%7D%2C%22bib%22%3A%22%3Cdiv%20class%3D%5C%22csl-bib-body%5C%22%20style%3D%5C%22line-height%3A%202%3B%20padding-left%3A%202em%3B%20text-indent%3A-2em%3B%5C%22%3E%5Cn%20%20%3Cdiv%20class%3D%5C%22csl-entry%5C%22%3EDalla%20Preda%2C%20M.%2C%20Feng%2C%20W.%2C%20Giacobazzi%2C%20R.%2C%20Greechie%2C%20R.%2C%20%26amp%3B%20Lakhotia%2C%20A.%20%282012%29.%20Twisting%20Additivity%20in%20Program%20Obfuscation.%20In%20S.%20Dua%2C%20A.%20Gangopadhyay%2C%20P.%20Thulasiraman%2C%20U.%20Straccia%2C%20M.%20Shepherd%2C%20%26amp%3B%20B.%20Stein%20%28Eds.%29%2C%20%3Ci%3EInformation%20Systems%2C%20Technology%20and%20Management%3C%5C%2Fi%3E%20%28pp.%20336%26%23x2013%3B347%29.%20Springer%20Berlin%20Heidelberg.%20Retrieved%20from%20%3Ca%20href%3D%27http%3A%5C%2F%5C%2Flink.springer.com%5C%2Fchapter%5C%2F10.1007%5C%2F978-3-642-29166-1_30%27%3Ehttp%3A%5C%2F%5C%2Flink.springer.com%5C%2Fchapter%5C%2F10.1007%5C%2F978-3-642-29166-1_30%3C%5C%2Fa%3E%20%3Ca%20title%3D%27Cite%20in%20RIS%20Format%27%20class%3D%27zp-CiteRIS%27%20href%3D%27http%3A%5C%2F%5C%2Fulsrl.org%5C%2Fwp-content%5C%2Fplugins%5C%2Fzotpress%5C%2Flib%5C%2Frequest%5C%2Frequest.cite.php%3Fapi_user_id%3D136048%26amp%3Bitem_key%3DQQ637Q49%27%3ECite%3C%5C%2Fa%3E%20%3C%5C%2Fdiv%3E%5Cn%3C%5C%2Fdiv%3E%22%2C%22data%22%3A%7B%22itemType%22%3A%22conferencePaper%22%2C%22title%22%3A%22Twisting%20Additivity%20in%20Program%20Obfuscation%22%2C%22creators%22%3A%5B%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22Mila%22%2C%22lastName%22%3A%22Dalla%20Preda%22%7D%2C%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22Wu%22%2C%22lastName%22%3A%22Feng%22%7D%2C%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22Roberto%22%2C%22lastName%22%3A%22Giacobazzi%22%7D%2C%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22Richard%22%2C%22lastName%22%3A%22Greechie%22%7D%2C%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22Arun%22%2C%22lastName%22%3A%22Lakhotia%22%7D%2C%7B%22creatorType%22%3A%22editor%22%2C%22firstName%22%3A%22Sumeet%22%2C%22lastName%22%3A%22Dua%22%7D%2C%7B%22creatorType%22%3A%22editor%22%2C%22firstName%22%3A%22Aryya%22%2C%22lastName%22%3A%22Gangopadhyay%22%7D%2C%7B%22creatorType%22%3A%22editor%22%2C%22firstName%22%3A%22Parimala%22%2C%22lastName%22%3A%22Thulasiraman%22%7D%2C%7B%22creatorType%22%3A%22editor%22%2C%22firstName%22%3A%22Umberto%22%2C%22lastName%22%3A%22Straccia%22%7D%2C%7B%22creatorType%22%3A%22editor%22%2C%22firstName%22%3A%22Michael%22%2C%22lastName%22%3A%22Shepherd%22%7D%2C%7B%22creatorType%22%3A%22editor%22%2C%22firstName%22%3A%22Benno%22%2C%22lastName%22%3A%22Stein%22%7D%5D%2C%22abstractNote%22%3A%22Additivity%20plays%20a%20key%20role%20in%20program%20analysis.%20It%20is%20the%20basis%20for%20designing%20Galois%20connection%20based%20abstract%20interpretations%2C%20it%20makes%20a%20Data-Flow%20Analysis%20%28DFA%29%20problem%20easy%20being%20convertible%20into%20a%20Kildall%5Cu2019s%20general%20form%2C%20and%20provides%20a%20lattice-theoretic%20model%20for%20disjunctive%20analysis.%20In%20this%20paper%20we%20consider%20reversible%20transformers%20respectively%20making%20any%20monotone%20function%20additive%20and%20maximally%20non-additive.%20We%20show%20that%2C%20under%20non%20restrictive%20hypothesis%2C%20these%20transformers%20exist%20and%20that%20they%20provide%20a%20theoretical%20foundation%20for%20the%20obfuscation%20of%20DFA.%22%2C%22date%22%3A%222012%5C%2F01%5C%2F01%22%2C%22proceedingsTitle%22%3A%22Information%20Systems%2C%20Technology%20and%20Management%22%2C%22conferenceName%22%3A%22%22%2C%22language%22%3A%22%22%2C%22DOI%22%3A%22%22%2C%22ISBN%22%3A%22978-3-642-29165-4%2C%20978-3-642-29166-1%22%2C%22url%22%3A%22http%3A%5C%2F%5C%2Flink.springer.com%5C%2Fchapter%5C%2F10.1007%5C%2F978-3-642-29166-1_30%22%2C%22collections%22%3A%5B%22JUUEUA7U%22%2C%22CFD996TJ%22%5D%2C%22dateModified%22%3A%222014-01-20T21%3A46%3A25Z%22%7D%7D%2C%7B%22key%22%3A%22PDD6P8RZ%22%2C%22library%22%3A%7B%22id%22%3A136048%7D%2C%22meta%22%3A%7B%22creatorSummary%22%3A%22Singh%20et%20al.%22%2C%22parsedDate%22%3A%222003%22%2C%22numChildren%22%3A0%7D%2C%22bib%22%3A%22%3Cdiv%20class%3D%5C%22csl-bib-body%5C%22%20style%3D%5C%22line-height%3A%202%3B%20padding-left%3A%202em%3B%20text-indent%3A-2em%3B%5C%22%3E%5Cn%20%20%3Cdiv%20class%3D%5C%22csl-entry%5C%22%3ESingh%2C%20P.%20K.%2C%20Moinuddin%2C%20M.%2C%20%26amp%3B%20Lakhotia%2C%20A.%20%282003%29.%20Using%20static%20analysis%20and%20verification%20for%20analyzing%20virus%20and%20worm%20programs.%20In%20%3Ci%3EProceedings%20of%20the%202nd%20European%20Conference%20on%20Information%20Warfare%20and%20Security%3C%5C%2Fi%3E%20%28pp.%20281%26%23x2013%3B292%29.%20%3Ca%20title%3D%27Cite%20in%20RIS%20Format%27%20class%3D%27zp-CiteRIS%27%20href%3D%27http%3A%5C%2F%5C%2Fulsrl.org%5C%2Fwp-content%5C%2Fplugins%5C%2Fzotpress%5C%2Flib%5C%2Frequest%5C%2Frequest.cite.php%3Fapi_user_id%3D136048%26amp%3Bitem_key%3DPDD6P8RZ%27%3ECite%3C%5C%2Fa%3E%20%3C%5C%2Fdiv%3E%5Cn%3C%5C%2Fdiv%3E%22%2C%22data%22%3A%7B%22itemType%22%3A%22conferencePaper%22%2C%22title%22%3A%22Using%20static%20analysis%20and%20verification%20for%20analyzing%20virus%20and%20worm%20programs%22%2C%22creators%22%3A%5B%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22Prabhat%20K%22%2C%22lastName%22%3A%22Singh%22%7D%2C%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22Mohammed%22%2C%22lastName%22%3A%22Moinuddin%22%7D%2C%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22Arun%22%2C%22lastName%22%3A%22Lakhotia%22%7D%5D%2C%22abstractNote%22%3A%22%22%2C%22date%22%3A%222003%22%2C%22proceedingsTitle%22%3A%22Proceedings%20of%20the%202nd%20European%20Conference%20on%20Information%20Warfare%20and%20Security%22%2C%22conferenceName%22%3A%22%22%2C%22language%22%3A%22%22%2C%22DOI%22%3A%22%22%2C%22ISBN%22%3A%22%22%2C%22url%22%3A%22%22%2C%22collections%22%3A%5B%22JUUEUA7U%22%2C%22JIJ3KRFV%22%5D%2C%22dateModified%22%3A%222014-01-06T21%3A01%3A25Z%22%7D%7D%2C%7B%22key%22%3A%22E3A9JUUA%22%2C%22library%22%3A%7B%22id%22%3A136048%7D%2C%22meta%22%3A%7B%22creatorSummary%22%3A%22Lakhotia%22%2C%22parsedDate%22%3A%221998%22%2C%22numChildren%22%3A2%7D%2C%22bib%22%3A%22%3Cdiv%20class%3D%5C%22csl-bib-body%5C%22%20style%3D%5C%22line-height%3A%202%3B%20padding-left%3A%202em%3B%20text-indent%3A-2em%3B%5C%22%3E%5Cn%20%20%3Cdiv%20class%3D%5C%22csl-entry%5C%22%3ELakhotia%2C%20A.%20%281998%29.%20DIME%3A%20a%20direct%20manipulation%20environment%20for%20evolutionary%20development%20of%20software.%20In%20%3Ci%3E%2C%206th%20International%20Workshop%20on%20Program%20Comprehension%2C%201998.%20IWPC%20%26%23x2019%3B98.%20Proceedings%3C%5C%2Fi%3E%20%28pp.%2072%26%23x2013%3B79%29.%20%3Ca%20href%3D%27https%3A%5C%2F%5C%2Fdoi.org%5C%2F10.1109%5C%2FWPC.1998.693289%27%3Ehttps%3A%5C%2F%5C%2Fdoi.org%5C%2F10.1109%5C%2FWPC.1998.693289%3C%5C%2Fa%3E%20%3Ca%20title%3D%27Cite%20in%20RIS%20Format%27%20class%3D%27zp-CiteRIS%27%20href%3D%27http%3A%5C%2F%5C%2Fulsrl.org%5C%2Fwp-content%5C%2Fplugins%5C%2Fzotpress%5C%2Flib%5C%2Frequest%5C%2Frequest.cite.php%3Fapi_user_id%3D136048%26amp%3Bitem_key%3DE3A9JUUA%27%3ECite%3C%5C%2Fa%3E%20%20%3Ca%20title%3D%27Download%27%20class%3D%27zp-DownloadURL%27%20href%3D%27http%3A%5C%2F%5C%2Fulsrl.org%5C%2Fwp-content%5C%2Fplugins%5C%2Fzotpress%5C%2Flib%5C%2Frequest%5C%2Frequest.dl.php%3Fapi_user_id%3D136048%26amp%3Bdlkey%3DWX8P5WW9%26amp%3Bcontent_type%3Dapplication%5C%2Fpdf%27%3EDownload%3C%5C%2Fa%3E%3C%5C%2Fdiv%3E%5Cn%3C%5C%2Fdiv%3E%22%2C%22data%22%3A%7B%22itemType%22%3A%22conferencePaper%22%2C%22title%22%3A%22DIME%3A%20a%20direct%20manipulation%20environment%20for%20evolutionary%20development%20of%20software%22%2C%22creators%22%3A%5B%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22A.%22%2C%22lastName%22%3A%22Lakhotia%22%7D%5D%2C%22abstractNote%22%3A%22This%20paper%20presents%20an%20overview%20of%20the%20DIME%20environment%20%28DIrect%20Manipulation%20Environment%29%20being%20developed%20by%20the%20author.%20The%20paper%20presents%20the%20DIME%20vision%2C%20its%20catalogue%20of%20evolutionary%20transformations-program%20transformations%20used%20by%20programmers%20during%20software%20maintenance-and%20scenarios%20of%20how%20they%20may%20be%20used%20by%20a%20programmer%20during%20software%20maintenance.%20The%20DIME%20system%20will%20provide%20for%20programmers%20what%20programmers%20provide%20for%20other%20computer%20users%3A%20a%20simple%2C%20intuitive%2C%20yet%20powerful%20way%20to%20transform%20data%20with%20the%20click%20of%20a%20mouse.%20It%20will%20place%20at%20the%20programmer%27s%20finger-tips-figuratively%20speaking-rigorous%2C%20formal%20transformations%20for%20creating%2C%20composing%2C%20analyzing%2C%20and%20modifying%20the%20architecture%20of%20a%20software%20system.%20Using%20DIME%20a%20programmer%20will%20radically%20overhaul%20the%20architecture%20of%20a%20software%20system%20just%20by%20point-and-click%20and%20drag-and-drop%20with%20the%20guarantee%20that%20the%20external%20behavior%20of%20the%20system%20is%20unchanged%22%2C%22date%22%3A%221998%22%2C%22proceedingsTitle%22%3A%22%2C%206th%20International%20Workshop%20on%20Program%20Comprehension%2C%201998.%20IWPC%20%2798.%20Proceedings%22%2C%22conferenceName%22%3A%22%2C%206th%20International%20Workshop%20on%20Program%20Comprehension%2C%201998.%20IWPC%20%2798.%20Proceedings%22%2C%22language%22%3A%22%22%2C%22DOI%22%3A%2210.1109%5C%2FWPC.1998.693289%22%2C%22ISBN%22%3A%22%22%2C%22url%22%3A%22%22%2C%22collections%22%3A%5B%22JUUEUA7U%22%5D%2C%22dateModified%22%3A%222014-01-06T21%3A00%3A35Z%22%7D%7D%2C%7B%22key%22%3A%22D3F575AG%22%2C%22library%22%3A%7B%22id%22%3A136048%7D%2C%22meta%22%3A%7B%22creatorSummary%22%3A%22Harman%20et%20al.%22%2C%22parsedDate%22%3A%222006%22%2C%22numChildren%22%3A1%7D%2C%22bib%22%3A%22%3Cdiv%20class%3D%5C%22csl-bib-body%5C%22%20style%3D%5C%22line-height%3A%202%3B%20padding-left%3A%202em%3B%20text-indent%3A-2em%3B%5C%22%3E%5Cn%20%20%3Cdiv%20class%3D%5C%22csl-entry%5C%22%3EHarman%2C%20M.%2C%20Lakhotia%2C%20A.%2C%20%26amp%3B%20Binkley%2C%20D.%20W.%20%282006%29.%20A%20Framework%20for%20Static%20Slicers%20of%20Unstructured%20Programs.%20%3Ci%3EInformation%20and%20Software%20Technology%3C%5C%2Fi%3E%2C%20%3Ci%3E48%3C%5C%2Fi%3E%287%29%2C%20549%26%23x2013%3B565.%20Retrieved%20from%20%3Ca%20href%3D%27http%3A%5C%2F%5C%2Fcalcium.dcs.kcl.ac.uk%5C%2F329%5C%2F%27%3Ehttp%3A%5C%2F%5C%2Fcalcium.dcs.kcl.ac.uk%5C%2F329%5C%2F%3C%5C%2Fa%3E%20%3Ca%20title%3D%27Cite%20in%20RIS%20Format%27%20class%3D%27zp-CiteRIS%27%20href%3D%27http%3A%5C%2F%5C%2Fulsrl.org%5C%2Fwp-content%5C%2Fplugins%5C%2Fzotpress%5C%2Flib%5C%2Frequest%5C%2Frequest.cite.php%3Fapi_user_id%3D136048%26amp%3Bitem_key%3DD3F575AG%27%3ECite%3C%5C%2Fa%3E%20%3C%5C%2Fdiv%3E%5Cn%3C%5C%2Fdiv%3E%22%2C%22data%22%3A%7B%22itemType%22%3A%22journalArticle%22%2C%22title%22%3A%22A%20Framework%20for%20Static%20Slicers%20of%20Unstructured%20Programs%22%2C%22creators%22%3A%5B%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22Mark%22%2C%22lastName%22%3A%22Harman%22%7D%2C%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22Arun%22%2C%22lastName%22%3A%22Lakhotia%22%7D%2C%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22David%20Wendell%22%2C%22lastName%22%3A%22Binkley%22%7D%5D%2C%22abstractNote%22%3A%22%22%2C%22date%22%3A%222006%22%2C%22language%22%3A%22%22%2C%22DOI%22%3A%22%22%2C%22ISSN%22%3A%22%22%2C%22url%22%3A%22http%3A%5C%2F%5C%2Fcalcium.dcs.kcl.ac.uk%5C%2F329%5C%2F%22%2C%22collections%22%3A%5B%22JUUEUA7U%22%5D%2C%22dateModified%22%3A%222014-01-06T21%3A00%3A14Z%22%7D%7D%2C%7B%22key%22%3A%222CNWXQS6%22%2C%22library%22%3A%7B%22id%22%3A136048%7D%2C%22meta%22%3A%7B%22creatorSummary%22%3A%22Lakhotia%22%2C%22parsedDate%22%3A%221993%22%2C%22numChildren%22%3A2%7D%2C%22bib%22%3A%22%3Cdiv%20class%3D%5C%22csl-bib-body%5C%22%20style%3D%5C%22line-height%3A%202%3B%20padding-left%3A%202em%3B%20text-indent%3A-2em%3B%5C%22%3E%5Cn%20%20%3Cdiv%20class%3D%5C%22csl-entry%5C%22%3ELakhotia%2C%20A.%20%281993%29.%20Rule-based%20approach%20to%20computing%20module%20cohesion.%20In%20%3Ci%3E%2C%2015th%20International%20Conference%20on%20Software%20Engineering%2C%201993.%20Proceedings%3C%5C%2Fi%3E%20%28pp.%2035%26%23x2013%3B44%29.%20%3Ca%20href%3D%27https%3A%5C%2F%5C%2Fdoi.org%5C%2F10.1109%5C%2FICSE.1993.346057%27%3Ehttps%3A%5C%2F%5C%2Fdoi.org%5C%2F10.1109%5C%2FICSE.1993.346057%3C%5C%2Fa%3E%20%3Ca%20title%3D%27Cite%20in%20RIS%20Format%27%20class%3D%27zp-CiteRIS%27%20href%3D%27http%3A%5C%2F%5C%2Fulsrl.org%5C%2Fwp-content%5C%2Fplugins%5C%2Fzotpress%5C%2Flib%5C%2Frequest%5C%2Frequest.cite.php%3Fapi_user_id%3D136048%26amp%3Bitem_key%3D2CNWXQS6%27%3ECite%3C%5C%2Fa%3E%20%20%3Ca%20title%3D%27Download%27%20class%3D%27zp-DownloadURL%27%20href%3D%27http%3A%5C%2F%5C%2Fulsrl.org%5C%2Fwp-content%5C%2Fplugins%5C%2Fzotpress%5C%2Flib%5C%2Frequest%5C%2Frequest.dl.php%3Fapi_user_id%3D136048%26amp%3Bdlkey%3DIU9UXT2T%26amp%3Bcontent_type%3Dapplication%5C%2Fpdf%27%3EDownload%3C%5C%2Fa%3E%3C%5C%2Fdiv%3E%5Cn%3C%5C%2Fdiv%3E%22%2C%22data%22%3A%7B%22itemType%22%3A%22conferencePaper%22%2C%22title%22%3A%22Rule-based%20approach%20to%20computing%20module%20cohesion%22%2C%22creators%22%3A%5B%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22A.%22%2C%22lastName%22%3A%22Lakhotia%22%7D%5D%2C%22abstractNote%22%3A%22Stevens%2C%20Myers%2C%20and%20Constantine%20introduced%20the%20notion%20of%20cohesion%2C%20an%20ordinal%20scale%20of%20seven%20levels%20that%20describes%20the%20degree%20to%20which%20the%20actions%20performed%20by%20a%20module%20contribute%20to%20a%20unified%20function%20%281974%29.%20They%20provided%20rules%2C%20termed%20as%20associative%20principles%20to%20examine%20the%20relationships%20between%20processing%20elements%20of%20a%20module%20and%20designate%20a%20cohesion%20level%20to%20it.%20Stevens%20et%20al.%2C%20however%2C%20did%20not%20give%20a%20precise%20definition%20for%20the%20term%20processing%20element.%20The%20author%20interprets%20the%20output%20variables%20of%20a%20module%20as%20its%20processing%20elements.%20Stevens%20et%20al.%27s%20associative%20principles%20are%20transformed%20to%20relate%20the%20output%20variables%20based%20on%20their%20data%20and%20control%20dependence%20relationships.%20What%20results%20is%20a%20rule-based%20approach%20to%20computing%20cohesion.%20Experimental%20results%20show%20that%2C%20but%20for%20temporal%20cohesion%2C%20the%20cohesion%20associated%20to%20a%20module%20under%20this%20reinterpretation%20and%20that%20due%20to%20the%20original%20definitions%20are%20identical%20for%20all%20examples%22%2C%22date%22%3A%221993%22%2C%22proceedingsTitle%22%3A%22%2C%2015th%20International%20Conference%20on%20Software%20Engineering%2C%201993.%20Proceedings%22%2C%22conferenceName%22%3A%22%2C%2015th%20International%20Conference%20on%20Software%20Engineering%2C%201993.%20Proceedings%22%2C%22language%22%3A%22%22%2C%22DOI%22%3A%2210.1109%5C%2FICSE.1993.346057%22%2C%22ISBN%22%3A%22%22%2C%22url%22%3A%22%22%2C%22collections%22%3A%5B%22JUUEUA7U%22%5D%2C%22dateModified%22%3A%222014-01-06T20%3A59%3A48Z%22%7D%7D%2C%7B%22key%22%3A%2245ZTFJ2R%22%2C%22library%22%3A%7B%22id%22%3A136048%7D%2C%22meta%22%3A%7B%22creatorSummary%22%3A%22Lakhotia%20and%20Deprez%22%2C%22parsedDate%22%3A%221999%22%2C%22numChildren%22%3A2%7D%2C%22bib%22%3A%22%3Cdiv%20class%3D%5C%22csl-bib-body%5C%22%20style%3D%5C%22line-height%3A%202%3B%20padding-left%3A%202em%3B%20text-indent%3A-2em%3B%5C%22%3E%5Cn%20%20%3Cdiv%20class%3D%5C%22csl-entry%5C%22%3ELakhotia%2C%20A.%2C%20%26amp%3B%20Deprez%2C%20J.-C.%20%281999%29.%20Restructuring%20functions%20with%20low%20cohesion.%20In%20%3Ci%3ESixth%20Working%20Conference%20on%20Reverse%20Engineering%2C%201999.%20Proceedings%3C%5C%2Fi%3E%20%28pp.%2036%26%23x2013%3B46%29.%20%3Ca%20href%3D%27https%3A%5C%2F%5C%2Fdoi.org%5C%2F10.1109%5C%2FWCRE.1999.806945%27%3Ehttps%3A%5C%2F%5C%2Fdoi.org%5C%2F10.1109%5C%2FWCRE.1999.806945%3C%5C%2Fa%3E%20%3Ca%20title%3D%27Cite%20in%20RIS%20Format%27%20class%3D%27zp-CiteRIS%27%20href%3D%27http%3A%5C%2F%5C%2Fulsrl.org%5C%2Fwp-content%5C%2Fplugins%5C%2Fzotpress%5C%2Flib%5C%2Frequest%5C%2Frequest.cite.php%3Fapi_user_id%3D136048%26amp%3Bitem_key%3D45ZTFJ2R%27%3ECite%3C%5C%2Fa%3E%20%20%3Ca%20title%3D%27Download%27%20class%3D%27zp-DownloadURL%27%20href%3D%27http%3A%5C%2F%5C%2Fulsrl.org%5C%2Fwp-content%5C%2Fplugins%5C%2Fzotpress%5C%2Flib%5C%2Frequest%5C%2Frequest.dl.php%3Fapi_user_id%3D136048%26amp%3Bdlkey%3DRZKZGPSR%26amp%3Bcontent_type%3Dapplication%5C%2Fpdf%27%3EDownload%3C%5C%2Fa%3E%3C%5C%2Fdiv%3E%5Cn%3C%5C%2Fdiv%3E%22%2C%22data%22%3A%7B%22itemType%22%3A%22conferencePaper%22%2C%22title%22%3A%22Restructuring%20functions%20with%20low%20cohesion%22%2C%22creators%22%3A%5B%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22A.%22%2C%22lastName%22%3A%22Lakhotia%22%7D%2C%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22J.-C.%22%2C%22lastName%22%3A%22Deprez%22%7D%5D%2C%22abstractNote%22%3A%22We%20present%20a%20technique%20for%20restructuring%20functions%20with%20low%20cohesion%20into%20functions%20with%20high%20cohesion.%20Such%20restructuring%20is%20desirable%20when%20re-architecting%20a%20legacy%20system%20into%20an%20object-oriented%20architecture.%20The%20restructured%20system%20has%20functions%20with%20higher%20cohesion%20and%20hence%20lower%20coupling.%20This%20enables%20finer-grained%20grouping%20of%20functions%20into%20objects.%20Automatically%20decomposing%20a%20function%20is%20difficult%20when%20its%20computations%20are%20interleaved.%20The%20challenge%20lies%20in%20programmatically%20identifying%20and%20separating%20the%20various%20activities%20performed%20by%20a%20complex%20code%20segment.%20The%20technique%20presented%20partitions%20the%20set%20of%20output%20variables%20of%20a%20function%20on%20the%20basis%20of%20their%20pairwise%20cohesion.%20Program%20slicing%20is%20then%20used%20to%20identify%20the%20statements%20that%20perform%20computations%20for%20each%20variable%20group%20in%20the%20partition.%20New%20functions%20corresponding%20to%20the%20slices%20are%20created%20to%20replace%20the%20original%20function.%20Experiences%20with%20restructuring%20real-world%20code%20using%20a%20tool%20that%20implements%20the%20technique%20are%20presented%22%2C%22date%22%3A%221999%22%2C%22proceedingsTitle%22%3A%22Sixth%20Working%20Conference%20on%20Reverse%20Engineering%2C%201999.%20Proceedings%22%2C%22conferenceName%22%3A%22Sixth%20Working%20Conference%20on%20Reverse%20Engineering%2C%201999.%20Proceedings%22%2C%22language%22%3A%22%22%2C%22DOI%22%3A%2210.1109%5C%2FWCRE.1999.806945%22%2C%22ISBN%22%3A%22%22%2C%22url%22%3A%22%22%2C%22collections%22%3A%5B%22JUUEUA7U%22%5D%2C%22dateModified%22%3A%222014-01-06T20%3A59%3A29Z%22%7D%7D%2C%7B%22key%22%3A%22WV48S58N%22%2C%22library%22%3A%7B%22id%22%3A136048%7D%2C%22meta%22%3A%7B%22creatorSummary%22%3A%22Lakhotia%22%2C%22parsedDate%22%3A%221993%22%2C%22numChildren%22%3A1%7D%2C%22bib%22%3A%22%3Cdiv%20class%3D%5C%22csl-bib-body%5C%22%20style%3D%5C%22line-height%3A%202%3B%20padding-left%3A%202em%3B%20text-indent%3A-2em%3B%5C%22%3E%5Cn%20%20%3Cdiv%20class%3D%5C%22csl-entry%5C%22%3ELakhotia%2C%20A.%20%281993%29.%20Constructing%20Call%20Multigraphs%20Using%20Dependence%20Graphs.%20In%20%3Ci%3EProceedings%20of%20the%2020th%20ACM%20SIGPLAN-SIGACT%20Symposium%20on%20Principles%20of%20Programming%20Languages%3C%5C%2Fi%3E%20%28pp.%20273%26%23x2013%3B284%29.%20New%20York%2C%20NY%2C%20USA%3A%20ACM.%20%3Ca%20href%3D%27https%3A%5C%2F%5C%2Fdoi.org%5C%2F10.1145%5C%2F158511.158647%27%3Ehttps%3A%5C%2F%5C%2Fdoi.org%5C%2F10.1145%5C%2F158511.158647%3C%5C%2Fa%3E%20%3Ca%20title%3D%27Cite%20in%20RIS%20Format%27%20class%3D%27zp-CiteRIS%27%20href%3D%27http%3A%5C%2F%5C%2Fulsrl.org%5C%2Fwp-content%5C%2Fplugins%5C%2Fzotpress%5C%2Flib%5C%2Frequest%5C%2Frequest.cite.php%3Fapi_user_id%3D136048%26amp%3Bitem_key%3DWV48S58N%27%3ECite%3C%5C%2Fa%3E%20%20%3Ca%20title%3D%27Download%27%20class%3D%27zp-DownloadURL%27%20href%3D%27http%3A%5C%2F%5C%2Fulsrl.org%5C%2Fwp-content%5C%2Fplugins%5C%2Fzotpress%5C%2Flib%5C%2Frequest%5C%2Frequest.dl.php%3Fapi_user_id%3D136048%26amp%3Bdlkey%3DWBU69GC2%26amp%3Bcontent_type%3Dapplication%5C%2Fpdf%27%3EDownload%3C%5C%2Fa%3E%3C%5C%2Fdiv%3E%5Cn%3C%5C%2Fdiv%3E%22%2C%22data%22%3A%7B%22itemType%22%3A%22conferencePaper%22%2C%22title%22%3A%22Constructing%20Call%20Multigraphs%20Using%20Dependence%20Graphs%22%2C%22creators%22%3A%5B%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22Arun%22%2C%22lastName%22%3A%22Lakhotia%22%7D%5D%2C%22abstractNote%22%3A%22%22%2C%22date%22%3A%221993%22%2C%22proceedingsTitle%22%3A%22Proceedings%20of%20the%2020th%20ACM%20SIGPLAN-SIGACT%20Symposium%20on%20Principles%20of%20Programming%20Languages%22%2C%22conferenceName%22%3A%22%22%2C%22language%22%3A%22%22%2C%22DOI%22%3A%2210.1145%5C%2F158511.158647%22%2C%22ISBN%22%3A%220-89791-560-7%22%2C%22url%22%3A%22http%3A%5C%2F%5C%2Fdoi.acm.org%5C%2F10.1145%5C%2F158511.158647%22%2C%22collections%22%3A%5B%22JUUEUA7U%22%5D%2C%22dateModified%22%3A%222014-01-06T20%3A58%3A13Z%22%7D%7D%2C%7B%22key%22%3A%225JMZA8T2%22%2C%22library%22%3A%7B%22id%22%3A136048%7D%2C%22meta%22%3A%7B%22creatorSummary%22%3A%22Karim%20et%20al.%22%2C%22parsedDate%22%3A%222005%22%2C%22numChildren%22%3A1%7D%2C%22bib%22%3A%22%3Cdiv%20class%3D%5C%22csl-bib-body%5C%22%20style%3D%5C%22line-height%3A%202%3B%20padding-left%3A%202em%3B%20text-indent%3A-2em%3B%5C%22%3E%5Cn%20%20%3Cdiv%20class%3D%5C%22csl-entry%5C%22%3EKarim%2C%20M.%20E.%2C%20Walenstein%2C%20A.%2C%20Lakhotia%2C%20A.%2C%20%26amp%3B%20Parida%2C%20L.%20%282005%29.%20Malware%20phylogeny%20using%20maximal%20pi-patterns.%20In%20%3Ci%3EEICAR%202005%20Conference%3A%20Best%20Paper%20Proceedings%3C%5C%2Fi%3E%20%28pp.%20156%26%23x2013%3B174%29.%20Retrieved%20from%20%3Ca%20href%3D%27http%3A%5C%2F%5C%2Fwww.researchgate.net%5C%2Fpublication%5C%2F228640414_Malware_Phylogeny_Using_Maximal_Patterns%5C%2Ffile%5C%2Fd912f50f9cc467ab89.pdf%27%3Ehttp%3A%5C%2F%5C%2Fwww.researchgate.net%5C%2Fpublication%5C%2F228640414_Malware_Phylogeny_Using_Maximal_Patterns%5C%2Ffile%5C%2Fd912f50f9cc467ab89.pdf%3C%5C%2Fa%3E%20%3Ca%20title%3D%27Cite%20in%20RIS%20Format%27%20class%3D%27zp-CiteRIS%27%20href%3D%27http%3A%5C%2F%5C%2Fulsrl.org%5C%2Fwp-content%5C%2Fplugins%5C%2Fzotpress%5C%2Flib%5C%2Frequest%5C%2Frequest.cite.php%3Fapi_user_id%3D136048%26amp%3Bitem_key%3D5JMZA8T2%27%3ECite%3C%5C%2Fa%3E%20%20%3Ca%20title%3D%27Download%27%20class%3D%27zp-DownloadURL%27%20href%3D%27http%3A%5C%2F%5C%2Fulsrl.org%5C%2Fwp-content%5C%2Fplugins%5C%2Fzotpress%5C%2Flib%5C%2Frequest%5C%2Frequest.dl.php%3Fapi_user_id%3D136048%26amp%3Bdlkey%3DGZ5ECDJ2%26amp%3Bcontent_type%3Dapplication%5C%2Fpdf%27%3EDownload%3C%5C%2Fa%3E%3C%5C%2Fdiv%3E%5Cn%3C%5C%2Fdiv%3E%22%2C%22data%22%3A%7B%22itemType%22%3A%22conferencePaper%22%2C%22title%22%3A%22Malware%20phylogeny%20using%20maximal%20pi-patterns%22%2C%22creators%22%3A%5B%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22Md%20Enamul%22%2C%22lastName%22%3A%22Karim%22%7D%2C%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22Andrew%22%2C%22lastName%22%3A%22Walenstein%22%7D%2C%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22Arun%22%2C%22lastName%22%3A%22Lakhotia%22%7D%2C%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22Laxmi%22%2C%22lastName%22%3A%22Parida%22%7D%5D%2C%22abstractNote%22%3A%22%22%2C%22date%22%3A%222005%22%2C%22proceedingsTitle%22%3A%22EICAR%202005%20Conference%3A%20Best%20Paper%20Proceedings%22%2C%22conferenceName%22%3A%22%22%2C%22language%22%3A%22%22%2C%22DOI%22%3A%22%22%2C%22ISBN%22%3A%22%22%2C%22url%22%3A%22http%3A%5C%2F%5C%2Fwww.researchgate.net%5C%2Fpublication%5C%2F228640414_Malware_Phylogeny_Using_Maximal_Patterns%5C%2Ffile%5C%2Fd912f50f9cc467ab89.pdf%22%2C%22collections%22%3A%5B%22JUUEUA7U%22%2C%22JIJ3KRFV%22%5D%2C%22dateModified%22%3A%222014-01-06T20%3A54%3A29Z%22%7D%7D%2C%7B%22key%22%3A%22D7V9GWKT%22%2C%22library%22%3A%7B%22id%22%3A136048%7D%2C%22meta%22%3A%7B%22creatorSummary%22%3A%22Deprez%20and%20Lakhotia%22%2C%22parsedDate%22%3A%222000%22%2C%22numChildren%22%3A2%7D%2C%22bib%22%3A%22%3Cdiv%20class%3D%5C%22csl-bib-body%5C%22%20style%3D%5C%22line-height%3A%202%3B%20padding-left%3A%202em%3B%20text-indent%3A-2em%3B%5C%22%3E%5Cn%20%20%3Cdiv%20class%3D%5C%22csl-entry%5C%22%3EDeprez%2C%20J.-C.%2C%20%26amp%3B%20Lakhotia%2C%20A.%20%282000%29.%20A%20formalism%20to%20automate%20mapping%20from%20program%20features%20to%20code.%20In%20%3Ci%3E8th%20International%20Workshop%20on%20Program%20Comprehension%2C%202000.%20Proceedings.%20IWPC%202000%3C%5C%2Fi%3E%20%28pp.%2069%26%23x2013%3B78%29.%20%3Ca%20href%3D%27https%3A%5C%2F%5C%2Fdoi.org%5C%2F10.1109%5C%2FWPC.2000.852481%27%3Ehttps%3A%5C%2F%5C%2Fdoi.org%5C%2F10.1109%5C%2FWPC.2000.852481%3C%5C%2Fa%3E%20%3Ca%20title%3D%27Cite%20in%20RIS%20Format%27%20class%3D%27zp-CiteRIS%27%20href%3D%27http%3A%5C%2F%5C%2Fulsrl.org%5C%2Fwp-content%5C%2Fplugins%5C%2Fzotpress%5C%2Flib%5C%2Frequest%5C%2Frequest.cite.php%3Fapi_user_id%3D136048%26amp%3Bitem_key%3DD7V9GWKT%27%3ECite%3C%5C%2Fa%3E%20%20%3Ca%20title%3D%27Download%27%20class%3D%27zp-DownloadURL%27%20href%3D%27http%3A%5C%2F%5C%2Fulsrl.org%5C%2Fwp-content%5C%2Fplugins%5C%2Fzotpress%5C%2Flib%5C%2Frequest%5C%2Frequest.dl.php%3Fapi_user_id%3D136048%26amp%3Bdlkey%3D9RXKH4AW%26amp%3Bcontent_type%3Dapplication%5C%2Fpdf%27%3EDownload%3C%5C%2Fa%3E%3C%5C%2Fdiv%3E%5Cn%3C%5C%2Fdiv%3E%22%2C%22data%22%3A%7B%22itemType%22%3A%22conferencePaper%22%2C%22title%22%3A%22A%20formalism%20to%20automate%20mapping%20from%20program%20features%20to%20code%22%2C%22creators%22%3A%5B%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22J.-C.%22%2C%22lastName%22%3A%22Deprez%22%7D%2C%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22A.%22%2C%22lastName%22%3A%22Lakhotia%22%7D%5D%2C%22abstractNote%22%3A%22How%20does%20one%20locate%20the%20segments%20of%20code%20that%20implement%20a%20particular%20feature%3F%20N.%20Wilde%20and%20M.C.%20Scully%20%28WS%29%20%281995%29%20pioneered%20the%20use%20of%20execution%20traces%20to%20map%20program%20features%20to%20code.%20Using%20their%20technique%20to%20locate%20the%20implementation%20of%20a%20particular%20feature%2C%20a%20program%20is%20executed%20with%20two%20sets%20of%20inputs%3B%20one%20set%20invokes%20the%20feature%20of%20interest%20and%20the%20other%20set%20does%20not.%20Operations%20such%20as%20set-difference%20and%20set-intersection%2C%20amongst%20others%2C%20are%20then%20applied%20on%20the%20execution%20traces%20to%20obtain%20answers%20for%20various%20questions%20related%20to%20a%20feature%20and%20its%20implementation.%20Previous%20researchers%20have%20automated%20the%20tasks%20of%20computing%20the%20execution%20traces%20and%20performing%20operations%20on%20the%20execution%20traces.%20We%20present%20a%20formalism%20to%20automate%20the%20most%20time-consuming%20aspect%20of%20this%20approach%20for%20locating%20code%2C%20namely%2C%20the%20partitioning%20of%20the%20input%20sets%20into%20invoking%20and%20non-invoking%20sets.%20A%20collection%20of%20input%20sets%20is%20partitioned%20using%20feature%20syntax%2C%20a%20grammar%20of%20the%20program%27s%20input%20annotated%20with%20feature%20names.%20An%20input%20set%20is%20placed%20in%20the%20invoking%20set%20if%20and%20only%20if%20its%20parse%20tree%20is%20annotated%20with%20that%20feature.%20WS%27%20technique%20solely%20applies%20set%20operations%20on%20the%20execution%20traces%20of%20inputs.%20In%20our%20technique%2C%20we%20also%20apply%20the%20set%20operations%20among%20the%20set%20of%20features%20used%20by%20these%20inputs.%20By%20doing%20so%2C%20we%20can%20precisely%20determine%20the%20features%20whose%20implementation%20is%20identified%20when%20applying%20the%20operations%20on%20the%20execution%20traces%22%2C%22date%22%3A%222000%22%2C%22proceedingsTitle%22%3A%228th%20International%20Workshop%20on%20Program%20Comprehension%2C%202000.%20Proceedings.%20IWPC%202000%22%2C%22conferenceName%22%3A%228th%20International%20Workshop%20on%20Program%20Comprehension%2C%202000.%20Proceedings.%20IWPC%202000%22%2C%22language%22%3A%22%22%2C%22DOI%22%3A%2210.1109%5C%2FWPC.2000.852481%22%2C%22ISBN%22%3A%22%22%2C%22url%22%3A%22%22%2C%22collections%22%3A%5B%22JUUEUA7U%22%5D%2C%22dateModified%22%3A%222014-01-06T20%3A53%3A21Z%22%7D%7D%2C%7B%22key%22%3A%22Z6V3AI86%22%2C%22library%22%3A%7B%22id%22%3A136048%7D%2C%22meta%22%3A%7B%22creatorSummary%22%3A%22Goel%22%2C%22parsedDate%22%3A%222008%22%2C%22numChildren%22%3A1%7D%2C%22bib%22%3A%22%3Cdiv%20class%3D%5C%22csl-bib-body%5C%22%20style%3D%5C%22line-height%3A%202%3B%20padding-left%3A%202em%3B%20text-indent%3A-2em%3B%5C%22%3E%5Cn%20%20%3Cdiv%20class%3D%5C%22csl-entry%5C%22%3EGoel%2C%20S.%20%282008%29.%203rd%20Annual%20Symposium%20on%20Information%20Assurance%20%28ASIA%26%23x2019%3B08%29.%20Retrieved%20from%20%3Ca%20href%3D%27http%3A%5C%2F%5C%2Fciteseerx.ist.psu.edu%5C%2Fviewdoc%5C%2Fdownload%3Fdoi%3D10.1.1.295.9837%26rep%3Drep1%26type%3Dpdf%27%3Ehttp%3A%5C%2F%5C%2Fciteseerx.ist.psu.edu%5C%2Fviewdoc%5C%2Fdownload%3Fdoi%3D10.1.1.295.9837%26rep%3Drep1%26type%3Dpdf%3C%5C%2Fa%3E%20%3Ca%20title%3D%27Cite%20in%20RIS%20Format%27%20class%3D%27zp-CiteRIS%27%20href%3D%27http%3A%5C%2F%5C%2Fulsrl.org%5C%2Fwp-content%5C%2Fplugins%5C%2Fzotpress%5C%2Flib%5C%2Frequest%5C%2Frequest.cite.php%3Fapi_user_id%3D136048%26amp%3Bitem_key%3DZ6V3AI86%27%3ECite%3C%5C%2Fa%3E%20%20%3Ca%20title%3D%27Download%27%20class%3D%27zp-DownloadURL%27%20href%3D%27http%3A%5C%2F%5C%2Fulsrl.org%5C%2Fwp-content%5C%2Fplugins%5C%2Fzotpress%5C%2Flib%5C%2Frequest%5C%2Frequest.dl.php%3Fapi_user_id%3D136048%26amp%3Bdlkey%3DZGZNFBTH%26amp%3Bcontent_type%3Dapplication%5C%2Fpdf%27%3EDownload%3C%5C%2Fa%3E%3C%5C%2Fdiv%3E%5Cn%3C%5C%2Fdiv%3E%22%2C%22data%22%3A%7B%22itemType%22%3A%22journalArticle%22%2C%22title%22%3A%223rd%20Annual%20Symposium%20on%20Information%20Assurance%20%28ASIA%5Cu201908%29%22%2C%22creators%22%3A%5B%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22Sanjay%22%2C%22lastName%22%3A%22Goel%22%7D%5D%2C%22abstractNote%22%3A%22%22%2C%22date%22%3A%222008%22%2C%22language%22%3A%22%22%2C%22DOI%22%3A%22%22%2C%22ISSN%22%3A%22%22%2C%22url%22%3A%22http%3A%5C%2F%5C%2Fciteseerx.ist.psu.edu%5C%2Fviewdoc%5C%2Fdownload%3Fdoi%3D10.1.1.295.9837%26rep%3Drep1%26type%3Dpdf%22%2C%22collections%22%3A%5B%22JUUEUA7U%22%5D%2C%22dateModified%22%3A%222014-01-06T20%3A51%3A00Z%22%7D%7D%2C%7B%22key%22%3A%22AQUFVEXN%22%2C%22library%22%3A%7B%22id%22%3A136048%7D%2C%22meta%22%3A%7B%22creatorSummary%22%3A%22Boccardo%20et%20al.%22%2C%22parsedDate%22%3A%222009%22%2C%22numChildren%22%3A1%7D%2C%22bib%22%3A%22%3Cdiv%20class%3D%5C%22csl-bib-body%5C%22%20style%3D%5C%22line-height%3A%202%3B%20padding-left%3A%202em%3B%20text-indent%3A-2em%3B%5C%22%3E%5Cn%20%20%3Cdiv%20class%3D%5C%22csl-entry%5C%22%3EBoccardo%2C%20D.%20R.%2C%20Lakhotia%2C%20A.%2C%20Manacero%20Jr%2C%20A.%2C%20%26amp%3B%20Venable%2C%20M.%20%282009%29.%20Adapting%20call-string%20approach%20for%20x86%20obfuscated%20binaries.%20%3Ci%3ESimp%26%23xF3%3Bsio%20Brasileiro%20Em%20Seguran%5C%5Ccca%20Da%20Informa%5C%5Cccao%20e%20de%20Sistemas%20Computacionais%3C%5C%2Fi%3E.%20Retrieved%20from%20%3Ca%20href%3D%27http%3A%5C%2F%5C%2Fwww.lbd.dcc.ufmg.br%5C%2Fcolecoes%5C%2Fsbseg%5C%2F2009%5C%2F011.pdf%27%3Ehttp%3A%5C%2F%5C%2Fwww.lbd.dcc.ufmg.br%5C%2Fcolecoes%5C%2Fsbseg%5C%2F2009%5C%2F011.pdf%3C%5C%2Fa%3E%20%3Ca%20title%3D%27Cite%20in%20RIS%20Format%27%20class%3D%27zp-CiteRIS%27%20href%3D%27http%3A%5C%2F%5C%2Fulsrl.org%5C%2Fwp-content%5C%2Fplugins%5C%2Fzotpress%5C%2Flib%5C%2Frequest%5C%2Frequest.cite.php%3Fapi_user_id%3D136048%26amp%3Bitem_key%3DAQUFVEXN%27%3ECite%3C%5C%2Fa%3E%20%20%3Ca%20title%3D%27Download%27%20class%3D%27zp-DownloadURL%27%20href%3D%27http%3A%5C%2F%5C%2Fulsrl.org%5C%2Fwp-content%5C%2Fplugins%5C%2Fzotpress%5C%2Flib%5C%2Frequest%5C%2Frequest.dl.php%3Fapi_user_id%3D136048%26amp%3Bdlkey%3D3RAW8NTX%26amp%3Bcontent_type%3Dapplication%5C%2Fpdf%27%3EDownload%3C%5C%2Fa%3E%3C%5C%2Fdiv%3E%5Cn%3C%5C%2Fdiv%3E%22%2C%22data%22%3A%7B%22itemType%22%3A%22journalArticle%22%2C%22title%22%3A%22Adapting%20call-string%20approach%20for%20x86%20obfuscated%20binaries%22%2C%22creators%22%3A%5B%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22Davidson%20R.%22%2C%22lastName%22%3A%22Boccardo%22%7D%2C%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22Arun%22%2C%22lastName%22%3A%22Lakhotia%22%7D%2C%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22A.%22%2C%22lastName%22%3A%22Manacero%20Jr%22%7D%2C%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22Michael%22%2C%22lastName%22%3A%22Venable%22%7D%5D%2C%22abstractNote%22%3A%22%22%2C%22date%22%3A%222009%22%2C%22language%22%3A%22%22%2C%22DOI%22%3A%22%22%2C%22ISSN%22%3A%22%22%2C%22url%22%3A%22http%3A%5C%2F%5C%2Fwww.lbd.dcc.ufmg.br%5C%2Fcolecoes%5C%2Fsbseg%5C%2F2009%5C%2F011.pdf%22%2C%22collections%22%3A%5B%22JUUEUA7U%22%2C%22CFD996TJ%22%5D%2C%22dateModified%22%3A%222014-01-06T20%3A50%3A20Z%22%7D%7D%2C%7B%22key%22%3A%229IN3TFCT%22%2C%22library%22%3A%7B%22id%22%3A136048%7D%2C%22meta%22%3A%7B%22creatorSummary%22%3A%22Eric%20et%20al.%22%2C%22parsedDate%22%3A%222005%22%2C%22numChildren%22%3A1%7D%2C%22bib%22%3A%22%3Cdiv%20class%3D%5C%22csl-bib-body%5C%22%20style%3D%5C%22line-height%3A%202%3B%20padding-left%3A%202em%3B%20text-indent%3A-2em%3B%5C%22%3E%5Cn%20%20%3Cdiv%20class%3D%5C%22csl-entry%5C%22%3EEric%2C%20U.%20K.%2C%20Kapoor%2C%20A.%2C%20%26amp%3B%20Lakhotia%2C%20A.%20%282005%29.%20DOC%26%23x2013%3BANSWERING%20THE%20HIDDEN%20%26%23x201C%3BCALL%26%23x201D%3B%20OF%20A%20VIRUS.%20%3Ci%3EVirus%20Bulletin%3C%5C%2Fi%3E%2C%20%3Ci%3E4%3C%5C%2Fi%3E%2C%208%26%23x2013%3B10.%20Retrieved%20from%20%3Ca%20href%3D%27http%3A%5C%2F%5C%2Fwww.cacs.louisiana.edu%5C%2F~arun%5C%2Fpapers%5C%2Fdetecting-obfuscated-calls-VB2005.pdf%27%3Ehttp%3A%5C%2F%5C%2Fwww.cacs.louisiana.edu%5C%2F~arun%5C%2Fpapers%5C%2Fdetecting-obfuscated-calls-VB2005.pdf%3C%5C%2Fa%3E%20%3Ca%20title%3D%27Cite%20in%20RIS%20Format%27%20class%3D%27zp-CiteRIS%27%20href%3D%27http%3A%5C%2F%5C%2Fulsrl.org%5C%2Fwp-content%5C%2Fplugins%5C%2Fzotpress%5C%2Flib%5C%2Frequest%5C%2Frequest.cite.php%3Fapi_user_id%3D136048%26amp%3Bitem_key%3D9IN3TFCT%27%3ECite%3C%5C%2Fa%3E%20%20%3Ca%20title%3D%27Download%27%20class%3D%27zp-DownloadURL%27%20href%3D%27http%3A%5C%2F%5C%2Fulsrl.org%5C%2Fwp-content%5C%2Fplugins%5C%2Fzotpress%5C%2Flib%5C%2Frequest%5C%2Frequest.dl.php%3Fapi_user_id%3D136048%26amp%3Bdlkey%3DHVXMGK2K%26amp%3Bcontent_type%3Dapplication%5C%2Fpdf%27%3EDownload%3C%5C%2Fa%3E%3C%5C%2Fdiv%3E%5Cn%3C%5C%2Fdiv%3E%22%2C%22data%22%3A%7B%22itemType%22%3A%22journalArticle%22%2C%22title%22%3A%22DOC%5Cu2013ANSWERING%20THE%20HIDDEN%20%5Cu201cCALL%5Cu201d%20OF%20A%20VIRUS%22%2C%22creators%22%3A%5B%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22Uday%20Kumar%22%2C%22lastName%22%3A%22Eric%22%7D%2C%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22Aditya%22%2C%22lastName%22%3A%22Kapoor%22%7D%2C%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22Arun%22%2C%22lastName%22%3A%22Lakhotia%22%7D%5D%2C%22abstractNote%22%3A%22%22%2C%22date%22%3A%222005%22%2C%22language%22%3A%22%22%2C%22DOI%22%3A%22%22%2C%22ISSN%22%3A%22%22%2C%22url%22%3A%22http%3A%5C%2F%5C%2Fwww.cacs.louisiana.edu%5C%2F~arun%5C%2Fpapers%5C%2Fdetecting-obfuscated-calls-VB2005.pdf%22%2C%22collections%22%3A%5B%22JUUEUA7U%22%5D%2C%22dateModified%22%3A%222014-01-06T20%3A50%3A03Z%22%7D%7D%2C%7B%22key%22%3A%22NPZCXNIQ%22%2C%22library%22%3A%7B%22id%22%3A136048%7D%2C%22meta%22%3A%7B%22creatorSummary%22%3A%22Walenstein%20et%20al.%22%2C%22parsedDate%22%3A%222007%22%2C%22numChildren%22%3A0%7D%2C%22bib%22%3A%22%3Cdiv%20class%3D%5C%22csl-bib-body%5C%22%20style%3D%5C%22line-height%3A%202%3B%20padding-left%3A%202em%3B%20text-indent%3A-2em%3B%5C%22%3E%5Cn%20%20%3Cdiv%20class%3D%5C%22csl-entry%5C%22%3EWalenstein%2C%20A.%2C%20Mathur%2C%20R.%2C%20Chouchane%2C%20M.%2C%20%26amp%3B%20Lakhotia%2C%20A.%20%282007%29.%20The%20design%20space%20of%20metamorphic%20malware.%20In%20%3Ci%3EProceedings%20of%20the%202nd%20International%20Conference%20on%20i-Warfare%20%26amp%3B%20Security%20%28ICIW%29%3C%5C%2Fi%3E%20%28pp.%20241%26%23x2013%3B248%29.%20%3Ca%20title%3D%27Cite%20in%20RIS%20Format%27%20class%3D%27zp-CiteRIS%27%20href%3D%27http%3A%5C%2F%5C%2Fulsrl.org%5C%2Fwp-content%5C%2Fplugins%5C%2Fzotpress%5C%2Flib%5C%2Frequest%5C%2Frequest.cite.php%3Fapi_user_id%3D136048%26amp%3Bitem_key%3DNPZCXNIQ%27%3ECite%3C%5C%2Fa%3E%20%3C%5C%2Fdiv%3E%5Cn%3C%5C%2Fdiv%3E%22%2C%22data%22%3A%7B%22itemType%22%3A%22conferencePaper%22%2C%22title%22%3A%22The%20design%20space%20of%20metamorphic%20malware%22%2C%22creators%22%3A%5B%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22Andrew%22%2C%22lastName%22%3A%22Walenstein%22%7D%2C%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22Rachit%22%2C%22lastName%22%3A%22Mathur%22%7D%2C%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22Mohamed%22%2C%22lastName%22%3A%22Chouchane%22%7D%2C%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22Arun%22%2C%22lastName%22%3A%22Lakhotia%22%7D%5D%2C%22abstractNote%22%3A%22%22%2C%22date%22%3A%222007%22%2C%22proceedingsTitle%22%3A%22Proceedings%20of%20the%202nd%20International%20Conference%20on%20i-Warfare%20%26%20Security%20%28ICIW%29%22%2C%22conferenceName%22%3A%22%22%2C%22language%22%3A%22%22%2C%22DOI%22%3A%22%22%2C%22ISBN%22%3A%22%22%2C%22url%22%3A%22%22%2C%22collections%22%3A%5B%22JUUEUA7U%22%2C%22APED9CV8%22%5D%2C%22dateModified%22%3A%222014-01-06T20%3A49%3A30Z%22%7D%7D%2C%7B%22key%22%3A%22CVSEPQN4%22%2C%22library%22%3A%7B%22id%22%3A136048%7D%2C%22meta%22%3A%7B%22creatorSummary%22%3A%22Lakhotia%20et%20al.%22%2C%22parsedDate%22%3A%222010%22%2C%22numChildren%22%3A1%7D%2C%22bib%22%3A%22%3Cdiv%20class%3D%5C%22csl-bib-body%5C%22%20style%3D%5C%22line-height%3A%202%3B%20padding-left%3A%202em%3B%20text-indent%3A-2em%3B%5C%22%3E%5Cn%20%20%3Cdiv%20class%3D%5C%22csl-entry%5C%22%3ELakhotia%2C%20A.%2C%20Boccardo%2C%20D.%20R.%2C%20Singh%2C%20A.%2C%20%26amp%3B%20Manacero%2CJr.%2C%20A.%20%282010%29.%20Context-sensitive%20Analysis%20of%20Obfuscated%20x86%20Executables.%20In%20%3Ci%3EProceedings%20of%20the%202010%20ACM%20SIGPLAN%20Workshop%20on%20Partial%20Evaluation%20and%20Program%20Manipulation%3C%5C%2Fi%3E%20%28pp.%20131%26%23x2013%3B140%29.%20New%20York%2C%20NY%2C%20USA%3A%20ACM.%20%3Ca%20href%3D%27https%3A%5C%2F%5C%2Fdoi.org%5C%2F10.1145%5C%2F1706356.1706381%27%3Ehttps%3A%5C%2F%5C%2Fdoi.org%5C%2F10.1145%5C%2F1706356.1706381%3C%5C%2Fa%3E%20%3Ca%20title%3D%27Cite%20in%20RIS%20Format%27%20class%3D%27zp-CiteRIS%27%20href%3D%27http%3A%5C%2F%5C%2Fulsrl.org%5C%2Fwp-content%5C%2Fplugins%5C%2Fzotpress%5C%2Flib%5C%2Frequest%5C%2Frequest.cite.php%3Fapi_user_id%3D136048%26amp%3Bitem_key%3DCVSEPQN4%27%3ECite%3C%5C%2Fa%3E%20%20%3Ca%20title%3D%27Download%27%20class%3D%27zp-DownloadURL%27%20href%3D%27http%3A%5C%2F%5C%2Fulsrl.org%5C%2Fwp-content%5C%2Fplugins%5C%2Fzotpress%5C%2Flib%5C%2Frequest%5C%2Frequest.dl.php%3Fapi_user_id%3D136048%26amp%3Bdlkey%3D3THHHAUU%26amp%3Bcontent_type%3Dapplication%5C%2Fpdf%27%3EDownload%3C%5C%2Fa%3E%3C%5C%2Fdiv%3E%5Cn%3C%5C%2Fdiv%3E%22%2C%22data%22%3A%7B%22itemType%22%3A%22conferencePaper%22%2C%22title%22%3A%22Context-sensitive%20Analysis%20of%20Obfuscated%20x86%20Executables%22%2C%22creators%22%3A%5B%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22Arun%22%2C%22lastName%22%3A%22Lakhotia%22%7D%2C%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22Davidson%20R.%22%2C%22lastName%22%3A%22Boccardo%22%7D%2C%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22Anshuman%22%2C%22lastName%22%3A%22Singh%22%7D%2C%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22Aleardo%22%2C%22lastName%22%3A%22Manacero%2CJr.%22%7D%5D%2C%22abstractNote%22%3A%22A%20method%20for%20context-sensitive%20analysis%20of%20binaries%20that%20may%20have%20obfuscated%20procedure%20call%20and%20return%20operations%20is%20presented.%20Such%20binaries%20may%20use%20operators%20to%20directly%20manipulate%20stack%20instead%20of%20using%20native%20call%20and%20ret%20instructions%20to%20achieve%20equivalent%20behavior.%20Since%20definition%20of%20context-sensitivity%20and%20algorithms%20for%20context-sensitive%20analysis%20have%20thus%20far%20been%20based%20on%20the%20specific%20semantics%20associated%20to%20procedure%20call%20and%20return%20operations%2C%20classic%20interprocedural%20analyses%20cannot%20be%20used%20reliably%20for%20analyzing%20programs%20in%20which%20these%20operations%20cannot%20be%20discerned.%20A%20new%20notion%20of%20context-sensitivity%20is%20introduced%20that%20is%20based%20on%20the%20state%20of%20the%20stack%20at%20any%20instruction.%20While%20changes%20in%20%60calling%27-context%20are%20associated%20with%20transfer%20of%20control%2C%20and%20hence%20can%20be%20reasoned%20in%20terms%20of%20paths%20in%20an%20interprocedural%20control%20flow%20graph%20%28ICFG%29%2C%20the%20same%20is%20not%20true%20of%20changes%20in%20%27stack%27-context.%20An%20abstract%20interpretation%20based%20framework%20is%20developed%20to%20reason%20about%20stack-contexts%20and%20to%20derive%20analogues%20of%20call-strings%20based%20methods%20for%20the%20context-sensitive%20analysis%20using%20stack-context.%20The%20method%20presented%20is%20used%20to%20create%20a%20context-sensitive%20version%20of%20Venable%20et%20al.%27s%20algorithm%20for%20detecting%20obfuscated%20calls.%20Experimental%20results%20show%20that%20the%20context-sensitive%20version%20of%20the%20algorithm%20generates%20more%20precise%20results%20and%20is%20also%20computationally%20more%20efficient%20than%20its%20context-insensitive%20counterpart.%22%2C%22date%22%3A%222010%22%2C%22proceedingsTitle%22%3A%22Proceedings%20of%20the%202010%20ACM%20SIGPLAN%20Workshop%20on%20Partial%20Evaluation%20and%20Program%20Manipulation%22%2C%22conferenceName%22%3A%22%22%2C%22language%22%3A%22%22%2C%22DOI%22%3A%2210.1145%5C%2F1706356.1706381%22%2C%22ISBN%22%3A%22978-1-60558-727-1%22%2C%22url%22%3A%22http%3A%5C%2F%5C%2Fdoi.acm.org%5C%2F10.1145%5C%2F1706356.1706381%22%2C%22collections%22%3A%5B%22JUUEUA7U%22%2C%22CFD996TJ%22%5D%2C%22dateModified%22%3A%222014-01-06T20%3A47%3A01Z%22%7D%7D%2C%7B%22key%22%3A%22K8V8AQJ9%22%2C%22library%22%3A%7B%22id%22%3A136048%7D%2C%22meta%22%3A%7B%22creatorSummary%22%3A%22Lakhotia%20and%20Mohammed%22%2C%22parsedDate%22%3A%222004%22%2C%22numChildren%22%3A2%7D%2C%22bib%22%3A%22%3Cdiv%20class%3D%5C%22csl-bib-body%5C%22%20style%3D%5C%22line-height%3A%202%3B%20padding-left%3A%202em%3B%20text-indent%3A-2em%3B%5C%22%3E%5Cn%20%20%3Cdiv%20class%3D%5C%22csl-entry%5C%22%3ELakhotia%2C%20A.%2C%20%26amp%3B%20Mohammed%2C%20M.%20%282004%29.%20Imposing%20order%20on%20program%20statements%20to%20assist%20anti-virus%20scanners.%20In%20%3Ci%3E11th%20Working%20Conference%20on%20Reverse%20Engineering%2C%202004.%20Proceedings%3C%5C%2Fi%3E%20%28pp.%20161%26%23x2013%3B170%29.%20%3Ca%20href%3D%27https%3A%5C%2F%5C%2Fdoi.org%5C%2F10.1109%5C%2FWCRE.2004.24%27%3Ehttps%3A%5C%2F%5C%2Fdoi.org%5C%2F10.1109%5C%2FWCRE.2004.24%3C%5C%2Fa%3E%20%3Ca%20title%3D%27Cite%20in%20RIS%20Format%27%20class%3D%27zp-CiteRIS%27%20href%3D%27http%3A%5C%2F%5C%2Fulsrl.org%5C%2Fwp-content%5C%2Fplugins%5C%2Fzotpress%5C%2Flib%5C%2Frequest%5C%2Frequest.cite.php%3Fapi_user_id%3D136048%26amp%3Bitem_key%3DK8V8AQJ9%27%3ECite%3C%5C%2Fa%3E%20%20%3Ca%20title%3D%27Download%27%20class%3D%27zp-DownloadURL%27%20href%3D%27http%3A%5C%2F%5C%2Fulsrl.org%5C%2Fwp-content%5C%2Fplugins%5C%2Fzotpress%5C%2Flib%5C%2Frequest%5C%2Frequest.dl.php%3Fapi_user_id%3D136048%26amp%3Bdlkey%3DSVE2N3M3%26amp%3Bcontent_type%3Dapplication%5C%2Fpdf%27%3EDownload%3C%5C%2Fa%3E%3C%5C%2Fdiv%3E%5Cn%3C%5C%2Fdiv%3E%22%2C%22data%22%3A%7B%22itemType%22%3A%22conferencePaper%22%2C%22title%22%3A%22Imposing%20order%20on%20program%20statements%20to%20assist%20anti-virus%20scanners%22%2C%22creators%22%3A%5B%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22A.%22%2C%22lastName%22%3A%22Lakhotia%22%7D%2C%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22M.%22%2C%22lastName%22%3A%22Mohammed%22%7D%5D%2C%22abstractNote%22%3A%22A%20metamorphic%20virus%20applies%20semantics%20preserving%20transformations%20on%20itself%20to%20create%20a%20different%20variant%20before%20propagation.%20Metamorphic%20computer%20viruses%20thwart%20current%20anti-virus%20technologies%20that%20use%20signatures%20-%20a%20fixed%20sequence%20of%20bytes%20from%20a%20sample%20of%20a%20virus%20-%20since%20two%20variants%20of%20a%20metamorphic%20virus%20may%20not%20share%20the%20same%20signature.%20A%20method%20to%20impose%20an%20order%20on%20the%20statements%20and%20components%20of%20expressions%20of%20a%20program%20is%20presented.%20The%20method%2C%20called%20a%20%5C%22zeroing%20transformation%2C%5C%22%20reduces%20the%20number%20of%20possible%20variants%20of%20a%20program%20created%20by%20reordering%20statement%2C%20reshaping%20expression%2C%20and%20renaming%20variable.%20On%20a%20collection%20of%20C%20program%20used%20for%20evaluation%2C%20the%20zeroing%20transformation%20reduced%20the%20space%20of%20program%20variants%20due%20to%20statement%20reordering%20from%2010183%20to%201020.%20Further%20reduction%20can%20be%20expected%20by%20undoing%20other%20transformations.%20Anti-virus%20technologies%20may%20be%20improved%20by%20extracting%20signatures%20from%20zero%20form%20of%20a%20virus%2C%20and%20not%20the%20original%20version.%22%2C%22date%22%3A%222004%22%2C%22proceedingsTitle%22%3A%2211th%20Working%20Conference%20on%20Reverse%20Engineering%2C%202004.%20Proceedings%22%2C%22conferenceName%22%3A%2211th%20Working%20Conference%20on%20Reverse%20Engineering%2C%202004.%20Proceedings%22%2C%22language%22%3A%22%22%2C%22DOI%22%3A%2210.1109%5C%2FWCRE.2004.24%22%2C%22ISBN%22%3A%22%22%2C%22url%22%3A%22%22%2C%22collections%22%3A%5B%22JUUEUA7U%22%2C%22APED9CV8%22%5D%2C%22dateModified%22%3A%222014-01-06T20%3A46%3A41Z%22%7D%7D%2C%7B%22key%22%3A%22B7U7EAI8%22%2C%22library%22%3A%7B%22id%22%3A136048%7D%2C%22meta%22%3A%7B%22creatorSummary%22%3A%22Lakhotia%20et%20al.%22%2C%22parsedDate%22%3A%222004%22%2C%22numChildren%22%3A1%7D%2C%22bib%22%3A%22%3Cdiv%20class%3D%5C%22csl-bib-body%5C%22%20style%3D%5C%22line-height%3A%202%3B%20padding-left%3A%202em%3B%20text-indent%3A-2em%3B%5C%22%3E%5Cn%20%20%3Cdiv%20class%3D%5C%22csl-entry%5C%22%3ELakhotia%2C%20A.%2C%20Kapoor%2C%20A.%2C%20%26amp%3B%20Kumar%2C%20E.%20U.%20%282004%29.%20Are%20metamorphic%20viruses%20really%20invincible.%20%3Ci%3EVirus%20Bulletin%3C%5C%2Fi%3E%2C%205%26%23x2013%3B7.%20Retrieved%20from%20%3Ca%20href%3D%27http%3A%5C%2F%5C%2Fwww.iscas2007.org%5C%2F~arun%5C%2Fpapers%5C%2Finvincible-complete.pdf%27%3Ehttp%3A%5C%2F%5C%2Fwww.iscas2007.org%5C%2F~arun%5C%2Fpapers%5C%2Finvincible-complete.pdf%3C%5C%2Fa%3E%20%3Ca%20title%3D%27Cite%20in%20RIS%20Format%27%20class%3D%27zp-CiteRIS%27%20href%3D%27http%3A%5C%2F%5C%2Fulsrl.org%5C%2Fwp-content%5C%2Fplugins%5C%2Fzotpress%5C%2Flib%5C%2Frequest%5C%2Frequest.cite.php%3Fapi_user_id%3D136048%26amp%3Bitem_key%3DB7U7EAI8%27%3ECite%3C%5C%2Fa%3E%20%20%3Ca%20title%3D%27Download%27%20class%3D%27zp-DownloadURL%27%20href%3D%27http%3A%5C%2F%5C%2Fulsrl.org%5C%2Fwp-content%5C%2Fplugins%5C%2Fzotpress%5C%2Flib%5C%2Frequest%5C%2Frequest.dl.php%3Fapi_user_id%3D136048%26amp%3Bdlkey%3DDD55RQKG%26amp%3Bcontent_type%3Dapplication%5C%2Fpdf%27%3EDownload%3C%5C%2Fa%3E%3C%5C%2Fdiv%3E%5Cn%3C%5C%2Fdiv%3E%22%2C%22data%22%3A%7B%22itemType%22%3A%22journalArticle%22%2C%22title%22%3A%22Are%20metamorphic%20viruses%20really%20invincible%22%2C%22creators%22%3A%5B%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22Arun%22%2C%22lastName%22%3A%22Lakhotia%22%7D%2C%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22Aditya%22%2C%22lastName%22%3A%22Kapoor%22%7D%2C%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22E.%20U.%22%2C%22lastName%22%3A%22Kumar%22%7D%5D%2C%22abstractNote%22%3A%22%22%2C%22date%22%3A%222004%22%2C%22language%22%3A%22%22%2C%22DOI%22%3A%22%22%2C%22ISSN%22%3A%22%22%2C%22url%22%3A%22http%3A%5C%2F%5C%2Fwww.iscas2007.org%5C%2F~arun%5C%2Fpapers%5C%2Finvincible-complete.pdf%22%2C%22collections%22%3A%5B%22JUUEUA7U%22%2C%22APED9CV8%22%5D%2C%22dateModified%22%3A%222014-01-06T20%3A46%3A26Z%22%7D%7D%2C%7B%22key%22%3A%223ZD2G6JF%22%2C%22library%22%3A%7B%22id%22%3A136048%7D%2C%22meta%22%3A%7B%22creatorSummary%22%3A%22Venable%20et%20al.%22%2C%22parsedDate%22%3A%222005-01-01%22%2C%22numChildren%22%3A2%7D%2C%22bib%22%3A%22%3Cdiv%20class%3D%5C%22csl-bib-body%5C%22%20style%3D%5C%22line-height%3A%202%3B%20padding-left%3A%202em%3B%20text-indent%3A-2em%3B%5C%22%3E%5Cn%20%20%3Cdiv%20class%3D%5C%22csl-entry%5C%22%3EVenable%2C%20M.%2C%20Chouchane%2C%20M.%20R.%2C%20Karim%2C%20M.%20E.%2C%20%26amp%3B%20Lakhotia%2C%20A.%20%282005%29.%20Analyzing%20Memory%20Accesses%20in%20Obfuscated%20x86%20Executables.%20In%20K.%20Julisch%20%26amp%3B%20C.%20Kruegel%20%28Eds.%29%2C%20%3Ci%3EDetection%20of%20Intrusions%20and%20Malware%2C%20and%20Vulnerability%20Assessment%3C%5C%2Fi%3E%20%28pp.%201%26%23x2013%3B18%29.%20Springer%20Berlin%20Heidelberg.%20Retrieved%20from%20%3Ca%20href%3D%27http%3A%5C%2F%5C%2Flink.springer.com%5C%2Fchapter%5C%2F10.1007%5C%2F11506881_1%27%3Ehttp%3A%5C%2F%5C%2Flink.springer.com%5C%2Fchapter%5C%2F10.1007%5C%2F11506881_1%3C%5C%2Fa%3E%20%3Ca%20title%3D%27Cite%20in%20RIS%20Format%27%20class%3D%27zp-CiteRIS%27%20href%3D%27http%3A%5C%2F%5C%2Fulsrl.org%5C%2Fwp-content%5C%2Fplugins%5C%2Fzotpress%5C%2Flib%5C%2Frequest%5C%2Frequest.cite.php%3Fapi_user_id%3D136048%26amp%3Bitem_key%3D3ZD2G6JF%27%3ECite%3C%5C%2Fa%3E%20%20%3Ca%20title%3D%27Download%27%20class%3D%27zp-DownloadURL%27%20href%3D%27http%3A%5C%2F%5C%2Fulsrl.org%5C%2Fwp-content%5C%2Fplugins%5C%2Fzotpress%5C%2Flib%5C%2Frequest%5C%2Frequest.dl.php%3Fapi_user_id%3D136048%26amp%3Bdlkey%3DGETT6DF4%26amp%3Bcontent_type%3Dapplication%5C%2Fpdf%27%3EDownload%3C%5C%2Fa%3E%3C%5C%2Fdiv%3E%5Cn%3C%5C%2Fdiv%3E%22%2C%22data%22%3A%7B%22itemType%22%3A%22bookSection%22%2C%22title%22%3A%22Analyzing%20Memory%20Accesses%20in%20Obfuscated%20x86%20Executables%22%2C%22creators%22%3A%5B%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22Michael%22%2C%22lastName%22%3A%22Venable%22%7D%2C%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22Mohamed%20R.%22%2C%22lastName%22%3A%22Chouchane%22%7D%2C%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22Md%20Enamul%22%2C%22lastName%22%3A%22Karim%22%7D%2C%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22Arun%22%2C%22lastName%22%3A%22Lakhotia%22%7D%2C%7B%22creatorType%22%3A%22editor%22%2C%22firstName%22%3A%22Klaus%22%2C%22lastName%22%3A%22Julisch%22%7D%2C%7B%22creatorType%22%3A%22editor%22%2C%22firstName%22%3A%22Christopher%22%2C%22lastName%22%3A%22Kruegel%22%7D%5D%2C%22abstractNote%22%3A%22Programmers%20obfuscate%20their%20code%20to%20defeat%20manual%20or%20automated%20analysis.%20Obfuscations%20are%20often%20used%20to%20hide%20malicious%20behavior.%20In%20particular%2C%20malicious%20programs%20employ%20obfuscations%20of%20stack-based%20instructions%2C%20such%20as%20call%20and%20return%20instructions%2C%20to%20prevent%20an%20analyzer%20from%20determining%20which%20system%20functions%20it%20calls.%20Instead%20of%20using%20these%20instructions%20directly%2C%20a%20combination%20of%20other%20instructions%2C%20such%20as%20PUSH%20and%20POP%2C%20are%20used%20to%20achieve%20the%20same%20semantics.%20This%20paper%20presents%20an%20abstract%20interpretation%20based%20analysis%20to%20detect%20obfuscation%20of%20stack%20instructions.%20The%20approach%20combines%20Reps%20and%20Balakrishnan%5Cu2019s%20value%20set%20analysis%20%28VSA%29%20and%20Lakhotia%20and%20Kumar%5Cu2019s%20Abstract%20Stack%20Graph%2C%20to%20create%20an%20analyzer%20that%20can%20track%20stack%20manipulations%20where%20the%20stack%20pointer%20may%20be%20saved%20and%20restored%20in%20memory%20or%20registers.%20The%20analysis%20technique%20may%20be%20used%20to%20determine%20obfuscated%20calls%20made%20by%20a%20program%2C%20an%20important%20first%20step%20in%20detecting%20malicious%20behavior.%22%2C%22bookTitle%22%3A%22Detection%20of%20Intrusions%20and%20Malware%2C%20and%20Vulnerability%20Assessment%22%2C%22date%22%3A%222005%5C%2F01%5C%2F01%22%2C%22language%22%3A%22%22%2C%22ISBN%22%3A%22978-3-540-26613-6%2C%20978-3-540-31645-9%22%2C%22url%22%3A%22http%3A%5C%2F%5C%2Flink.springer.com%5C%2Fchapter%5C%2F10.1007%5C%2F11506881_1%22%2C%22collections%22%3A%5B%22JUUEUA7U%22%2C%22CFD996TJ%22%5D%2C%22dateModified%22%3A%222014-01-06T20%3A45%3A26Z%22%7D%7D%2C%7B%22key%22%3A%222BXV8232%22%2C%22library%22%3A%7B%22id%22%3A136048%7D%2C%22meta%22%3A%7B%22creatorSummary%22%3A%22Lakhotia%20and%20Kumar%22%2C%22parsedDate%22%3A%222004%22%2C%22numChildren%22%3A2%7D%2C%22bib%22%3A%22%3Cdiv%20class%3D%5C%22csl-bib-body%5C%22%20style%3D%5C%22line-height%3A%202%3B%20padding-left%3A%202em%3B%20text-indent%3A-2em%3B%5C%22%3E%5Cn%20%20%3Cdiv%20class%3D%5C%22csl-entry%5C%22%3ELakhotia%2C%20A.%2C%20%26amp%3B%20Kumar%2C%20E.%20U.%20%282004%29.%20Abstracting%20stack%20to%20detect%20obfuscated%20calls%20in%20binaries.%20In%20%3Ci%3EFourth%20IEEE%20International%20Workshop%20on%20Source%20Code%20Analysis%20and%20Manipulation%2C%202004%3C%5C%2Fi%3E%20%28pp.%2017%26%23x2013%3B26%29.%20%3Ca%20href%3D%27https%3A%5C%2F%5C%2Fdoi.org%5C%2F10.1109%5C%2FSCAM.2004.2%27%3Ehttps%3A%5C%2F%5C%2Fdoi.org%5C%2F10.1109%5C%2FSCAM.2004.2%3C%5C%2Fa%3E%20%3Ca%20title%3D%27Cite%20in%20RIS%20Format%27%20class%3D%27zp-CiteRIS%27%20href%3D%27http%3A%5C%2F%5C%2Fulsrl.org%5C%2Fwp-content%5C%2Fplugins%5C%2Fzotpress%5C%2Flib%5C%2Frequest%5C%2Frequest.cite.php%3Fapi_user_id%3D136048%26amp%3Bitem_key%3D2BXV8232%27%3ECite%3C%5C%2Fa%3E%20%20%3Ca%20title%3D%27Download%27%20class%3D%27zp-DownloadURL%27%20href%3D%27http%3A%5C%2F%5C%2Fulsrl.org%5C%2Fwp-content%5C%2Fplugins%5C%2Fzotpress%5C%2Flib%5C%2Frequest%5C%2Frequest.dl.php%3Fapi_user_id%3D136048%26amp%3Bdlkey%3DSE64VNPV%26amp%3Bcontent_type%3Dapplication%5C%2Fpdf%27%3EDownload%3C%5C%2Fa%3E%3C%5C%2Fdiv%3E%5Cn%3C%5C%2Fdiv%3E%22%2C%22data%22%3A%7B%22itemType%22%3A%22conferencePaper%22%2C%22title%22%3A%22Abstracting%20stack%20to%20detect%20obfuscated%20calls%20in%20binaries%22%2C%22creators%22%3A%5B%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22A.%22%2C%22lastName%22%3A%22Lakhotia%22%7D%2C%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22Eric%20Uday%22%2C%22lastName%22%3A%22Kumar%22%7D%5D%2C%22abstractNote%22%3A%22Information%20about%20calls%20to%20the%20operating%20system%20%28or%20kernel%20libraries%29%20made%20by%20a%20binary%20executable%20may%20be%20used%20to%20determine%20whether%20the%20binary%20is%20malicious.%20Being%20aware%20of%20this%20approach%2C%20malicious%20programmers%20hide%20this%20information%20by%20making%20such%20calls%20without%20using%20the%20call%20instruction.%20For%20instance%2C%20the%20%60call%20addr%27%20instruction%20may%20be%20replaced%20by%20two%20push%20instructions%20and%20a%20return%20instruction%2C%20the%20first%20push%20pushes%20the%20address%20of%20the%20instruction%20after%20the%20return%20instruction%2C%20and%20the%20second%20push%20pushes%20the%20address%20addr.%20The%20code%20may%20be%20further%20obfuscated%20by%20spreading%20the%20three%20instructions%20and%20by%20splitting%20each%20instruction%20into%20multiple%20instructions.%20This%20paper%20presents%20a%20method%20to%20statically%20detect%20obfuscated%20calls%20in%20binary%20code.%20The%20notion%20of%20abstract%20stack%20is%20introduced%20to%20associate%20each%20element%20in%20the%20stack%20to%20the%20instruction%20that%20pushes%20the%20element.%20An%20abstract%20stack%20graph%20is%20a%20concise%20representation%20of%20all%20abstract%20stacks%20at%20every%20point%20in%20the%20program.%20An%20abstract%20stack%20graph%2C%20created%20by%20abstract%20interpretation%20of%20the%20binary%20executables%2C%20may%20be%20used%20to%20detect%20obfuscated%20calls%20and%20other%20stack%20related%20obfuscations%22%2C%22date%22%3A%222004%22%2C%22proceedingsTitle%22%3A%22Fourth%20IEEE%20International%20Workshop%20on%20Source%20Code%20Analysis%20and%20Manipulation%2C%202004%22%2C%22conferenceName%22%3A%22Fourth%20IEEE%20International%20Workshop%20on%20Source%20Code%20Analysis%20and%20Manipulation%2C%202004%22%2C%22language%22%3A%22%22%2C%22DOI%22%3A%2210.1109%5C%2FSCAM.2004.2%22%2C%22ISBN%22%3A%22%22%2C%22url%22%3A%22%22%2C%22collections%22%3A%5B%22JUUEUA7U%22%2C%22CFD996TJ%22%5D%2C%22dateModified%22%3A%222014-01-06T20%3A45%3A10Z%22%7D%7D%2C%7B%22key%22%3A%22JUIGPXWK%22%2C%22library%22%3A%7B%22id%22%3A136048%7D%2C%22meta%22%3A%7B%22creatorSummary%22%3A%22Lakhotia%20and%20Walenstein%22%2C%22numChildren%22%3A1%7D%2C%22bib%22%3A%22%3Cdiv%20class%3D%5C%22csl-bib-body%5C%22%20style%3D%5C%22line-height%3A%202%3B%20padding-left%3A%202em%3B%20text-indent%3A-2em%3B%5C%22%3E%5Cn%20%20%3Cdiv%20class%3D%5C%22csl-entry%5C%22%3ELakhotia%2C%20A.%2C%20%26amp%3B%20Walenstein%2C%20A.%20%28n.d.%29.%20A%20Self-Learning%20AV%20Scanner.%20Retrieved%20from%20%3Ca%20href%3D%27http%3A%5C%2F%5C%2Fweb.cacs.louisiana.edu%5C%2F~arun%5C%2Fpapers%5C%2F2008-avar-self-learning.pdf%27%3Ehttp%3A%5C%2F%5C%2Fweb.cacs.louisiana.edu%5C%2F~arun%5C%2Fpapers%5C%2F2008-avar-self-learning.pdf%3C%5C%2Fa%3E%20%3Ca%20title%3D%27Cite%20in%20RIS%20Format%27%20class%3D%27zp-CiteRIS%27%20href%3D%27http%3A%5C%2F%5C%2Fulsrl.org%5C%2Fwp-content%5C%2Fplugins%5C%2Fzotpress%5C%2Flib%5C%2Frequest%5C%2Frequest.cite.php%3Fapi_user_id%3D136048%26amp%3Bitem_key%3DJUIGPXWK%27%3ECite%3C%5C%2Fa%3E%20%20%3Ca%20title%3D%27Download%27%20class%3D%27zp-DownloadURL%27%20href%3D%27http%3A%5C%2F%5C%2Fulsrl.org%5C%2Fwp-content%5C%2Fplugins%5C%2Fzotpress%5C%2Flib%5C%2Frequest%5C%2Frequest.dl.php%3Fapi_user_id%3D136048%26amp%3Bdlkey%3D7TMJ8QXN%26amp%3Bcontent_type%3Dapplication%5C%2Fpdf%27%3EDownload%3C%5C%2Fa%3E%3C%5C%2Fdiv%3E%5Cn%3C%5C%2Fdiv%3E%22%2C%22data%22%3A%7B%22itemType%22%3A%22journalArticle%22%2C%22title%22%3A%22A%20Self-Learning%20AV%20Scanner%22%2C%22creators%22%3A%5B%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22Arun%22%2C%22lastName%22%3A%22Lakhotia%22%7D%2C%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22Andrew%22%2C%22lastName%22%3A%22Walenstein%22%7D%5D%2C%22abstractNote%22%3A%22%22%2C%22date%22%3A%22%22%2C%22language%22%3A%22%22%2C%22DOI%22%3A%22%22%2C%22ISSN%22%3A%22%22%2C%22url%22%3A%22http%3A%5C%2F%5C%2Fweb.cacs.louisiana.edu%5C%2F~arun%5C%2Fpapers%5C%2F2008-avar-self-learning.pdf%22%2C%22collections%22%3A%5B%22JUUEUA7U%22%2C%22JIJ3KRFV%22%5D%2C%22dateModified%22%3A%222014-01-06T20%3A42%3A59Z%22%7D%7D%2C%7B%22key%22%3A%229WK5XDAI%22%2C%22library%22%3A%7B%22id%22%3A136048%7D%2C%22meta%22%3A%7B%22creatorSummary%22%3A%22Singh%20et%20al.%22%2C%22parsedDate%22%3A%222012%22%2C%22numChildren%22%3A1%7D%2C%22bib%22%3A%22%3Cdiv%20class%3D%5C%22csl-bib-body%5C%22%20style%3D%5C%22line-height%3A%202%3B%20padding-left%3A%202em%3B%20text-indent%3A-2em%3B%5C%22%3E%5Cn%20%20%3Cdiv%20class%3D%5C%22csl-entry%5C%22%3ESingh%2C%20A.%2C%20Walenstein%2C%20A.%2C%20%26amp%3B%20Lakhotia%2C%20A.%20%282012%29.%20Tracking%20Concept%20Drift%20in%20Malware%20Families.%20In%20%3Ci%3EProceedings%20of%20the%205th%20ACM%20Workshop%20on%20Security%20and%20Artificial%20Intelligence%3C%5C%2Fi%3E%20%28pp.%2081%26%23x2013%3B92%29.%20New%20York%2C%20NY%2C%20USA%3A%20ACM.%20%3Ca%20href%3D%27https%3A%5C%2F%5C%2Fdoi.org%5C%2F10.1145%5C%2F2381896.2381910%27%3Ehttps%3A%5C%2F%5C%2Fdoi.org%5C%2F10.1145%5C%2F2381896.2381910%3C%5C%2Fa%3E%20%3Ca%20title%3D%27Cite%20in%20RIS%20Format%27%20class%3D%27zp-CiteRIS%27%20href%3D%27http%3A%5C%2F%5C%2Fulsrl.org%5C%2Fwp-content%5C%2Fplugins%5C%2Fzotpress%5C%2Flib%5C%2Frequest%5C%2Frequest.cite.php%3Fapi_user_id%3D136048%26amp%3Bitem_key%3D9WK5XDAI%27%3ECite%3C%5C%2Fa%3E%20%20%3Ca%20title%3D%27Download%27%20class%3D%27zp-DownloadURL%27%20href%3D%27http%3A%5C%2F%5C%2Fulsrl.org%5C%2Fwp-content%5C%2Fplugins%5C%2Fzotpress%5C%2Flib%5C%2Frequest%5C%2Frequest.dl.php%3Fapi_user_id%3D136048%26amp%3Bdlkey%3DPT3PNFPA%26amp%3Bcontent_type%3Dapplication%5C%2Fpdf%27%3EDownload%3C%5C%2Fa%3E%3C%5C%2Fdiv%3E%5Cn%3C%5C%2Fdiv%3E%22%2C%22data%22%3A%7B%22itemType%22%3A%22conferencePaper%22%2C%22title%22%3A%22Tracking%20Concept%20Drift%20in%20Malware%20Families%22%2C%22creators%22%3A%5B%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22Anshuman%22%2C%22lastName%22%3A%22Singh%22%7D%2C%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22Andrew%22%2C%22lastName%22%3A%22Walenstein%22%7D%2C%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22Arun%22%2C%22lastName%22%3A%22Lakhotia%22%7D%5D%2C%22abstractNote%22%3A%22The%20previous%20efforts%20in%20the%20use%20of%20machine%20learning%20for%20malware%20detection%20have%20assumed%20that%20malware%20population%20is%20stationary%20i.e.%20probability%20distribution%20of%20the%20observed%20characteristics%20%28features%29%20of%20malware%20populations%20don%27t%20change%20over%20time.%20In%20this%20paper%2C%20we%20investigate%20this%20assumption%20for%20malware%20families%20as%20populations.%20Malware%2C%20by%20design%2C%20constantly%20evolves%20so%20as%20to%20defeat%20detection.%20Evolution%20in%20malware%20may%20lead%20to%20a%20nonstationary%20malware%20population.%20The%20problem%20of%20nonstationary%20populations%20has%20been%20called%20concept%20drift%20in%20machine%20learning.%20Tracking%20concept%20drift%20is%20critical%20to%20the%20successful%20application%20of%20ML%20based%20methods%20for%20malware%20detection.%20If%20the%20evolution%20causes%20the%20malware%20population%20to%20drift%20rapidly%20then%20frequent%20retraining%20of%20classifiers%20may%20be%20required%20to%20prevent%20degradation%20in%20performance.%20On%20the%20other%20hand%2C%20if%20the%20drift%20is%20found%20to%20be%20negligible%2C%20then%20ML%20based%20methods%20are%20robust%20for%20such%20populations%20for%20long%20periods%20of%20time.%20We%20propose%20two%20measures%20for%20tracking%20concept%20drift%20in%20malware%20families%20when%20feature%20sets%20are%20very%20large-relative%20temporal%20similarity%20and%20metafeatures.%20We%20illustrate%20the%20use%20of%20the%20proposed%20measures%20with%20a%20study%20on%203500%2B%20samples%20from%20three%20families%20of%20x86%20malware%2C%20spanning%20over%205%20years.%20The%20results%20of%20the%20study%20show%20negligible%20drift%20in%20mnemonic%202-grams%20extracted%20from%20unpacked%20versions%20of%20the%20samples.%20The%20measures%20can%20likewise%20be%20applied%20to%20track%20drift%20in%20any%20number%20of%20malware%20families.%20Tracking%20drift%20in%20this%20manner%20also%20provides%20a%20novel%20method%20for%20feature%20type%20selection%2C%20i.e.%2C%20use%20the%20feature%20type%20that%20drifts%20the%20least.%22%2C%22date%22%3A%222012%22%2C%22proceedingsTitle%22%3A%22Proceedings%20of%20the%205th%20ACM%20Workshop%20on%20Security%20and%20Artificial%20Intelligence%22%2C%22conferenceName%22%3A%22%22%2C%22language%22%3A%22%22%2C%22DOI%22%3A%2210.1145%5C%2F2381896.2381910%22%2C%22ISBN%22%3A%22978-1-4503-1664-4%22%2C%22url%22%3A%22http%3A%5C%2F%5C%2Fdoi.acm.org%5C%2F10.1145%5C%2F2381896.2381910%22%2C%22collections%22%3A%5B%22JUUEUA7U%22%5D%2C%22dateModified%22%3A%222014-01-06T20%3A42%3A28Z%22%7D%7D%2C%7B%22key%22%3A%2299BCW8TX%22%2C%22library%22%3A%7B%22id%22%3A136048%7D%2C%22meta%22%3A%7B%22creatorSummary%22%3A%22Walenstein%20and%20Lakhotia%22%2C%22parsedDate%22%3A%222007%22%2C%22numChildren%22%3A1%7D%2C%22bib%22%3A%22%3Cdiv%20class%3D%5C%22csl-bib-body%5C%22%20style%3D%5C%22line-height%3A%202%3B%20padding-left%3A%202em%3B%20text-indent%3A-2em%3B%5C%22%3E%5Cn%20%20%3Cdiv%20class%3D%5C%22csl-entry%5C%22%3EWalenstein%2C%20A.%2C%20%26amp%3B%20Lakhotia%2C%20A.%20%282007%29.%20%3Ci%3EThe%20software%20similarity%20problem%20in%20malware%20analysis%3C%5C%2Fi%3E.%20Internat.%20Begegnungs-und%20Forschungszentrum%20f%26%23xFC%3Br%20Informatik.%20Retrieved%20from%20%3Ca%20href%3D%27http%3A%5C%2F%5C%2Fdrops.dagstuhl.de%5C%2Fopus%5C%2Fvolltexte%5C%2F2007%5C%2F964%5C%2F%27%3Ehttp%3A%5C%2F%5C%2Fdrops.dagstuhl.de%5C%2Fopus%5C%2Fvolltexte%5C%2F2007%5C%2F964%5C%2F%3C%5C%2Fa%3E%20%3Ca%20title%3D%27Cite%20in%20RIS%20Format%27%20class%3D%27zp-CiteRIS%27%20href%3D%27http%3A%5C%2F%5C%2Fulsrl.org%5C%2Fwp-content%5C%2Fplugins%5C%2Fzotpress%5C%2Flib%5C%2Frequest%5C%2Frequest.cite.php%3Fapi_user_id%3D136048%26amp%3Bitem_key%3D99BCW8TX%27%3ECite%3C%5C%2Fa%3E%20%20%3Ca%20title%3D%27Download%27%20class%3D%27zp-DownloadURL%27%20href%3D%27http%3A%5C%2F%5C%2Fulsrl.org%5C%2Fwp-content%5C%2Fplugins%5C%2Fzotpress%5C%2Flib%5C%2Frequest%5C%2Frequest.dl.php%3Fapi_user_id%3D136048%26amp%3Bdlkey%3DTW5PP3XW%26amp%3Bcontent_type%3Dapplication%5C%2Fpdf%27%3EDownload%3C%5C%2Fa%3E%3C%5C%2Fdiv%3E%5Cn%3C%5C%2Fdiv%3E%22%2C%22data%22%3A%7B%22itemType%22%3A%22book%22%2C%22title%22%3A%22The%20software%20similarity%20problem%20in%20malware%20analysis%22%2C%22creators%22%3A%5B%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22Andrew%22%2C%22lastName%22%3A%22Walenstein%22%7D%2C%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22Arun%22%2C%22lastName%22%3A%22Lakhotia%22%7D%5D%2C%22abstractNote%22%3A%22%22%2C%22date%22%3A%222007%22%2C%22language%22%3A%22%22%2C%22ISBN%22%3A%22%22%2C%22url%22%3A%22http%3A%5C%2F%5C%2Fdrops.dagstuhl.de%5C%2Fopus%5C%2Fvolltexte%5C%2F2007%5C%2F964%5C%2F%22%2C%22collections%22%3A%5B%22JUUEUA7U%22%5D%2C%22dateModified%22%3A%222014-01-06T20%3A42%3A06Z%22%7D%7D%2C%7B%22key%22%3A%22M5A3GJPJ%22%2C%22library%22%3A%7B%22id%22%3A136048%7D%2C%22meta%22%3A%7B%22creatorSummary%22%3A%22Lakhotia%22%2C%22parsedDate%22%3A%222006%22%2C%22numChildren%22%3A1%7D%2C%22bib%22%3A%22%3Cdiv%20class%3D%5C%22csl-bib-body%5C%22%20style%3D%5C%22line-height%3A%202%3B%20padding-left%3A%202em%3B%20text-indent%3A-2em%3B%5C%22%3E%5Cn%20%20%3Cdiv%20class%3D%5C%22csl-entry%5C%22%3ELakhotia%2C%20A.%20%282006%29.%20Analysis%20of%20Adversarial%20Code%3A%20Problem%2C%20Challenges%2C%20Results.%20%3Ci%3EBlackhat%20Federal%202006%3C%5C%2Fi%3E.%20%3Ca%20title%3D%27Cite%20in%20RIS%20Format%27%20class%3D%27zp-CiteRIS%27%20href%3D%27http%3A%5C%2F%5C%2Fulsrl.org%5C%2Fwp-content%5C%2Fplugins%5C%2Fzotpress%5C%2Flib%5C%2Frequest%5C%2Frequest.cite.php%3Fapi_user_id%3D136048%26amp%3Bitem_key%3DM5A3GJPJ%27%3ECite%3C%5C%2Fa%3E%20%20%3Ca%20title%3D%27Download%27%20class%3D%27zp-DownloadURL%27%20href%3D%27http%3A%5C%2F%5C%2Fulsrl.org%5C%2Fwp-content%5C%2Fplugins%5C%2Fzotpress%5C%2Flib%5C%2Frequest%5C%2Frequest.dl.php%3Fapi_user_id%3D136048%26amp%3Bdlkey%3DXBJ9XP92%26amp%3Bcontent_type%3Dapplication%5C%2Fpdf%27%3EDownload%3C%5C%2Fa%3E%3C%5C%2Fdiv%3E%5Cn%3C%5C%2Fdiv%3E%22%2C%22data%22%3A%7B%22itemType%22%3A%22journalArticle%22%2C%22title%22%3A%22Analysis%20of%20Adversarial%20Code%3A%20Problem%2C%20Challenges%2C%20Results%22%2C%22creators%22%3A%5B%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22Arun%22%2C%22lastName%22%3A%22Lakhotia%22%7D%5D%2C%22abstractNote%22%3A%22%22%2C%22date%22%3A%222006%22%2C%22language%22%3A%22%22%2C%22DOI%22%3A%22%22%2C%22ISSN%22%3A%22%22%2C%22url%22%3A%22%22%2C%22collections%22%3A%5B%22JUUEUA7U%22%5D%2C%22dateModified%22%3A%222014-01-06T20%3A41%3A07Z%22%7D%7D%2C%7B%22key%22%3A%226GB585BP%22%2C%22library%22%3A%7B%22id%22%3A136048%7D%2C%22meta%22%3A%7B%22creatorSummary%22%3A%22Chouchane%20and%20Lakhotia%22%2C%22parsedDate%22%3A%222006%22%2C%22numChildren%22%3A1%7D%2C%22bib%22%3A%22%3Cdiv%20class%3D%5C%22csl-bib-body%5C%22%20style%3D%5C%22line-height%3A%202%3B%20padding-left%3A%202em%3B%20text-indent%3A-2em%3B%5C%22%3E%5Cn%20%20%3Cdiv%20class%3D%5C%22csl-entry%5C%22%3EChouchane%2C%20M.%20R.%2C%20%26amp%3B%20Lakhotia%2C%20A.%20%282006%29.%20Using%20Engine%20Signature%20to%20Detect%20Metamorphic%20Malware.%20In%20%3Ci%3EProceedings%20of%20the%204th%20ACM%20Workshop%20on%20Recurring%20Malcode%3C%5C%2Fi%3E%20%28pp.%2073%26%23x2013%3B78%29.%20New%20York%2C%20NY%2C%20USA%3A%20ACM.%20%3Ca%20href%3D%27https%3A%5C%2F%5C%2Fdoi.org%5C%2F10.1145%5C%2F1179542.1179558%27%3Ehttps%3A%5C%2F%5C%2Fdoi.org%5C%2F10.1145%5C%2F1179542.1179558%3C%5C%2Fa%3E%20%3Ca%20title%3D%27Cite%20in%20RIS%20Format%27%20class%3D%27zp-CiteRIS%27%20href%3D%27http%3A%5C%2F%5C%2Fulsrl.org%5C%2Fwp-content%5C%2Fplugins%5C%2Fzotpress%5C%2Flib%5C%2Frequest%5C%2Frequest.cite.php%3Fapi_user_id%3D136048%26amp%3Bitem_key%3D6GB585BP%27%3ECite%3C%5C%2Fa%3E%20%20%3Ca%20title%3D%27Download%27%20class%3D%27zp-DownloadURL%27%20href%3D%27http%3A%5C%2F%5C%2Fulsrl.org%5C%2Fwp-content%5C%2Fplugins%5C%2Fzotpress%5C%2Flib%5C%2Frequest%5C%2Frequest.dl.php%3Fapi_user_id%3D136048%26amp%3Bdlkey%3DHAA5KAUC%26amp%3Bcontent_type%3Dapplication%5C%2Fpdf%27%3EDownload%3C%5C%2Fa%3E%3C%5C%2Fdiv%3E%5Cn%3C%5C%2Fdiv%3E%22%2C%22data%22%3A%7B%22itemType%22%3A%22conferencePaper%22%2C%22title%22%3A%22Using%20Engine%20Signature%20to%20Detect%20Metamorphic%20Malware%22%2C%22creators%22%3A%5B%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22Mohamed%20R.%22%2C%22lastName%22%3A%22Chouchane%22%7D%2C%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22Arun%22%2C%22lastName%22%3A%22Lakhotia%22%7D%5D%2C%22abstractNote%22%3A%22This%20paper%20introduces%20the%20%5C%22engine%20signature%5C%22%20approach%20to%20assist%20in%20detecting%20metamorphic%20malware%20by%20tracking%20it%20to%20its%20engine.%20More%20specifically%2C%20it%20presents%20and%20evaluates%20a%20code%20scoring%20technique%20for%20collecting%20forensic%20evidence%20from%20x86%20code%20segments%20in%20order%20to%20get%20some%20measure%20of%20how%20likely%20they%20are%20to%20have%20been%20generated%20by%20some%20known%20instruction-substituting%20metamorphic%20engine.%20A%20prototype%20simulator%20that%20mimics%20real%20instruction-substituting%20metamorphic%20engines%20was%20implemented%20and%20used%20to%20conduct%20several%20experiments%20that%20evaluate%20the%20goodness%20of%20the%20scoring%20technique%20for%20given%20engine%20parameters.%20The%20technique%20was%20also%20used%20to%20successfully%20help%20track%20variants%20of%20W32.Evol%20to%20their%20engine.%22%2C%22date%22%3A%222006%22%2C%22proceedingsTitle%22%3A%22Proceedings%20of%20the%204th%20ACM%20Workshop%20on%20Recurring%20Malcode%22%2C%22conferenceName%22%3A%22%22%2C%22language%22%3A%22%22%2C%22DOI%22%3A%2210.1145%5C%2F1179542.1179558%22%2C%22ISBN%22%3A%221-59593-551-7%22%2C%22url%22%3A%22http%3A%5C%2F%5C%2Fdoi.acm.org%5C%2F10.1145%5C%2F1179542.1179558%22%2C%22collections%22%3A%5B%22JUUEUA7U%22%2C%22APED9CV8%22%5D%2C%22dateModified%22%3A%222014-01-06T20%3A40%3A45Z%22%7D%7D%2C%7B%22key%22%3A%22IBA4FCKE%22%2C%22library%22%3A%7B%22id%22%3A136048%7D%2C%22meta%22%3A%7B%22creatorSummary%22%3A%22Lakhotia%20et%20al.%22%2C%22parsedDate%22%3A%222013%22%2C%22numChildren%22%3A1%7D%2C%22bib%22%3A%22%3Cdiv%20class%3D%5C%22csl-bib-body%5C%22%20style%3D%5C%22line-height%3A%202%3B%20padding-left%3A%202em%3B%20text-indent%3A-2em%3B%5C%22%3E%5Cn%20%20%3Cdiv%20class%3D%5C%22csl-entry%5C%22%3ELakhotia%2C%20A.%2C%20Preda%2C%20M.%20D.%2C%20%26amp%3B%20Giacobazzi%2C%20R.%20%282013%29.%20Fast%20Location%20of%20Similar%20Code%20Fragments%20Using%20Semantic%20%26%23x201C%3BJuice.%26%23x201D%3B%20In%20%3Ci%3EProceedings%20of%20the%202Nd%20ACM%20SIGPLAN%20Program%20Protection%20and%20Reverse%20Engineering%20Workshop%3C%5C%2Fi%3E%20%28pp.%205%3A1%26%23x2013%3B5%3A6%29.%20New%20York%2C%20NY%2C%20USA%3A%20ACM.%20%3Ca%20href%3D%27https%3A%5C%2F%5C%2Fdoi.org%5C%2F10.1145%5C%2F2430553.2430558%27%3Ehttps%3A%5C%2F%5C%2Fdoi.org%5C%2F10.1145%5C%2F2430553.2430558%3C%5C%2Fa%3E%20%3Ca%20title%3D%27Cite%20in%20RIS%20Format%27%20class%3D%27zp-CiteRIS%27%20href%3D%27http%3A%5C%2F%5C%2Fulsrl.org%5C%2Fwp-content%5C%2Fplugins%5C%2Fzotpress%5C%2Flib%5C%2Frequest%5C%2Frequest.cite.php%3Fapi_user_id%3D136048%26amp%3Bitem_key%3DIBA4FCKE%27%3ECite%3C%5C%2Fa%3E%20%20%3Ca%20title%3D%27Download%27%20class%3D%27zp-DownloadURL%27%20href%3D%27http%3A%5C%2F%5C%2Fulsrl.org%5C%2Fwp-content%5C%2Fplugins%5C%2Fzotpress%5C%2Flib%5C%2Frequest%5C%2Frequest.dl.php%3Fapi_user_id%3D136048%26amp%3Bdlkey%3DBTVZE5CV%26amp%3Bcontent_type%3Dapplication%5C%2Fpdf%27%3EDownload%3C%5C%2Fa%3E%3C%5C%2Fdiv%3E%5Cn%3C%5C%2Fdiv%3E%22%2C%22data%22%3A%7B%22itemType%22%3A%22conferencePaper%22%2C%22title%22%3A%22Fast%20Location%20of%20Similar%20Code%20Fragments%20Using%20Semantic%20%27Juice%27%22%2C%22creators%22%3A%5B%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22Arun%22%2C%22lastName%22%3A%22Lakhotia%22%7D%2C%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22Mila%20Dalla%22%2C%22lastName%22%3A%22Preda%22%7D%2C%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22Roberto%22%2C%22lastName%22%3A%22Giacobazzi%22%7D%5D%2C%22abstractNote%22%3A%22Abstraction%20of%20semantics%20of%20blocks%20of%20a%20binary%20is%20termed%20as%20%27juice.%27%20Whereas%20the%20denotational%20semantics%20summarizes%20the%20computation%20performed%20by%20a%20block%2C%20its%20juice%20presents%20a%20template%20of%20the%20relationships%20established%20by%20the%20block.%20BinJuice%20is%20a%20tool%20for%20extracting%20the%20%27juice%27%20of%20a%20binary.%20It%20symbolically%20interprets%20individual%20blocks%20of%20a%20binary%20to%20extract%20their%20semantics%3A%20the%20effect%20of%20the%20block%20on%20the%20program%20state.%20The%20semantics%20is%20generalized%20to%20juice%20by%20replacing%20register%20names%20and%20literal%20constants%20by%20typed%2C%20logical%20variables.%20The%20juice%20also%20maintains%20algebraic%20constraints%20between%20the%20numeric%20variables.%20Thus%2C%20this%20juice%20forms%20a%20semantic%20template%20that%20is%20expected%20to%20be%20identical%20regardless%20of%20code%20variations%20due%20to%20register%20renaming%2C%20memory%20address%20allocation%2C%20and%20constant%20replacement.%20The%20terms%20in%20juice%20can%20be%20canonically%20ordered%20using%20a%20linear%20order%20presented.%20Thus%20semantically%20equivalent%20%28rather%2C%20similar%29%20code%20fragments%20can%20be%20identified%20by%20simple%20structural%20comparison%20of%20their%20juice%2C%20or%20by%20comparing%20their%20hashes.%20While%20BinJuice%20cannot%20find%20all%20equivalent%20constructs%2C%20for%20that%20would%20solve%20the%20Halting%20Problem%2C%20it%20does%20significantly%20improve%20the%20state-of-the-art%20in%20both%20the%20computational%20complexity%20as%20well%20as%20the%20set%20of%20equivalences%20it%20can%20establish.%20Preliminary%20results%20show%20that%20juice%20is%20effective%20in%20pairing%20code%20variants%20created%20by%20post-compile%20obfuscating%20transformations.%22%2C%22date%22%3A%222013%22%2C%22proceedingsTitle%22%3A%22Proceedings%20of%20the%202Nd%20ACM%20SIGPLAN%20Program%20Protection%20and%20Reverse%20Engineering%20Workshop%22%2C%22conferenceName%22%3A%22%22%2C%22language%22%3A%22%22%2C%22DOI%22%3A%2210.1145%5C%2F2430553.2430558%22%2C%22ISBN%22%3A%22978-1-4503-1857-0%22%2C%22url%22%3A%22http%3A%5C%2F%5C%2Fdoi.acm.org%5C%2F10.1145%5C%2F2430553.2430558%22%2C%22collections%22%3A%5B%22JUUEUA7U%22%5D%2C%22dateModified%22%3A%222014-01-06T20%3A40%3A15Z%22%7D%7D%2C%7B%22key%22%3A%22JQ3QHH78%22%2C%22library%22%3A%7B%22id%22%3A136048%7D%2C%22meta%22%3A%7B%22creatorSummary%22%3A%22Walenstein%20et%20al.%22%2C%22parsedDate%22%3A%222007%22%2C%22numChildren%22%3A1%7D%2C%22bib%22%3A%22%3Cdiv%20class%3D%5C%22csl-bib-body%5C%22%20style%3D%5C%22line-height%3A%202%3B%20padding-left%3A%202em%3B%20text-indent%3A-2em%3B%5C%22%3E%5Cn%20%20%3Cdiv%20class%3D%5C%22csl-entry%5C%22%3EWalenstein%2C%20A.%2C%20Hayes%2C%20M.%2C%20%26amp%3B%20Lakhotia%2C%20A.%20%282007%29.%20Phylogenetic%20Comparisons%20of%20Malware.%20In%20%3Ci%3EVirus%20Bulletin%20Conference%3C%5C%2Fi%3E%20%28Vol.%2039%2C%20p.%2041%29.%20%3Ca%20title%3D%27Cite%20in%20RIS%20Format%27%20class%3D%27zp-CiteRIS%27%20href%3D%27http%3A%5C%2F%5C%2Fulsrl.org%5C%2Fwp-content%5C%2Fplugins%5C%2Fzotpress%5C%2Flib%5C%2Frequest%5C%2Frequest.cite.php%3Fapi_user_id%3D136048%26amp%3Bitem_key%3DJQ3QHH78%27%3ECite%3C%5C%2Fa%3E%20%20%3Ca%20title%3D%27Download%27%20class%3D%27zp-DownloadURL%27%20href%3D%27http%3A%5C%2F%5C%2Fulsrl.org%5C%2Fwp-content%5C%2Fplugins%5C%2Fzotpress%5C%2Flib%5C%2Frequest%5C%2Frequest.dl.php%3Fapi_user_id%3D136048%26amp%3Bdlkey%3D5QTUHD49%26amp%3Bcontent_type%3Dapplication%5C%2Fpdf%27%3EDownload%3C%5C%2Fa%3E%3C%5C%2Fdiv%3E%5Cn%3C%5C%2Fdiv%3E%22%2C%22data%22%3A%7B%22itemType%22%3A%22conferencePaper%22%2C%22title%22%3A%22Phylogenetic%20Comparisons%20of%20Malware%22%2C%22creators%22%3A%5B%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22Andrew%22%2C%22lastName%22%3A%22Walenstein%22%7D%2C%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22Matthew%22%2C%22lastName%22%3A%22Hayes%22%7D%2C%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22Arun%22%2C%22lastName%22%3A%22Lakhotia%22%7D%5D%2C%22abstractNote%22%3A%22%22%2C%22date%22%3A%222007%22%2C%22proceedingsTitle%22%3A%22Virus%20Bulletin%20Conference%22%2C%22conferenceName%22%3A%22%22%2C%22language%22%3A%22%22%2C%22DOI%22%3A%22%22%2C%22ISBN%22%3A%22%22%2C%22url%22%3A%22%22%2C%22collections%22%3A%5B%22JUUEUA7U%22%5D%2C%22dateModified%22%3A%222014-01-06T20%3A39%3A38Z%22%7D%7D%2C%7B%22key%22%3A%2238QBRN2C%22%2C%22library%22%3A%7B%22id%22%3A136048%7D%2C%22meta%22%3A%7B%22creatorSummary%22%3A%22Walenstein%20et%20al.%22%2C%22parsedDate%22%3A%222008%22%2C%22numChildren%22%3A0%7D%2C%22bib%22%3A%22%3Cdiv%20class%3D%5C%22csl-bib-body%5C%22%20style%3D%5C%22line-height%3A%202%3B%20padding-left%3A%202em%3B%20text-indent%3A-2em%3B%5C%22%3E%5Cn%20%20%3Cdiv%20class%3D%5C%22csl-entry%5C%22%3EWalenstein%2C%20A.%2C%20Mathur%2C%20R.%2C%20Chouchane%2C%20M.%20R.%2C%20%26amp%3B%20Lakhotia%2C%20A.%20%282008%29.%20Constructing%20malware%20normalizers%20using%20term%20rewriting.%20%3Ci%3EJournal%20in%20Computer%20Virology%3C%5C%2Fi%3E%2C%20%3Ci%3E4%3C%5C%2Fi%3E%284%29%2C%20307%26%23x2013%3B322.%20%3Ca%20title%3D%27Cite%20in%20RIS%20Format%27%20class%3D%27zp-CiteRIS%27%20href%3D%27http%3A%5C%2F%5C%2Fulsrl.org%5C%2Fwp-content%5C%2Fplugins%5C%2Fzotpress%5C%2Flib%5C%2Frequest%5C%2Frequest.cite.php%3Fapi_user_id%3D136048%26amp%3Bitem_key%3D38QBRN2C%27%3ECite%3C%5C%2Fa%3E%20%3C%5C%2Fdiv%3E%5Cn%3C%5C%2Fdiv%3E%22%2C%22data%22%3A%7B%22itemType%22%3A%22journalArticle%22%2C%22title%22%3A%22Constructing%20malware%20normalizers%20using%20term%20rewriting%22%2C%22creators%22%3A%5B%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22Andrew%22%2C%22lastName%22%3A%22Walenstein%22%7D%2C%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22Rachit%22%2C%22lastName%22%3A%22Mathur%22%7D%2C%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22Mohamed%20R%22%2C%22lastName%22%3A%22Chouchane%22%7D%2C%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22Arun%22%2C%22lastName%22%3A%22Lakhotia%22%7D%5D%2C%22abstractNote%22%3A%22%22%2C%22date%22%3A%222008%22%2C%22language%22%3A%22%22%2C%22DOI%22%3A%22%22%2C%22ISSN%22%3A%22%22%2C%22url%22%3A%22%22%2C%22collections%22%3A%5B%22JUUEUA7U%22%2C%22APED9CV8%22%5D%2C%22dateModified%22%3A%222014-01-06T20%3A32%3A50Z%22%7D%7D%2C%7B%22key%22%3A%22MAA3IZ9R%22%2C%22library%22%3A%7B%22id%22%3A136048%7D%2C%22meta%22%3A%7B%22creatorSummary%22%3A%22Chouchane%20et%20al.%22%2C%22parsedDate%22%3A%222008%22%2C%22numChildren%22%3A0%7D%2C%22bib%22%3A%22%3Cdiv%20class%3D%5C%22csl-bib-body%5C%22%20style%3D%5C%22line-height%3A%202%3B%20padding-left%3A%202em%3B%20text-indent%3A-2em%3B%5C%22%3E%5Cn%20%20%3Cdiv%20class%3D%5C%22csl-entry%5C%22%3EChouchane%2C%20M.%20R.%2C%20Walenstein%2C%20A.%2C%20%26amp%3B%20Lakhotia%2C%20A.%20%282008%29.%20Using%20Markov%20Chains%20to%20filter%20machine-morphed%20variants%20of%20malicious%20programs.%20In%20%3Ci%3EMalicious%20and%20Unwanted%20Software%2C%202008.%20MALWARE%202008.%203rd%20International%20Conference%20on%3C%5C%2Fi%3E%20%28pp.%2077%26%23x2013%3B84%29.%20%3Ca%20title%3D%27Cite%20in%20RIS%20Format%27%20class%3D%27zp-CiteRIS%27%20href%3D%27http%3A%5C%2F%5C%2Fulsrl.org%5C%2Fwp-content%5C%2Fplugins%5C%2Fzotpress%5C%2Flib%5C%2Frequest%5C%2Frequest.cite.php%3Fapi_user_id%3D136048%26amp%3Bitem_key%3DMAA3IZ9R%27%3ECite%3C%5C%2Fa%3E%20%3C%5C%2Fdiv%3E%5Cn%3C%5C%2Fdiv%3E%22%2C%22data%22%3A%7B%22itemType%22%3A%22conferencePaper%22%2C%22title%22%3A%22Using%20Markov%20Chains%20to%20filter%20machine-morphed%20variants%20of%20malicious%20programs%22%2C%22creators%22%3A%5B%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22Mohamed%20R%22%2C%22lastName%22%3A%22Chouchane%22%7D%2C%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22Andrew%22%2C%22lastName%22%3A%22Walenstein%22%7D%2C%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22Arun%22%2C%22lastName%22%3A%22Lakhotia%22%7D%5D%2C%22abstractNote%22%3A%22%22%2C%22date%22%3A%222008%22%2C%22proceedingsTitle%22%3A%22Malicious%20and%20Unwanted%20Software%2C%202008.%20MALWARE%202008.%203rd%20International%20Conference%20on%22%2C%22conferenceName%22%3A%22%22%2C%22language%22%3A%22%22%2C%22DOI%22%3A%22%22%2C%22ISBN%22%3A%22%22%2C%22url%22%3A%22%22%2C%22collections%22%3A%5B%22JUUEUA7U%22%5D%2C%22dateModified%22%3A%222014-01-06T20%3A32%3A34Z%22%7D%7D%2C%7B%22key%22%3A%222M7U6I58%22%2C%22library%22%3A%7B%22id%22%3A136048%7D%2C%22meta%22%3A%7B%22creatorSummary%22%3A%22Charles%20LeDoux%20et%20al.%22%2C%22parsedDate%22%3A%222013%22%2C%22numChildren%22%3A1%7D%2C%22bib%22%3A%22%3Cdiv%20class%3D%5C%22csl-bib-body%5C%22%20style%3D%5C%22line-height%3A%202%3B%20padding-left%3A%202em%3B%20text-indent%3A-2em%3B%5C%22%3E%5Cn%20%20%3Cdiv%20class%3D%5C%22csl-entry%5C%22%3ECharles%20LeDoux%2C%20Arun%20Lakhotia%2C%20Craig%20Miles%2C%20Vivek%20Notani%2C%20%26amp%3B%20Avi%20Pfeffer.%20%282013%29.%20FuncTracker%3A%20Discovering%20Shared%20Code%20to%20Aid%20Malware%20Forensics%20Extended%20Abstract.%20Presented%20at%20the%206th%20USENIX%20Workshop%20on%20Large-Scale%20Exploits%20and%20Emergent%20Threats%20%28LEET%20%26%23x2019%3B13%29.%20Retrieved%20from%20%3Ca%20href%3D%27https%3A%5C%2F%5C%2Fwww.usenix.org%5C%2Fconference%5C%2Fleet13%5C%2Ffunctracker-discovering-shared-code-to-aid-malware-forensics%27%3Ehttps%3A%5C%2F%5C%2Fwww.usenix.org%5C%2Fconference%5C%2Fleet13%5C%2Ffunctracker-discovering-shared-code-to-aid-malware-forensics%3C%5C%2Fa%3E%20%3Ca%20title%3D%27Cite%20in%20RIS%20Format%27%20class%3D%27zp-CiteRIS%27%20href%3D%27http%3A%5C%2F%5C%2Fulsrl.org%5C%2Fwp-content%5C%2Fplugins%5C%2Fzotpress%5C%2Flib%5C%2Frequest%5C%2Frequest.cite.php%3Fapi_user_id%3D136048%26amp%3Bitem_key%3D2M7U6I58%27%3ECite%3C%5C%2Fa%3E%20%20%3Ca%20title%3D%27Download%27%20class%3D%27zp-DownloadURL%27%20href%3D%27http%3A%5C%2F%5C%2Fulsrl.org%5C%2Fwp-content%5C%2Fplugins%5C%2Fzotpress%5C%2Flib%5C%2Frequest%5C%2Frequest.dl.php%3Fapi_user_id%3D136048%26amp%3Bdlkey%3D8V92UZGI%26amp%3Bcontent_type%3Dapplication%5C%2Fpdf%27%3EDownload%3C%5C%2Fa%3E%3C%5C%2Fdiv%3E%5Cn%3C%5C%2Fdiv%3E%22%2C%22data%22%3A%7B%22itemType%22%3A%22conferencePaper%22%2C%22title%22%3A%22FuncTracker%3A%20Discovering%20Shared%20Code%20to%20Aid%20Malware%20Forensics%20Extended%20Abstract%22%2C%22creators%22%3A%5B%7B%22creatorType%22%3A%22author%22%2C%22name%22%3A%22Charles%20LeDoux%22%7D%2C%7B%22creatorType%22%3A%22author%22%2C%22name%22%3A%22Arun%20Lakhotia%22%7D%2C%7B%22creatorType%22%3A%22author%22%2C%22name%22%3A%22Craig%20Miles%22%7D%2C%7B%22creatorType%22%3A%22author%22%2C%22name%22%3A%22Vivek%20Notani%22%7D%2C%7B%22creatorType%22%3A%22author%22%2C%22name%22%3A%22Avi%20Pfeffer%22%7D%5D%2C%22abstractNote%22%3A%22%22%2C%22date%22%3A%222013%22%2C%22proceedingsTitle%22%3A%22%22%2C%22conferenceName%22%3A%226th%20USENIX%20Workshop%20on%20Large-Scale%20Exploits%20and%20Emergent%20Threats%20%28LEET%20%2713%29%22%2C%22language%22%3A%22%22%2C%22DOI%22%3A%22%22%2C%22ISBN%22%3A%22%22%2C%22url%22%3A%22https%3A%5C%2F%5C%2Fwww.usenix.org%5C%2Fconference%5C%2Fleet13%5C%2Ffunctracker-discovering-shared-code-to-aid-malware-forensics%22%2C%22collections%22%3A%5B%22JUUEUA7U%22%2C%22B48ZW7RZ%22%5D%2C%22dateModified%22%3A%222013-09-14T20%3A15%3A19Z%22%7D%7D%2C%7B%22key%22%3A%22XKD9WT2X%22%2C%22library%22%3A%7B%22id%22%3A136048%7D%2C%22meta%22%3A%7B%22creatorSummary%22%3A%22Walenstein%20and%20Lakhotia%22%2C%22parsedDate%22%3A%222012%22%2C%22numChildren%22%3A2%7D%2C%22bib%22%3A%22%3Cdiv%20class%3D%5C%22csl-bib-body%5C%22%20style%3D%5C%22line-height%3A%202%3B%20padding-left%3A%202em%3B%20text-indent%3A-2em%3B%5C%22%3E%5Cn%20%20%3Cdiv%20class%3D%5C%22csl-entry%5C%22%3EWalenstein%2C%20A.%2C%20%26amp%3B%20Lakhotia%2C%20A.%20%282012%29.%20A%20transformation-based%20model%20of%20malware%20derivation.%20In%20%3Ci%3E2012%207th%20International%20Conference%20on%20Malicious%20and%20Unwanted%20Software%20%28MALWARE%29%3C%5C%2Fi%3E%20%28pp.%2017%26%23x2013%3B25%29.%20%3Ca%20href%3D%27https%3A%5C%2F%5C%2Fdoi.org%5C%2F10.1109%5C%2FMALWARE.2012.6461003%27%3Ehttps%3A%5C%2F%5C%2Fdoi.org%5C%2F10.1109%5C%2FMALWARE.2012.6461003%3C%5C%2Fa%3E%20%3Ca%20title%3D%27Cite%20in%20RIS%20Format%27%20class%3D%27zp-CiteRIS%27%20href%3D%27http%3A%5C%2F%5C%2Fulsrl.org%5C%2Fwp-content%5C%2Fplugins%5C%2Fzotpress%5C%2Flib%5C%2Frequest%5C%2Frequest.cite.php%3Fapi_user_id%3D136048%26amp%3Bitem_key%3DXKD9WT2X%27%3ECite%3C%5C%2Fa%3E%20%20%3Ca%20title%3D%27Download%27%20class%3D%27zp-DownloadURL%27%20href%3D%27http%3A%5C%2F%5C%2Fulsrl.org%5C%2Fwp-content%5C%2Fplugins%5C%2Fzotpress%5C%2Flib%5C%2Frequest%5C%2Frequest.dl.php%3Fapi_user_id%3D136048%26amp%3Bdlkey%3DQT5QSQ5W%26amp%3Bcontent_type%3Dapplication%5C%2Fpdf%27%3EDownload%3C%5C%2Fa%3E%3C%5C%2Fdiv%3E%5Cn%3C%5C%2Fdiv%3E%22%2C%22data%22%3A%7B%22itemType%22%3A%22conferencePaper%22%2C%22title%22%3A%22A%20transformation-based%20model%20of%20malware%20derivation%22%2C%22creators%22%3A%5B%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22A.%22%2C%22lastName%22%3A%22Walenstein%22%7D%2C%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22A.%22%2C%22lastName%22%3A%22Lakhotia%22%7D%5D%2C%22abstractNote%22%3A%22Since%20most%20malware%20is%20derived%20from%20prior%20code%2C%20understanding%20malware%20derivation%20and%20evolution%20is%20essential%20for%20many%20types%20of%20malware%20analysis.%20However%20prior%20models%20of%20malware%20relationships%20are%20insufficiently%20precise%20or%20fail%20to%20capture%20important%20relationships.%20A%20framework%20is%20proposed%20that%20treats%20both%20production%20and%20evolution%20uniformly%20as%20compositions%20of%20code%20transformations%2C%20and%20distinguishes%20disjoint%20but%20interleaved%20evolution%20of%20production%20code%20and%20malware%20code.%20Evolution%20relations%20are%20defined%20in%20terms%20of%20path%20patterns%20on%20derivation%20graphs%3B%20this%20generalizes%20and%20formalizes%20the%20relationship%20between%20phylogenies%20and%20provenance%20graphs.%20The%20comprehensiveness%20of%20the%20modeling%20framework%20is%20demonstrated%20using%20examples%20from%20the%20literature%3B%20implications%20for%20future%20work%20in%20relationship%20reconstruction%20are%20drawn.%22%2C%22date%22%3A%222012%22%2C%22proceedingsTitle%22%3A%222012%207th%20International%20Conference%20on%20Malicious%20and%20Unwanted%20Software%20%28MALWARE%29%22%2C%22conferenceName%22%3A%222012%207th%20International%20Conference%20on%20Malicious%20and%20Unwanted%20Software%20%28MALWARE%29%22%2C%22language%22%3A%22%22%2C%22DOI%22%3A%2210.1109%5C%2FMALWARE.2012.6461003%22%2C%22ISBN%22%3A%22%22%2C%22url%22%3A%22%22%2C%22collections%22%3A%5B%22JUUEUA7U%22%5D%2C%22dateModified%22%3A%222013-09-11T15%3A27%3A18Z%22%7D%7D%2C%7B%22key%22%3A%226RV7GKJW%22%2C%22library%22%3A%7B%22id%22%3A136048%7D%2C%22meta%22%3A%7B%22creatorSummary%22%3A%22Charles%20LeDoux%20et%20al.%22%2C%22parsedDate%22%3A%222012%22%2C%22numChildren%22%3A1%7D%2C%22bib%22%3A%22%3Cdiv%20class%3D%5C%22csl-bib-body%5C%22%20style%3D%5C%22line-height%3A%202%3B%20padding-left%3A%202em%3B%20text-indent%3A-2em%3B%5C%22%3E%5Cn%20%20%3Cdiv%20class%3D%5C%22csl-entry%5C%22%3ECharles%20LeDoux%2C%20Michael%20Sharkey%2C%20Brandon%20Primeaux%2C%20%26amp%3B%20Craig%20Miles.%20%282012%29.%20Instruction%20embedding%20for%20improved%20obfuscation.%20In%20%3Ci%3EProceedings%20of%20the%2050th%20Annual%20Southeast%20Regional%20Conference%3C%5C%2Fi%3E%20%28pp.%20130%26%23x2013%3B135%29.%20Retrieved%20from%20%3Ca%20href%3D%27http%3A%5C%2F%5C%2Fdl.acm.org%5C%2Fcitation.cfm%3Fid%3D2184543%27%3Ehttp%3A%5C%2F%5C%2Fdl.acm.org%5C%2Fcitation.cfm%3Fid%3D2184543%3C%5C%2Fa%3E%20%3Ca%20title%3D%27Cite%20in%20RIS%20Format%27%20class%3D%27zp-CiteRIS%27%20href%3D%27http%3A%5C%2F%5C%2Fulsrl.org%5C%2Fwp-content%5C%2Fplugins%5C%2Fzotpress%5C%2Flib%5C%2Frequest%5C%2Frequest.cite.php%3Fapi_user_id%3D136048%26amp%3Bitem_key%3D6RV7GKJW%27%3ECite%3C%5C%2Fa%3E%20%20%3Ca%20title%3D%27Download%27%20class%3D%27zp-DownloadURL%27%20href%3D%27http%3A%5C%2F%5C%2Fulsrl.org%5C%2Fwp-content%5C%2Fplugins%5C%2Fzotpress%5C%2Flib%5C%2Frequest%5C%2Frequest.dl.php%3Fapi_user_id%3D136048%26amp%3Bdlkey%3DXP79U4V2%26amp%3Bcontent_type%3Dapplication%5C%2Fpdf%27%3EDownload%3C%5C%2Fa%3E%3C%5C%2Fdiv%3E%5Cn%3C%5C%2Fdiv%3E%22%2C%22data%22%3A%7B%22itemType%22%3A%22conferencePaper%22%2C%22title%22%3A%22Instruction%20embedding%20for%20improved%20obfuscation%22%2C%22creators%22%3A%5B%7B%22creatorType%22%3A%22author%22%2C%22name%22%3A%22Charles%20LeDoux%22%7D%2C%7B%22creatorType%22%3A%22author%22%2C%22name%22%3A%22Michael%20Sharkey%22%7D%2C%7B%22creatorType%22%3A%22author%22%2C%22name%22%3A%22Brandon%20Primeaux%22%7D%2C%7B%22creatorType%22%3A%22author%22%2C%22name%22%3A%22Craig%20Miles%22%7D%5D%2C%22abstractNote%22%3A%22%22%2C%22date%22%3A%222012%22%2C%22proceedingsTitle%22%3A%22Proceedings%20of%20the%2050th%20Annual%20Southeast%20Regional%20Conference%22%2C%22conferenceName%22%3A%22%22%2C%22language%22%3A%22%22%2C%22DOI%22%3A%22%22%2C%22ISBN%22%3A%22%22%2C%22url%22%3A%22http%3A%5C%2F%5C%2Fdl.acm.org%5C%2Fcitation.cfm%3Fid%3D2184543%22%2C%22collections%22%3A%5B%22JUUEUA7U%22%2C%22CFD996TJ%22%5D%2C%22dateModified%22%3A%222013-01-03T22%3A09%3A40Z%22%7D%7D%2C%7B%22key%22%3A%22QP5SUZ2I%22%2C%22library%22%3A%7B%22id%22%3A136048%7D%2C%22meta%22%3A%7B%22creatorSummary%22%3A%22Charles%20LeDoux%20et%20al.%22%2C%22parsedDate%22%3A%222012%22%2C%22numChildren%22%3A2%7D%2C%22bib%22%3A%22%3Cdiv%20class%3D%5C%22csl-bib-body%5C%22%20style%3D%5C%22line-height%3A%202%3B%20padding-left%3A%202em%3B%20text-indent%3A-2em%3B%5C%22%3E%5Cn%20%20%3Cdiv%20class%3D%5C%22csl-entry%5C%22%3ECharles%20LeDoux%2C%20Andrew%20Walenstein%2C%20%26amp%3B%20Arun%20Lakhotia.%20%282012%29.%20Improved%20Malware%20Classification%20through%20Sensor%20Fusion%20Using%20Disjoint%20Union.%20In%20%3Ci%3EInformation%20Systems%2C%20Technology%20and%20Management%3C%5C%2Fi%3E%20%28pp.%20360%26%23x2013%3B371%29.%20Grenoble%2C%20France%3A%20Springer%20Berlin%20Heidelberg.%20%3Ca%20href%3D%27https%3A%5C%2F%5C%2Fdoi.org%5C%2F10.1007%5C%2F978-3-642-29166-1_32%27%3Ehttps%3A%5C%2F%5C%2Fdoi.org%5C%2F10.1007%5C%2F978-3-642-29166-1_32%3C%5C%2Fa%3E%20%3Ca%20title%3D%27Cite%20in%20RIS%20Format%27%20class%3D%27zp-CiteRIS%27%20href%3D%27http%3A%5C%2F%5C%2Fulsrl.org%5C%2Fwp-content%5C%2Fplugins%5C%2Fzotpress%5C%2Flib%5C%2Frequest%5C%2Frequest.cite.php%3Fapi_user_id%3D136048%26amp%3Bitem_key%3DQP5SUZ2I%27%3ECite%3C%5C%2Fa%3E%20%20%3Ca%20title%3D%27Download%27%20class%3D%27zp-DownloadURL%27%20href%3D%27http%3A%5C%2F%5C%2Fulsrl.org%5C%2Fwp-content%5C%2Fplugins%5C%2Fzotpress%5C%2Flib%5C%2Frequest%5C%2Frequest.dl.php%3Fapi_user_id%3D136048%26amp%3Bdlkey%3DNHDXD2T6%26amp%3Bcontent_type%3Dapplication%5C%2Fpdf%27%3EDownload%3C%5C%2Fa%3E%3C%5C%2Fdiv%3E%5Cn%3C%5C%2Fdiv%3E%22%2C%22data%22%3A%7B%22itemType%22%3A%22conferencePaper%22%2C%22title%22%3A%22Improved%20Malware%20Classification%20through%20Sensor%20Fusion%20Using%20Disjoint%20Union%22%2C%22creators%22%3A%5B%7B%22creatorType%22%3A%22author%22%2C%22name%22%3A%22Charles%20LeDoux%22%7D%2C%7B%22creatorType%22%3A%22author%22%2C%22name%22%3A%22Andrew%20Walenstein%22%7D%2C%7B%22creatorType%22%3A%22author%22%2C%22name%22%3A%22Arun%20Lakhotia%22%7D%5D%2C%22abstractNote%22%3A%22%22%2C%22date%22%3A%222012%22%2C%22proceedingsTitle%22%3A%22Information%20Systems%2C%20Technology%20and%20Management%22%2C%22conferenceName%22%3A%22%22%2C%22language%22%3A%22%22%2C%22DOI%22%3A%2210.1007%5C%2F978-3-642-29166-1_32%22%2C%22ISBN%22%3A%22978-3-642-29166-1%22%2C%22url%22%3A%22http%3A%5C%2F%5C%2Fwww.springerlink.com%5C%2Findex%5C%2FX02884K103700654.pdf%22%2C%22collections%22%3A%5B%22JUUEUA7U%22%5D%2C%22dateModified%22%3A%222013-01-03T22%3A09%3A40Z%22%7D%7D%5D%7D
Dalla Preda, M., Feng, W., Giacobazzi, R., Greechie, R., & Lakhotia, A. (2012). Twisting Additivity in Program Obfuscation. In S. Dua, A. Gangopadhyay, P. Thulasiraman, U. Straccia, M. Shepherd, & B. Stein (Eds.), Information Systems, Technology and Management (pp. 336–347). Springer Berlin Heidelberg. Retrieved from http://link.springer.com/chapter/10.1007/978-3-642-29166-1_30 Cite
Singh, P. K., Moinuddin, M., & Lakhotia, A. (2003). Using static analysis and verification for analyzing virus and worm programs. In Proceedings of the 2nd European Conference on Information Warfare and Security (pp. 281–292). Cite
Lakhotia, A. (1998). DIME: a direct manipulation environment for evolutionary development of software. In , 6th International Workshop on Program Comprehension, 1998. IWPC ’98. Proceedings (pp. 72–79). https://doi.org/10.1109/WPC.1998.693289 Cite Download
Harman, M., Lakhotia, A., & Binkley, D. W. (2006). A Framework for Static Slicers of Unstructured Programs. Information and Software Technology, 48(7), 549–565. Retrieved from http://calcium.dcs.kcl.ac.uk/329/ Cite
Lakhotia, A. (1993). Rule-based approach to computing module cohesion. In , 15th International Conference on Software Engineering, 1993. Proceedings (pp. 35–44). https://doi.org/10.1109/ICSE.1993.346057 Cite Download
Lakhotia, A., & Deprez, J.-C. (1999). Restructuring functions with low cohesion. In Sixth Working Conference on Reverse Engineering, 1999. Proceedings (pp. 36–46). https://doi.org/10.1109/WCRE.1999.806945 Cite Download
Lakhotia, A. (1993). Constructing Call Multigraphs Using Dependence Graphs. In Proceedings of the 20th ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages (pp. 273–284). New York, NY, USA: ACM. https://doi.org/10.1145/158511.158647 Cite Download
Karim, M. E., Walenstein, A., Lakhotia, A., & Parida, L. (2005). Malware phylogeny using maximal pi-patterns. In EICAR 2005 Conference: Best Paper Proceedings (pp. 156–174). Retrieved from http://www.researchgate.net/publication/228640414_Malware_Phylogeny_Using_Maximal_Patterns/file/d912f50f9cc467ab89.pdf Cite Download
Deprez, J.-C., & Lakhotia, A. (2000). A formalism to automate mapping from program features to code. In 8th International Workshop on Program Comprehension, 2000. Proceedings. IWPC 2000 (pp. 69–78). https://doi.org/10.1109/WPC.2000.852481 Cite Download
Goel, S. (2008). 3rd Annual Symposium on Information Assurance (ASIA’08). Retrieved from http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.295.9837&rep=rep1&type=pdf Cite Download
Boccardo, D. R., Lakhotia, A., Manacero Jr, A., & Venable, M. (2009). Adapting call-string approach for x86 obfuscated binaries. Simpósio Brasileiro Em Seguran\cca Da Informa\ccao e de Sistemas Computacionais. Retrieved from http://www.lbd.dcc.ufmg.br/colecoes/sbseg/2009/011.pdf Cite Download
Eric, U. K., Kapoor, A., & Lakhotia, A. (2005). DOC–ANSWERING THE HIDDEN “CALL” OF A VIRUS. Virus Bulletin, 4, 8–10. Retrieved from http://www.cacs.louisiana.edu/~arun/papers/detecting-obfuscated-calls-VB2005.pdf Cite Download
Walenstein, A., Mathur, R., Chouchane, M., & Lakhotia, A. (2007). The design space of metamorphic malware. In Proceedings of the 2nd International Conference on i-Warfare & Security (ICIW) (pp. 241–248). Cite
Lakhotia, A., Boccardo, D. R., Singh, A., & Manacero,Jr., A. (2010). Context-sensitive Analysis of Obfuscated x86 Executables. In Proceedings of the 2010 ACM SIGPLAN Workshop on Partial Evaluation and Program Manipulation (pp. 131–140). New York, NY, USA: ACM. https://doi.org/10.1145/1706356.1706381 Cite Download
Lakhotia, A., & Mohammed, M. (2004). Imposing order on program statements to assist anti-virus scanners. In 11th Working Conference on Reverse Engineering, 2004. Proceedings (pp. 161–170). https://doi.org/10.1109/WCRE.2004.24 Cite Download
Lakhotia, A., Kapoor, A., & Kumar, E. U. (2004). Are metamorphic viruses really invincible. Virus Bulletin, 5–7. Retrieved from http://www.iscas2007.org/~arun/papers/invincible-complete.pdf Cite Download
Venable, M., Chouchane, M. R., Karim, M. E., & Lakhotia, A. (2005). Analyzing Memory Accesses in Obfuscated x86 Executables. In K. Julisch & C. Kruegel (Eds.), Detection of Intrusions and Malware, and Vulnerability Assessment (pp. 1–18). Springer Berlin Heidelberg. Retrieved from http://link.springer.com/chapter/10.1007/11506881_1 Cite Download
Lakhotia, A., & Kumar, E. U. (2004). Abstracting stack to detect obfuscated calls in binaries. In Fourth IEEE International Workshop on Source Code Analysis and Manipulation, 2004 (pp. 17–26). https://doi.org/10.1109/SCAM.2004.2 Cite Download
Lakhotia, A., & Walenstein, A. (n.d.). A Self-Learning AV Scanner. Retrieved from http://web.cacs.louisiana.edu/~arun/papers/2008-avar-self-learning.pdf Cite Download
Singh, A., Walenstein, A., & Lakhotia, A. (2012). Tracking Concept Drift in Malware Families. In Proceedings of the 5th ACM Workshop on Security and Artificial Intelligence (pp. 81–92). New York, NY, USA: ACM. https://doi.org/10.1145/2381896.2381910 Cite Download
Walenstein, A., & Lakhotia, A. (2007). The software similarity problem in malware analysis. Internat. Begegnungs-und Forschungszentrum für Informatik. Retrieved from http://drops.dagstuhl.de/opus/volltexte/2007/964/ Cite Download
Chouchane, M. R., & Lakhotia, A. (2006). Using Engine Signature to Detect Metamorphic Malware. In Proceedings of the 4th ACM Workshop on Recurring Malcode (pp. 73–78). New York, NY, USA: ACM. https://doi.org/10.1145/1179542.1179558 Cite Download
Lakhotia, A., Preda, M. D., & Giacobazzi, R. (2013). Fast Location of Similar Code Fragments Using Semantic “Juice.” In Proceedings of the 2Nd ACM SIGPLAN Program Protection and Reverse Engineering Workshop (pp. 5:1–5:6). New York, NY, USA: ACM. https://doi.org/10.1145/2430553.2430558 Cite Download
Walenstein, A., Mathur, R., Chouchane, M. R., & Lakhotia, A. (2008). Constructing malware normalizers using term rewriting. Journal in Computer Virology, 4(4), 307–322. Cite
Chouchane, M. R., Walenstein, A., & Lakhotia, A. (2008). Using Markov Chains to filter machine-morphed variants of malicious programs. In Malicious and Unwanted Software, 2008. MALWARE 2008. 3rd International Conference on (pp. 77–84). Cite
Charles LeDoux, Arun Lakhotia, Craig Miles, Vivek Notani, & Avi Pfeffer. (2013). FuncTracker: Discovering Shared Code to Aid Malware Forensics Extended Abstract. Presented at the 6th USENIX Workshop on Large-Scale Exploits and Emergent Threats (LEET ’13). Retrieved from https://www.usenix.org/conference/leet13/functracker-discovering-shared-code-to-aid-malware-forensics Cite Download
Walenstein, A., & Lakhotia, A. (2012). A transformation-based model of malware derivation. In 2012 7th International Conference on Malicious and Unwanted Software (MALWARE) (pp. 17–25). https://doi.org/10.1109/MALWARE.2012.6461003 Cite Download
Charles LeDoux, Michael Sharkey, Brandon Primeaux, & Craig Miles. (2012). Instruction embedding for improved obfuscation. In Proceedings of the 50th Annual Southeast Regional Conference (pp. 130–135). Retrieved from http://dl.acm.org/citation.cfm?id=2184543 Cite Download
Charles LeDoux, Andrew Walenstein, & Arun Lakhotia. (2012). Improved Malware Classification through Sensor Fusion Using Disjoint Union. In Information Systems, Technology and Management (pp. 360–371). Grenoble, France: Springer Berlin Heidelberg. https://doi.org/10.1007/978-3-642-29166-1_32 Cite Download
Journals
136048
SRRJ7DPN
apa
50
1
1
639
http://ulsrl.org/wp-content/plugins/zotpress/
%7B%22status%22%3A%22success%22%2C%22updateneeded%22%3Afalse%2C%22instance%22%3A%22zotpress-019ad539880e50c97895be4fcfc69694%22%2C%22meta%22%3A%7B%22request_last%22%3A0%2C%22request_next%22%3A0%2C%22used_cache%22%3Atrue%7D%2C%22data%22%3A%5B%7B%22key%22%3A%22BGAKUNE4%22%2C%22library%22%3A%7B%22id%22%3A136048%7D%2C%22meta%22%3A%7B%22creatorSummary%22%3A%22Harman%20et%20al.%22%2C%22parsedDate%22%3A%222006-07%22%2C%22numChildren%22%3A2%7D%2C%22bib%22%3A%22%3Cdiv%20class%3D%5C%22csl-bib-body%5C%22%20style%3D%5C%22line-height%3A%202%3B%20padding-left%3A%202em%3B%20text-indent%3A-2em%3B%5C%22%3E%5Cn%20%20%3Cdiv%20class%3D%5C%22csl-entry%5C%22%3EHarman%2C%20M.%2C%20Lakhotia%2C%20A.%2C%20%26amp%3B%20Binkley%2C%20D.%20%282006%29.%20Theory%20and%20algorithms%20for%20slicing%20unstructured%20programs.%20%3Ci%3EInformation%20and%20Software%20Technology%3C%5C%2Fi%3E%2C%20%3Ci%3E48%3C%5C%2Fi%3E%287%29%2C%20549%26%23x2013%3B565.%20%3Ca%20href%3D%27https%3A%5C%2F%5C%2Fdoi.org%5C%2F10.1016%5C%2Fj.infsof.2005.06.001%27%3Ehttps%3A%5C%2F%5C%2Fdoi.org%5C%2F10.1016%5C%2Fj.infsof.2005.06.001%3C%5C%2Fa%3E%20%3Ca%20title%3D%27Cite%20in%20RIS%20Format%27%20class%3D%27zp-CiteRIS%27%20href%3D%27http%3A%5C%2F%5C%2Fulsrl.org%5C%2Fwp-content%5C%2Fplugins%5C%2Fzotpress%5C%2Flib%5C%2Frequest%5C%2Frequest.cite.php%3Fapi_user_id%3D136048%26amp%3Bitem_key%3DBGAKUNE4%27%3ECite%3C%5C%2Fa%3E%20%20%3Ca%20title%3D%27Download%27%20class%3D%27zp-DownloadURL%27%20href%3D%27http%3A%5C%2F%5C%2Fulsrl.org%5C%2Fwp-content%5C%2Fplugins%5C%2Fzotpress%5C%2Flib%5C%2Frequest%5C%2Frequest.dl.php%3Fapi_user_id%3D136048%26amp%3Bdlkey%3DHN9C2KHH%26amp%3Bcontent_type%3Dapplication%5C%2Fpdf%27%3EDownload%3C%5C%2Fa%3E%3C%5C%2Fdiv%3E%5Cn%3C%5C%2Fdiv%3E%22%2C%22data%22%3A%7B%22itemType%22%3A%22journalArticle%22%2C%22title%22%3A%22Theory%20and%20algorithms%20for%20slicing%20unstructured%20programs%22%2C%22creators%22%3A%5B%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22Mark%22%2C%22lastName%22%3A%22Harman%22%7D%2C%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22Arun%22%2C%22lastName%22%3A%22Lakhotia%22%7D%2C%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22David%22%2C%22lastName%22%3A%22Binkley%22%7D%5D%2C%22abstractNote%22%3A%22Program%20slicing%20identifies%20parts%20of%20a%20program%20that%20potentially%20affect%20a%20chosen%20computation.%20It%20has%20many%20applications%20in%20software%20engineering%2C%20including%20maintenance%2C%20evolution%20and%20re-engineering%20of%20legacy%20systems.%20However%2C%20these%20systems%20typically%20contain%20programs%20with%20unstructured%20control-flow%2C%20produced%20using%20goto%20statements%3B%20thus%2C%20effective%20slicing%20of%20unstructured%20programs%20remains%20an%20important%20topic%20of%20study.%5Cn%5CnThis%20paper%20shows%20that%20slicing%20unstructured%20programs%20inherently%20requires%20making%20trade-offs%20between%20three%20slice%20attributes%3A%20termination%20behaviour%2C%20size%2C%20and%20syntactic%20structure.%20It%20is%20shown%20how%20different%20applications%20of%20slicing%20require%20different%20tradeoffs.%20The%20three%20attributes%20are%20used%20as%20the%20basis%20of%20a%20three-dimensional%20theoretical%20framework%2C%20which%20classifies%20slicing%20algorithms%20for%20unstructured%20programs.%20The%20paper%20proves%20that%20for%20two%20combinations%20of%20these%20dimensions%2C%20no%20algorithm%20exists%20and%20presents%20algorithms%20for%20the%20remaining%20six%20combinations.%22%2C%22date%22%3A%22July%202006%22%2C%22language%22%3A%22%22%2C%22DOI%22%3A%2210.1016%5C%2Fj.infsof.2005.06.001%22%2C%22ISSN%22%3A%220950-5849%22%2C%22url%22%3A%22http%3A%5C%2F%5C%2Fwww.sciencedirect.com%5C%2Fscience%5C%2Farticle%5C%2Fpii%5C%2FS0950584905000881%22%2C%22collections%22%3A%5B%22SRRJ7DPN%22%5D%2C%22dateModified%22%3A%222014-01-06T20%3A58%3A51Z%22%7D%7D%2C%7B%22key%22%3A%22A2XGNZB3%22%2C%22library%22%3A%7B%22id%22%3A136048%7D%2C%22meta%22%3A%7B%22creatorSummary%22%3A%22Chan%20and%20Lakhotia%22%2C%22parsedDate%22%3A%221998%22%2C%22numChildren%22%3A0%7D%2C%22bib%22%3A%22%3Cdiv%20class%3D%5C%22csl-bib-body%5C%22%20style%3D%5C%22line-height%3A%202%3B%20padding-left%3A%202em%3B%20text-indent%3A-2em%3B%5C%22%3E%5Cn%20%20%3Cdiv%20class%3D%5C%22csl-entry%5C%22%3EChan%2C%20T.%20W.%2C%20%26amp%3B%20Lakhotia%2C%20A.%20%281998%29.%20Debugging%20program%20failure%20exhibited%20by%20voluminous%20data.%20%3Ci%3EJournal%20of%20Software%20Maintenance%3A%20Research%20and%20Practice%3C%5C%2Fi%3E%2C%20%3Ci%3E10%3C%5C%2Fi%3E%282%29%2C%20111%26%23x2013%3B150.%20https%3A%5C%2F%5C%2Fdoi.org%5C%2F10.1002%5C%2F%28SICI%291096-908X%28199803%5C%2F04%2910%3A2%26lt%3B111%3A%3AAID-SMR167%26gt%3B3.0.CO%3B2-8%20%3Ca%20title%3D%27Cite%20in%20RIS%20Format%27%20class%3D%27zp-CiteRIS%27%20href%3D%27http%3A%5C%2F%5C%2Fulsrl.org%5C%2Fwp-content%5C%2Fplugins%5C%2Fzotpress%5C%2Flib%5C%2Frequest%5C%2Frequest.cite.php%3Fapi_user_id%3D136048%26amp%3Bitem_key%3DA2XGNZB3%27%3ECite%3C%5C%2Fa%3E%20%3C%5C%2Fdiv%3E%5Cn%3C%5C%2Fdiv%3E%22%2C%22data%22%3A%7B%22itemType%22%3A%22journalArticle%22%2C%22title%22%3A%22Debugging%20program%20failure%20exhibited%20by%20voluminous%20data%22%2C%22creators%22%3A%5B%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22Tat%20W.%22%2C%22lastName%22%3A%22Chan%22%7D%2C%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22Arun%22%2C%22lastName%22%3A%22Lakhotia%22%7D%5D%2C%22abstractNote%22%3A%22It%20is%20difficult%20to%20debug%20a%20program%20when%20the%20data%20set%20that%20causes%20it%20to%20fail%20is%20large%20%28or%20voluminous%29.%20The%20cues%20that%20may%20help%20in%20locating%20the%20fault%20are%20obscured%20by%20the%20large%20amount%20of%20information%20that%20is%20generated%20from%20processing%20the%20data%20set.%20Clearly%2C%20a%20smaller%20data%20set%20which%20exhibits%20the%20same%20failure%20should%20lead%20to%20the%20diagnosis%20of%20the%20fault%20more%20quickly%20than%20the%20initial%2C%20large%20data%20set.%20We%20term%20such%20a%20smaller%20data%20set%20a%20data%20slice%20and%20the%20process%20of%20creating%20it%20data%20slicing.The%20problem%20of%20creating%20a%20data%20slice%20is%20undecidable.%20In%20this%20paper%2C%20we%20investigate%20four%20generate-and-test%20heuristics%20for%20deriving%20a%20smaller%20data%20set%20that%20reproduces%20the%20failure%20exhibited%20by%20a%20large%20data%20set.%20The%20four%20heuristics%20are%3A%20invariance%20analysis%2C%20origin%20tracking%2C%20random%20elimination%20and%20program-specific%20heuristics.%20We%20also%20provide%20a%20classification%20of%20programs%20based%20upon%20a%20certain%20relationship%20between%20their%20input%20and%20output.%20This%20classification%20may%20be%20used%20to%20choose%20an%20appropriate%20heuristic%20in%20a%20given%20debugging%20scenario.%20As%20evidence%20from%20a%20database%20of%20debugging%20anecdotes%20at%20the%20Open%20University%2C%20U.K.%2C%20debugging%20failures%20exhibited%20by%20large%20data%20sets%20require%20inordinate%20amounts%20of%20time.%20Our%20data%20slicing%20techniques%20would%20significantly%20reduce%20the%20effort%20required%20in%20such%20scenarios.%20%5Cu00a9%201998%20John%20Wiley%20%26%20Sons%2C%20Ltd.%22%2C%22date%22%3A%221998%22%2C%22language%22%3A%22en%22%2C%22DOI%22%3A%2210.1002%5C%2F%28SICI%291096-908X%28199803%5C%2F04%2910%3A2%3C111%3A%3AAID-SMR167%3E3.0.CO%3B2-8%22%2C%22ISSN%22%3A%221096-908X%22%2C%22url%22%3A%22http%3A%5C%2F%5C%2Fonlinelibrary.wiley.com%5C%2Fdoi%5C%2F10.1002%5C%2F%28SICI%291096-908X%28199803%5C%2F04%2910%3A2%3C111%3A%3AAID-SMR167%3E3.0.CO%3B2-8%5C%2Fabstract%22%2C%22collections%22%3A%5B%22SRRJ7DPN%22%5D%2C%22dateModified%22%3A%222014-01-06T20%3A57%3A28Z%22%7D%7D%2C%7B%22key%22%3A%2228TCXNSP%22%2C%22library%22%3A%7B%22id%22%3A136048%7D%2C%22meta%22%3A%7B%22creatorSummary%22%3A%22Lakhotia%20and%20Deprez%22%2C%22parsedDate%22%3A%221998-12-01%22%2C%22numChildren%22%3A2%7D%2C%22bib%22%3A%22%3Cdiv%20class%3D%5C%22csl-bib-body%5C%22%20style%3D%5C%22line-height%3A%202%3B%20padding-left%3A%202em%3B%20text-indent%3A-2em%3B%5C%22%3E%5Cn%20%20%3Cdiv%20class%3D%5C%22csl-entry%5C%22%3ELakhotia%2C%20A.%2C%20%26amp%3B%20Deprez%2C%20J.-C.%20%281998%29.%20Restructuring%20programs%20by%20tucking%20statements%20into%20functions.%20%3Ci%3EInformation%20and%20Software%20Technology%3C%5C%2Fi%3E%2C%20%3Ci%3E40%3C%5C%2Fi%3E%2811%26%23x2013%3B12%29%2C%20677%26%23x2013%3B689.%20%3Ca%20href%3D%27https%3A%5C%2F%5C%2Fdoi.org%5C%2F10.1016%5C%2FS0950-5849%2898%2900091-3%27%3Ehttps%3A%5C%2F%5C%2Fdoi.org%5C%2F10.1016%5C%2FS0950-5849%2898%2900091-3%3C%5C%2Fa%3E%20%3Ca%20title%3D%27Cite%20in%20RIS%20Format%27%20class%3D%27zp-CiteRIS%27%20href%3D%27http%3A%5C%2F%5C%2Fulsrl.org%5C%2Fwp-content%5C%2Fplugins%5C%2Fzotpress%5C%2Flib%5C%2Frequest%5C%2Frequest.cite.php%3Fapi_user_id%3D136048%26amp%3Bitem_key%3D28TCXNSP%27%3ECite%3C%5C%2Fa%3E%20%20%3Ca%20title%3D%27Download%27%20class%3D%27zp-DownloadURL%27%20href%3D%27http%3A%5C%2F%5C%2Fulsrl.org%5C%2Fwp-content%5C%2Fplugins%5C%2Fzotpress%5C%2Flib%5C%2Frequest%5C%2Frequest.dl.php%3Fapi_user_id%3D136048%26amp%3Bdlkey%3D24V8UFUU%26amp%3Bcontent_type%3Dapplication%5C%2Fpdf%27%3EDownload%3C%5C%2Fa%3E%3C%5C%2Fdiv%3E%5Cn%3C%5C%2Fdiv%3E%22%2C%22data%22%3A%7B%22itemType%22%3A%22journalArticle%22%2C%22title%22%3A%22Restructuring%20programs%20by%20tucking%20statements%20into%20functions%22%2C%22creators%22%3A%5B%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22Arun%22%2C%22lastName%22%3A%22Lakhotia%22%7D%2C%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22Jean-Christophe%22%2C%22lastName%22%3A%22Deprez%22%7D%5D%2C%22abstractNote%22%3A%22Changing%20the%20internal%20structure%20of%20a%20program%20without%20changing%20its%20behavior%20is%20called%20restructuring.%20This%20paper%20presents%20a%20transformation%20called%20tuck%20for%20restructuring%20programs%20by%20decomposing%20large%20functions%20into%20small%20functions.%20Tuck%20consists%20of%20three%20steps%3A%20Wedge%2C%20Split%2C%20and%20Fold.%20A%20wedge%20a%20subset%20of%20statements%20in%20a%20slice-contains%20computations%20that%20are%20related%20and%20that%20may%20create%20a%20meaningful%20function.%20The%20statements%20in%20a%20wedge%20are%20split%20from%20the%20rest%20of%20the%20code%20and%20folded%20into%20a%20new%20function.%20A%20call%20to%20the%20new%20function%20is%20placed%20in%20the%20now%20restructured%20function.%20That%20tuck%20does%20not%20alter%20the%20behavior%20of%20the%20original%20function%20follows%20from%20the%20semantic%20preserving%20properties%20of%20a%20slice.%22%2C%22date%22%3A%22December%201%2C%201998%22%2C%22language%22%3A%22%22%2C%22DOI%22%3A%2210.1016%5C%2FS0950-5849%2898%2900091-3%22%2C%22ISSN%22%3A%220950-5849%22%2C%22url%22%3A%22http%3A%5C%2F%5C%2Fwww.sciencedirect.com%5C%2Fscience%5C%2Farticle%5C%2Fpii%5C%2FS0950584998000913%22%2C%22collections%22%3A%5B%22SRRJ7DPN%22%5D%2C%22dateModified%22%3A%222014-01-06T20%3A56%3A40Z%22%7D%7D%2C%7B%22key%22%3A%22JWSM6A82%22%2C%22library%22%3A%7B%22id%22%3A136048%7D%2C%22meta%22%3A%7B%22creatorSummary%22%3A%22Lakhotia%20et%20al.%22%2C%22parsedDate%22%3A%222010-09-01%22%2C%22numChildren%22%3A1%7D%2C%22bib%22%3A%22%3Cdiv%20class%3D%5C%22csl-bib-body%5C%22%20style%3D%5C%22line-height%3A%202%3B%20padding-left%3A%202em%3B%20text-indent%3A-2em%3B%5C%22%3E%5Cn%20%20%3Cdiv%20class%3D%5C%22csl-entry%5C%22%3ELakhotia%2C%20A.%2C%20Boccardo%2C%20D.%20R.%2C%20Singh%2C%20A.%2C%20%26amp%3B%20Jr%2C%20A.%20M.%20%282010%29.%20Context-sensitive%20analysis%20without%20calling-context.%20%3Ci%3EHigher-Order%20and%20Symbolic%20Computation%3C%5C%2Fi%3E%2C%20%3Ci%3E23%3C%5C%2Fi%3E%283%29%2C%20275%26%23x2013%3B313.%20%3Ca%20href%3D%27https%3A%5C%2F%5C%2Fdoi.org%5C%2F10.1007%5C%2Fs10990-011-9080-1%27%3Ehttps%3A%5C%2F%5C%2Fdoi.org%5C%2F10.1007%5C%2Fs10990-011-9080-1%3C%5C%2Fa%3E%20%3Ca%20title%3D%27Cite%20in%20RIS%20Format%27%20class%3D%27zp-CiteRIS%27%20href%3D%27http%3A%5C%2F%5C%2Fulsrl.org%5C%2Fwp-content%5C%2Fplugins%5C%2Fzotpress%5C%2Flib%5C%2Frequest%5C%2Frequest.cite.php%3Fapi_user_id%3D136048%26amp%3Bitem_key%3DJWSM6A82%27%3ECite%3C%5C%2Fa%3E%20%3C%5C%2Fdiv%3E%5Cn%3C%5C%2Fdiv%3E%22%2C%22data%22%3A%7B%22itemType%22%3A%22journalArticle%22%2C%22title%22%3A%22Context-sensitive%20analysis%20without%20calling-context%22%2C%22creators%22%3A%5B%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22Arun%22%2C%22lastName%22%3A%22Lakhotia%22%7D%2C%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22Davidson%20R.%22%2C%22lastName%22%3A%22Boccardo%22%7D%2C%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22Anshuman%22%2C%22lastName%22%3A%22Singh%22%7D%2C%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22Aleardo%20Manacero%22%2C%22lastName%22%3A%22Jr%22%7D%5D%2C%22abstractNote%22%3A%22Since%20Sharir%20and%20Pnueli%2C%20algorithms%20for%20context-sensitivity%20have%20been%20defined%20in%20terms%20of%20%5Cu2018valid%5Cu2019%20paths%20in%20an%20interprocedural%20flow%20graph.%20The%20definition%20of%20valid%20paths%20requires%20atomic%20call%20and%20ret%20statements%2C%20and%20encapsulated%20procedures.%20Thus%2C%20the%20resulting%20algorithms%20are%20not%20directly%20applicable%20when%20behavior%20similar%20to%20call%20and%20ret%20instructions%20may%20be%20realized%20using%20non-atomic%20statements%2C%20or%20when%20procedures%20do%20not%20have%20rigid%20boundaries%2C%20such%20as%20with%20programs%20in%20low%20level%20languages%20like%20assembly%20or%20RTL.%20We%20present%20a%20framework%20for%20context-sensitive%20analysis%20that%20requires%20neither%20atomic%20call%20and%20ret%20instructions%2C%20nor%20encapsulated%20procedures.%20The%20framework%20presented%20decouples%20the%20transfer%20of%20control%20semantics%20and%20the%20context%20manipulation%20semantics%20of%20statements.%20A%20new%20definition%20of%20context-sensitivity%2C%20called%20stack%20contexts%2C%20is%20developed.%20A%20stack%20context%2C%20which%20is%20defined%20using%20trace%20semantics%2C%20is%20more%20general%20than%20Sharir%20and%20Pnueli%5Cu2019s%20interprocedural%20path%20based%20calling-context.%20An%20abstract%20interpretation%20based%20framework%20is%20developed%20to%20reason%20about%20stack-contexts%20and%20to%20derive%20analogues%20of%20calling-context%20based%20algorithms%20using%20stack-context.%20The%20framework%20presented%20is%20suitable%20for%20deriving%20algorithms%20for%20analyzing%20binary%20programs%2C%20such%20as%20malware%2C%20that%20employ%20obfuscations%20with%20the%20deliberate%20intent%20of%20defeating%20automated%20analysis.%20The%20framework%20is%20used%20to%20create%20a%20context-sensitive%20version%20of%20Venable%20et%20al.%5Cu2019s%20algorithm%20for%20analyzing%20x86%20binaries%20without%20requiring%20that%20a%20binary%20conforms%20to%20a%20standard%20compilation%20model%20for%20maintaining%20procedures%2C%20calls%2C%20and%20returns.%20Experimental%20results%20show%20that%20a%20context-sensitive%20analysis%20using%20stack-context%20performs%20just%20as%20well%20for%20programs%20where%20the%20use%20of%20Sharir%20and%20Pnueli%5Cu2019s%20calling-context%20produces%20correct%20approximations.%20However%2C%20if%20those%20programs%20are%20transformed%20to%20use%20call%20obfuscations%2C%20a%20context-sensitive%20analysis%20using%20stack-context%20still%20provides%20the%20same%2C%20correct%20results%20and%20without%20any%20additional%20overhead.%22%2C%22date%22%3A%222010%5C%2F09%5C%2F01%22%2C%22language%22%3A%22en%22%2C%22DOI%22%3A%2210.1007%5C%2Fs10990-011-9080-1%22%2C%22ISSN%22%3A%221388-3690%2C%201573-0557%22%2C%22url%22%3A%22http%3A%5C%2F%5C%2Flink.springer.com%5C%2Farticle%5C%2F10.1007%5C%2Fs10990-011-9080-1%22%2C%22collections%22%3A%5B%22SRRJ7DPN%22%2C%22CFD996TJ%22%5D%2C%22dateModified%22%3A%222014-01-06T20%3A51%3A54Z%22%7D%7D%2C%7B%22key%22%3A%2225ANBGXU%22%2C%22library%22%3A%7B%22id%22%3A136048%7D%2C%22meta%22%3A%7B%22creatorSummary%22%3A%22Lakhotia%20et%20al.%22%2C%22parsedDate%22%3A%222005%22%2C%22numChildren%22%3A2%7D%2C%22bib%22%3A%22%3Cdiv%20class%3D%5C%22csl-bib-body%5C%22%20style%3D%5C%22line-height%3A%202%3B%20padding-left%3A%202em%3B%20text-indent%3A-2em%3B%5C%22%3E%5Cn%20%20%3Cdiv%20class%3D%5C%22csl-entry%5C%22%3ELakhotia%2C%20A.%2C%20Kumar%2C%20E.%20U.%2C%20%26amp%3B%20Venable%2C%20M.%20%282005%29.%20A%20method%20for%20detecting%20obfuscated%20calls%20in%20malicious%20binaries.%20%3Ci%3EIEEE%20Transactions%20on%20Software%20Engineering%3C%5C%2Fi%3E%2C%20%3Ci%3E31%3C%5C%2Fi%3E%2811%29%2C%20955%26%23x2013%3B968.%20%3Ca%20href%3D%27https%3A%5C%2F%5C%2Fdoi.org%5C%2F10.1109%5C%2FTSE.2005.120%27%3Ehttps%3A%5C%2F%5C%2Fdoi.org%5C%2F10.1109%5C%2FTSE.2005.120%3C%5C%2Fa%3E%20%3Ca%20title%3D%27Cite%20in%20RIS%20Format%27%20class%3D%27zp-CiteRIS%27%20href%3D%27http%3A%5C%2F%5C%2Fulsrl.org%5C%2Fwp-content%5C%2Fplugins%5C%2Fzotpress%5C%2Flib%5C%2Frequest%5C%2Frequest.cite.php%3Fapi_user_id%3D136048%26amp%3Bitem_key%3D25ANBGXU%27%3ECite%3C%5C%2Fa%3E%20%20%3Ca%20title%3D%27Download%27%20class%3D%27zp-DownloadURL%27%20href%3D%27http%3A%5C%2F%5C%2Fulsrl.org%5C%2Fwp-content%5C%2Fplugins%5C%2Fzotpress%5C%2Flib%5C%2Frequest%5C%2Frequest.dl.php%3Fapi_user_id%3D136048%26amp%3Bdlkey%3DP7UQTXDC%26amp%3Bcontent_type%3Dapplication%5C%2Fpdf%27%3EDownload%3C%5C%2Fa%3E%3C%5C%2Fdiv%3E%5Cn%3C%5C%2Fdiv%3E%22%2C%22data%22%3A%7B%22itemType%22%3A%22journalArticle%22%2C%22title%22%3A%22A%20method%20for%20detecting%20obfuscated%20calls%20in%20malicious%20binaries%22%2C%22creators%22%3A%5B%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22A.%22%2C%22lastName%22%3A%22Lakhotia%22%7D%2C%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22Eric%20Uday%22%2C%22lastName%22%3A%22Kumar%22%7D%2C%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22M.%22%2C%22lastName%22%3A%22Venable%22%7D%5D%2C%22abstractNote%22%3A%22Information%20about%20calls%20to%20the%20operating%20system%20%28or%20kernel%20libraries%29%20made%20by%20a%20binary%20executable%20may%20be%20used%20to%20determine%20whether%20the%20binary%20is%20malicious.%20Being%20aware%20of%20this%20approach%2C%20malicious%20programmers%20hide%20this%20information%20by%20making%20such%20calls%20without%20using%20the%20call%20instruction.%20For%20instance%2C%20the%20call%20addr%20instruction%20may%20be%20replaced%20by%20two%20push%20instructions%20and%20a%20ret%20instruction%2C%20the%20first%20push%20pushes%20the%20address%20of%20instruction%20after%20the%20ret%20instruction%2C%20and%20the%20second%20push%20pushes%20the%20address%20addr.%20The%20code%20may%20be%20further%20obfuscated%20by%20spreading%20the%20three%20instructions%20and%20by%20splitting%20each%20instruction%20into%20multiple%20instructions.%20This%20work%20presents%20a%20method%20to%20statically%20detect%20obfuscated%20calls%20in%20binary%20code.%20The%20idea%20is%20to%20use%20abstract%20interpretation%20to%20detect%20where%20the%20normal%20call-ret%20convention%20is%20violated.%20These%20violations%20can%20be%20detected%20by%20what%20is%20called%20an%20abstract%20stack%20graph.%20An%20abstract%20stack%20graph%20is%20a%20concise%20representation%20of%20all%20potential%20abstract%20stacks%20at%20every%20point%20in%20a%20program.%20An%20abstract%20stack%20is%20used%20to%20associate%20each%20element%20in%20the%20stack%20to%20the%20instruction%20that%20pushes%20the%20element.%20An%20algorithm%20for%20constructing%20the%20abstract%20stack%20graph%20is%20also%20presented.%20Methods%20for%20using%20the%20abstract%20stack%20graph%20are%20shown%20to%20detect%20eight%20different%20obfuscations.%20The%20technique%20is%20demonstrated%20by%20implementing%20a%20prototype%20tool%20called%20DOC%20%28detector%20for%20obfuscated%20calls%29.%22%2C%22date%22%3A%222005%22%2C%22language%22%3A%22%22%2C%22DOI%22%3A%2210.1109%5C%2FTSE.2005.120%22%2C%22ISSN%22%3A%220098-5589%22%2C%22url%22%3A%22%22%2C%22collections%22%3A%5B%22SRRJ7DPN%22%2C%22CFD996TJ%22%5D%2C%22dateModified%22%3A%222014-01-06T20%3A44%3A47Z%22%7D%7D%2C%7B%22key%22%3A%224M6FC784%22%2C%22library%22%3A%7B%22id%22%3A136048%7D%2C%22meta%22%3A%7B%22creatorSummary%22%3A%22Chouchane%20et%20al.%22%2C%22parsedDate%22%3A%222013-08-01%22%2C%22numChildren%22%3A2%7D%2C%22bib%22%3A%22%3Cdiv%20class%3D%5C%22csl-bib-body%5C%22%20style%3D%5C%22line-height%3A%202%3B%20padding-left%3A%202em%3B%20text-indent%3A-2em%3B%5C%22%3E%5Cn%20%20%3Cdiv%20class%3D%5C%22csl-entry%5C%22%3EChouchane%2C%20R.%2C%20Stakhanova%2C%20N.%2C%20Walenstein%2C%20A.%2C%20%26amp%3B%20Lakhotia%2C%20A.%20%282013%29.%20Detecting%20machine-morphed%20malware%20variants%20via%20engine%20attribution.%20%3Ci%3EJournal%20of%20Computer%20Virology%20and%20Hacking%20Techniques%3C%5C%2Fi%3E%2C%20%3Ci%3E9%3C%5C%2Fi%3E%283%29%2C%20137%26%23x2013%3B157.%20%3Ca%20href%3D%27https%3A%5C%2F%5C%2Fdoi.org%5C%2F10.1007%5C%2Fs11416-013-0183-6%27%3Ehttps%3A%5C%2F%5C%2Fdoi.org%5C%2F10.1007%5C%2Fs11416-013-0183-6%3C%5C%2Fa%3E%20%3Ca%20title%3D%27Cite%20in%20RIS%20Format%27%20class%3D%27zp-CiteRIS%27%20href%3D%27http%3A%5C%2F%5C%2Fulsrl.org%5C%2Fwp-content%5C%2Fplugins%5C%2Fzotpress%5C%2Flib%5C%2Frequest%5C%2Frequest.cite.php%3Fapi_user_id%3D136048%26amp%3Bitem_key%3D4M6FC784%27%3ECite%3C%5C%2Fa%3E%20%20%3Ca%20title%3D%27Download%27%20class%3D%27zp-DownloadURL%27%20href%3D%27http%3A%5C%2F%5C%2Fulsrl.org%5C%2Fwp-content%5C%2Fplugins%5C%2Fzotpress%5C%2Flib%5C%2Frequest%5C%2Frequest.dl.php%3Fapi_user_id%3D136048%26amp%3Bdlkey%3D62ACZD95%26amp%3Bcontent_type%3Dapplication%5C%2Fpdf%27%3EDownload%3C%5C%2Fa%3E%3C%5C%2Fdiv%3E%5Cn%3C%5C%2Fdiv%3E%22%2C%22data%22%3A%7B%22itemType%22%3A%22journalArticle%22%2C%22title%22%3A%22Detecting%20machine-morphed%20malware%20variants%20via%20engine%20attribution%22%2C%22creators%22%3A%5B%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22Radhouane%22%2C%22lastName%22%3A%22Chouchane%22%7D%2C%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22Natalia%22%2C%22lastName%22%3A%22Stakhanova%22%7D%2C%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22Andrew%22%2C%22lastName%22%3A%22Walenstein%22%7D%2C%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22Arun%22%2C%22lastName%22%3A%22Lakhotia%22%7D%5D%2C%22abstractNote%22%3A%22One%20method%20malware%20authors%20use%20to%20defeat%20detection%20of%20their%20programs%20is%20to%20use%20morphing%20engines%20to%20rapidly%20generate%20a%20large%20number%20of%20variants.%20Inspired%20by%20previous%20works%20in%20author%20attribution%20of%20natural%20language%20text%2C%20we%20investigate%20a%20problem%20of%20attributing%20a%20malware%20to%20a%20morphing%20engine.%20Specifically%2C%20we%20present%20the%20malware%20engine%20attribution%20problem%20and%20formally%20define%20its%20three%20variations%3A%20MVRP%2C%20DENSITY%20and%20GEN%2C%20that%20reflect%20the%20challenges%20malware%20analysts%20face%20nowadays.%20We%20design%20and%20implement%20heuristics%20to%20address%20these%20problems%20and%20show%20their%20effectiveness%20on%20a%20set%20of%20well-known%20malware%20morphing%20engines%20and%20a%20real-world%20malware%20collection%20reaching%20detection%20accuracies%20of%2096%20%25%20and%20higher.%20Our%20experiments%20confirm%20the%20applicability%20of%20the%20proposed%20approach%20in%20practice%20and%20indicate%20that%20engine%20attribution%20may%20offer%20a%20viable%20enhancement%20of%20current%20defenses%20against%20malware.%22%2C%22date%22%3A%222013%5C%2F08%5C%2F01%22%2C%22language%22%3A%22en%22%2C%22DOI%22%3A%2210.1007%5C%2Fs11416-013-0183-6%22%2C%22ISSN%22%3A%221772-9890%2C%202263-8733%22%2C%22url%22%3A%22http%3A%5C%2F%5C%2Flink.springer.com%5C%2Farticle%5C%2F10.1007%5C%2Fs11416-013-0183-6%22%2C%22collections%22%3A%5B%22SRRJ7DPN%22%5D%2C%22dateModified%22%3A%222014-01-06T20%3A37%3A37Z%22%7D%7D%2C%7B%22key%22%3A%227IQ5W888%22%2C%22library%22%3A%7B%22id%22%3A136048%7D%2C%22meta%22%3A%7B%22creatorSummary%22%3A%22Hayes%20et%20al.%22%2C%22parsedDate%22%3A%222009-11-01%22%2C%22numChildren%22%3A2%7D%2C%22bib%22%3A%22%3Cdiv%20class%3D%5C%22csl-bib-body%5C%22%20style%3D%5C%22line-height%3A%202%3B%20padding-left%3A%202em%3B%20text-indent%3A-2em%3B%5C%22%3E%5Cn%20%20%3Cdiv%20class%3D%5C%22csl-entry%5C%22%3EHayes%2C%20M.%2C%20Walenstein%2C%20A.%2C%20%26amp%3B%20Lakhotia%2C%20A.%20%282009%29.%20Evaluation%20of%20malware%20phylogeny%20modelling%20systems%20using%20automated%20variant%20generation.%20%3Ci%3EJournal%20in%20Computer%20Virology%3C%5C%2Fi%3E%2C%20%3Ci%3E5%3C%5C%2Fi%3E%284%29%2C%20335%26%23x2013%3B343.%20%3Ca%20href%3D%27https%3A%5C%2F%5C%2Fdoi.org%5C%2F10.1007%5C%2Fs11416-008-0100-6%27%3Ehttps%3A%5C%2F%5C%2Fdoi.org%5C%2F10.1007%5C%2Fs11416-008-0100-6%3C%5C%2Fa%3E%20%3Ca%20title%3D%27Cite%20in%20RIS%20Format%27%20class%3D%27zp-CiteRIS%27%20href%3D%27http%3A%5C%2F%5C%2Fulsrl.org%5C%2Fwp-content%5C%2Fplugins%5C%2Fzotpress%5C%2Flib%5C%2Frequest%5C%2Frequest.cite.php%3Fapi_user_id%3D136048%26amp%3Bitem_key%3D7IQ5W888%27%3ECite%3C%5C%2Fa%3E%20%20%3Ca%20title%3D%27Download%27%20class%3D%27zp-DownloadURL%27%20href%3D%27http%3A%5C%2F%5C%2Fulsrl.org%5C%2Fwp-content%5C%2Fplugins%5C%2Fzotpress%5C%2Flib%5C%2Frequest%5C%2Frequest.dl.php%3Fapi_user_id%3D136048%26amp%3Bdlkey%3DJW5EJQWG%26amp%3Bcontent_type%3Dapplication%5C%2Fpdf%27%3EDownload%3C%5C%2Fa%3E%3C%5C%2Fdiv%3E%5Cn%3C%5C%2Fdiv%3E%22%2C%22data%22%3A%7B%22itemType%22%3A%22journalArticle%22%2C%22title%22%3A%22Evaluation%20of%20malware%20phylogeny%20modelling%20systems%20using%20automated%20variant%20generation%22%2C%22creators%22%3A%5B%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22Matthew%22%2C%22lastName%22%3A%22Hayes%22%7D%2C%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22Andrew%22%2C%22lastName%22%3A%22Walenstein%22%7D%2C%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22Arun%22%2C%22lastName%22%3A%22Lakhotia%22%7D%5D%2C%22abstractNote%22%3A%22A%20malware%20phylogeny%20model%20is%20an%20estimation%20of%20the%20derivation%20relationships%20between%20a%20set%20of%20malware%20samples.%20Systems%20that%20construct%20phylogeny%20models%20are%20expected%20to%20be%20useful%20for%20malware%20analysts.%20While%20several%20such%20systems%20have%20been%20proposed%2C%20little%20is%20known%20about%20the%20consistency%20of%20their%20results%20on%20different%20data%20sets%2C%20about%20their%20generalizability%20across%20different%20types%20of%20malware%20evolution.%20This%20paper%20explores%20these%20issues%20using%20two%20artificial%20malware%20history%20generators%3A%20systems%20that%20simulate%20malware%20evolution%20according%20to%20different%20evolution%20models.%20A%20quantitative%20study%20was%20conducted%20using%20two%20phylogeny%20model%20construction%20systems%20and%20multiple%20samples%20of%20artificial%20evolution.%20High%20variability%20was%20found%20in%20the%20quality%20of%20their%20results%20on%20different%20data%20sets%2C%20and%20the%20systems%20were%20shown%20to%20be%20sensitive%20to%20the%20characteristics%20of%20evolution%20in%20the%20data%20sets.%20The%20results%20call%20into%20question%20the%20adequacy%20of%20evaluations%20typical%20in%20the%20field%2C%20raise%20pragmatic%20concerns%20about%20tool%20choice%20for%20malware%20analysts%2C%20and%20underscore%20the%20important%20role%20that%20model-based%20simulation%20is%20expected%20to%20play%20in%20evaluating%20and%20selecting%20suitable%20malware%20phylogeny%20construction%20systems.%22%2C%22date%22%3A%222009%5C%2F11%5C%2F01%22%2C%22language%22%3A%22en%22%2C%22DOI%22%3A%2210.1007%5C%2Fs11416-008-0100-6%22%2C%22ISSN%22%3A%221772-9890%2C%201772-9904%22%2C%22url%22%3A%22http%3A%5C%2F%5C%2Flink.springer.com%5C%2Farticle%5C%2F10.1007%5C%2Fs11416-008-0100-6%22%2C%22collections%22%3A%5B%22SRRJ7DPN%22%5D%2C%22dateModified%22%3A%222014-01-06T20%3A36%3A53Z%22%7D%7D%2C%7B%22key%22%3A%22QHRX3Q6K%22%2C%22library%22%3A%7B%22id%22%3A136048%7D%2C%22meta%22%3A%7B%22creatorSummary%22%3A%22Karim%20et%20al.%22%2C%22parsedDate%22%3A%222005-11-01%22%2C%22numChildren%22%3A2%7D%2C%22bib%22%3A%22%3Cdiv%20class%3D%5C%22csl-bib-body%5C%22%20style%3D%5C%22line-height%3A%202%3B%20padding-left%3A%202em%3B%20text-indent%3A-2em%3B%5C%22%3E%5Cn%20%20%3Cdiv%20class%3D%5C%22csl-entry%5C%22%3EKarim%2C%20M.%20E.%2C%20Walenstein%2C%20A.%2C%20Lakhotia%2C%20A.%2C%20%26amp%3B%20Parida%2C%20L.%20%282005%29.%20Malware%20phylogeny%20generation%20using%20permutations%20of%20code.%20%3Ci%3EJournal%20in%20Computer%20Virology%3C%5C%2Fi%3E%2C%20%3Ci%3E1%3C%5C%2Fi%3E%281%26%23x2013%3B2%29%2C%2013%26%23x2013%3B23.%20%3Ca%20href%3D%27https%3A%5C%2F%5C%2Fdoi.org%5C%2F10.1007%5C%2Fs11416-005-0002-9%27%3Ehttps%3A%5C%2F%5C%2Fdoi.org%5C%2F10.1007%5C%2Fs11416-005-0002-9%3C%5C%2Fa%3E%20%3Ca%20title%3D%27Cite%20in%20RIS%20Format%27%20class%3D%27zp-CiteRIS%27%20href%3D%27http%3A%5C%2F%5C%2Fulsrl.org%5C%2Fwp-content%5C%2Fplugins%5C%2Fzotpress%5C%2Flib%5C%2Frequest%5C%2Frequest.cite.php%3Fapi_user_id%3D136048%26amp%3Bitem_key%3DQHRX3Q6K%27%3ECite%3C%5C%2Fa%3E%20%20%3Ca%20title%3D%27Download%27%20class%3D%27zp-DownloadURL%27%20href%3D%27http%3A%5C%2F%5C%2Fulsrl.org%5C%2Fwp-content%5C%2Fplugins%5C%2Fzotpress%5C%2Flib%5C%2Frequest%5C%2Frequest.dl.php%3Fapi_user_id%3D136048%26amp%3Bdlkey%3DXJH48JR6%26amp%3Bcontent_type%3Dapplication%5C%2Fpdf%27%3EDownload%3C%5C%2Fa%3E%3C%5C%2Fdiv%3E%5Cn%3C%5C%2Fdiv%3E%22%2C%22data%22%3A%7B%22itemType%22%3A%22journalArticle%22%2C%22title%22%3A%22Malware%20phylogeny%20generation%20using%20permutations%20of%20code%22%2C%22creators%22%3A%5B%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22Md%20Enamul%22%2C%22lastName%22%3A%22Karim%22%7D%2C%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22Andrew%22%2C%22lastName%22%3A%22Walenstein%22%7D%2C%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22Arun%22%2C%22lastName%22%3A%22Lakhotia%22%7D%2C%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22Laxmi%22%2C%22lastName%22%3A%22Parida%22%7D%5D%2C%22abstractNote%22%3A%22Malicious%20programs%2C%20such%20as%20viruses%20and%20worms%2C%20are%20frequently%20related%20to%20previous%20programs%20through%20evolutionary%20relationships.%20Discovering%20those%20relationships%20and%20constructing%20a%20phylogeny%20model%20is%20expected%20to%20be%20helpful%20for%20analyzing%20new%20malware%20and%20for%20establishing%20a%20principled%20naming%20scheme.%20Matching%20permutations%20of%20code%20may%20help%20build%20better%20models%20in%20cases%20where%20malware%20evolution%20does%20not%20keep%20things%20in%20the%20same%20order.%20We%20describe%20methods%20for%20constructing%20phylogeny%20models%20that%20uses%20features%20called%20n-perms%20to%20match%20possibly%20permuted%20codes.%20An%20experiment%20was%20performed%20to%20compare%20the%20relative%20effectiveness%20of%20vector%20similarity%20measures%20using%20n-perms%20and%20n-grams%20when%20comparing%20permuted%20variants%20of%20programs.%20The%20similarity%20measures%20using%20n-perms%20maintained%20a%20greater%20separation%20between%20the%20similarity%20scores%20of%20permuted%20families%20of%20specimens%20versus%20unrelated%20specimens.%20A%20subsequent%20study%20using%20a%20tree%20generated%20through%20n-perms%20suggests%20that%20phylogeny%20models%20based%20on%20n-perms%20may%20help%20forensic%20analysts%20investigate%20new%20specimens%2C%20and%20assist%20in%20reconciling%20malware%20naming%20inconsistencies%22%2C%22date%22%3A%222005%5C%2F11%5C%2F01%22%2C%22language%22%3A%22en%22%2C%22DOI%22%3A%2210.1007%5C%2Fs11416-005-0002-9%22%2C%22ISSN%22%3A%221772-9890%2C%201772-9904%22%2C%22url%22%3A%22http%3A%5C%2F%5C%2Flink.springer.com%5C%2Farticle%5C%2F10.1007%5C%2Fs11416-005-0002-9%22%2C%22collections%22%3A%5B%22SRRJ7DPN%22%5D%2C%22dateModified%22%3A%222014-01-06T20%3A35%3A21Z%22%7D%7D%2C%7B%22key%22%3A%223EUDWV47%22%2C%22library%22%3A%7B%22id%22%3A136048%7D%2C%22meta%22%3A%7B%22creatorSummary%22%3A%22Lakhotia%20et%20al.%22%2C%22parsedDate%22%3A%222013-08-01%22%2C%22numChildren%22%3A2%7D%2C%22bib%22%3A%22%3Cdiv%20class%3D%5C%22csl-bib-body%5C%22%20style%3D%5C%22line-height%3A%202%3B%20padding-left%3A%202em%3B%20text-indent%3A-2em%3B%5C%22%3E%5Cn%20%20%3Cdiv%20class%3D%5C%22csl-entry%5C%22%3ELakhotia%2C%20A.%2C%20Walenstein%2C%20A.%2C%20Miles%2C%20C.%2C%20%26amp%3B%20Singh%2C%20A.%20%282013%29.%20VILO%3A%20a%20rapid%20learning%20nearest-neighbor%20classifier%20for%20malware%20triage.%20%3Ci%3EJournal%20of%20Computer%20Virology%20and%20Hacking%20Techniques%3C%5C%2Fi%3E%2C%20%3Ci%3E9%3C%5C%2Fi%3E%283%29%2C%20109%26%23x2013%3B123.%20%3Ca%20href%3D%27https%3A%5C%2F%5C%2Fdoi.org%5C%2F10.1007%5C%2Fs11416-013-0178-3%27%3Ehttps%3A%5C%2F%5C%2Fdoi.org%5C%2F10.1007%5C%2Fs11416-013-0178-3%3C%5C%2Fa%3E%20%3Ca%20title%3D%27Cite%20in%20RIS%20Format%27%20class%3D%27zp-CiteRIS%27%20href%3D%27http%3A%5C%2F%5C%2Fulsrl.org%5C%2Fwp-content%5C%2Fplugins%5C%2Fzotpress%5C%2Flib%5C%2Frequest%5C%2Frequest.cite.php%3Fapi_user_id%3D136048%26amp%3Bitem_key%3D3EUDWV47%27%3ECite%3C%5C%2Fa%3E%20%20%3Ca%20title%3D%27Download%27%20class%3D%27zp-DownloadURL%27%20href%3D%27http%3A%5C%2F%5C%2Fulsrl.org%5C%2Fwp-content%5C%2Fplugins%5C%2Fzotpress%5C%2Flib%5C%2Frequest%5C%2Frequest.dl.php%3Fapi_user_id%3D136048%26amp%3Bdlkey%3DMU3BEG6U%26amp%3Bcontent_type%3Dapplication%5C%2Fpdf%27%3EDownload%3C%5C%2Fa%3E%3C%5C%2Fdiv%3E%5Cn%3C%5C%2Fdiv%3E%22%2C%22data%22%3A%7B%22itemType%22%3A%22journalArticle%22%2C%22title%22%3A%22VILO%3A%20a%20rapid%20learning%20nearest-neighbor%20classifier%20for%20malware%20triage%22%2C%22creators%22%3A%5B%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22Arun%22%2C%22lastName%22%3A%22Lakhotia%22%7D%2C%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22Andrew%22%2C%22lastName%22%3A%22Walenstein%22%7D%2C%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22Craig%22%2C%22lastName%22%3A%22Miles%22%7D%2C%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22Anshuman%22%2C%22lastName%22%3A%22Singh%22%7D%5D%2C%22abstractNote%22%3A%22VILO%20is%20a%20lazy%20learner%20system%20designed%20for%20malware%20classification%20and%20triage.%20It%20implements%20a%20nearest%20neighbor%20%28NN%29%20algorithm%20with%20similarities%20computed%20over%20Term%20Frequency%20TeX%5C%5Ctimes%20Inverse%20Document%20Frequency%20%28TFIDF%29%20weighted%20opcode%20mnemonic%20permutation%20features%20%28N-perms%29.%20Being%20an%20NN-classifier%2C%20VILO%20makes%20minimal%20structural%20assumptions%20about%20class%20boundaries%2C%20and%20thus%20is%20well%20suited%20for%20the%20constantly%20changing%20malware%20population.%20This%20paper%20presents%20an%20extensive%20study%20of%20application%20of%20VILO%20in%20malware%20analysis.%20Our%20experiments%20demonstrate%20that%20%28a%29%20VILO%20is%20a%20rapid%20learner%20of%20malware%20families%2C%20i.e.%2C%20VILO%5Cu2019s%20learning%20curve%20stabilizes%20at%20high%20accuracies%20quickly%20%28training%20on%20less%20than%2020%20variants%20per%20family%20is%20sufficient%29%3B%20%28b%29%20similarity%20scores%20derived%20from%20TDIDF%20weighted%20features%20should%20primarily%20be%20treated%20as%20ordinal%20measurements%3B%20and%20%28c%29%20VILO%20with%20N-perm%20feature%20vectors%20outperforms%20traditional%20N-gram%20feature%20vectors%20when%20used%20to%20classify%20real-world%20malware%20into%20their%20respective%20families.%22%2C%22date%22%3A%222013%5C%2F08%5C%2F01%22%2C%22language%22%3A%22en%22%2C%22DOI%22%3A%2210.1007%5C%2Fs11416-013-0178-3%22%2C%22ISSN%22%3A%221772-9890%2C%202263-8733%22%2C%22url%22%3A%22http%3A%5C%2F%5C%2Flink.springer.com%5C%2Farticle%5C%2F10.1007%5C%2Fs11416-013-0178-3%22%2C%22collections%22%3A%5B%22SRRJ7DPN%22%2C%22JIJ3KRFV%22%5D%2C%22dateModified%22%3A%222014-01-06T20%3A34%3A35Z%22%7D%7D%2C%7B%22key%22%3A%226WSNSU37%22%2C%22library%22%3A%7B%22id%22%3A136048%7D%2C%22meta%22%3A%7B%22creatorSummary%22%3A%22Miles%20et%20al.%22%2C%22parsedDate%22%3A%222012-08-01%22%2C%22numChildren%22%3A2%7D%2C%22bib%22%3A%22%3Cdiv%20class%3D%5C%22csl-bib-body%5C%22%20style%3D%5C%22line-height%3A%202%3B%20padding-left%3A%202em%3B%20text-indent%3A-2em%3B%5C%22%3E%5Cn%20%20%3Cdiv%20class%3D%5C%22csl-entry%5C%22%3EMiles%2C%20C.%2C%20Lakhotia%2C%20A.%2C%20%26amp%3B%20Walenstein%2C%20A.%20%282012%29.%20In%20situ%20reuse%20of%20logically%20extracted%20functional%20components.%20%3Ci%3EJournal%20in%20Computer%20Virology%3C%5C%2Fi%3E%2C%20%3Ci%3E8%3C%5C%2Fi%3E%283%29%2C%2073%26%23x2013%3B84.%20%3Ca%20href%3D%27https%3A%5C%2F%5C%2Fdoi.org%5C%2F10.1007%5C%2Fs11416-012-0167-y%27%3Ehttps%3A%5C%2F%5C%2Fdoi.org%5C%2F10.1007%5C%2Fs11416-012-0167-y%3C%5C%2Fa%3E%20%3Ca%20title%3D%27Cite%20in%20RIS%20Format%27%20class%3D%27zp-CiteRIS%27%20href%3D%27http%3A%5C%2F%5C%2Fulsrl.org%5C%2Fwp-content%5C%2Fplugins%5C%2Fzotpress%5C%2Flib%5C%2Frequest%5C%2Frequest.cite.php%3Fapi_user_id%3D136048%26amp%3Bitem_key%3D6WSNSU37%27%3ECite%3C%5C%2Fa%3E%20%20%3Ca%20title%3D%27Download%27%20class%3D%27zp-DownloadURL%27%20href%3D%27http%3A%5C%2F%5C%2Fulsrl.org%5C%2Fwp-content%5C%2Fplugins%5C%2Fzotpress%5C%2Flib%5C%2Frequest%5C%2Frequest.dl.php%3Fapi_user_id%3D136048%26amp%3Bdlkey%3DDWMRH4BA%26amp%3Bcontent_type%3Dapplication%5C%2Fpdf%27%3EDownload%3C%5C%2Fa%3E%3C%5C%2Fdiv%3E%5Cn%3C%5C%2Fdiv%3E%22%2C%22data%22%3A%7B%22itemType%22%3A%22journalArticle%22%2C%22title%22%3A%22In%20situ%20reuse%20of%20logically%20extracted%20functional%20components%22%2C%22creators%22%3A%5B%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22Craig%22%2C%22lastName%22%3A%22Miles%22%7D%2C%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22Arun%22%2C%22lastName%22%3A%22Lakhotia%22%7D%2C%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22Andrew%22%2C%22lastName%22%3A%22Walenstein%22%7D%5D%2C%22abstractNote%22%3A%22Programmers%20often%20identify%20functionality%20within%20a%20compiled%20program%20that%20they%20wish%20they%20could%20reuse%20in%20a%20manner%20other%20than%20that%20intended%20by%20the%20program%5Cu2019s%20original%20authors.%20The%20traditional%20approach%20to%20reusing%20pre-existing%20functionality%20contained%20within%20a%20binary%20executable%20is%20that%20of%20physical%20extraction%3B%20that%20is%2C%20the%20recreation%20of%20the%20desired%20functionality%20in%20some%20executable%20module%20separate%20from%20the%20program%20in%20which%20it%20was%20originally%20found.%20Towards%20overcoming%20the%20inherent%20limitations%20of%20physical%20extraction%2C%20we%20propose%20in%20situ%20reuse%20of%20logically%20extracted%20functional%20components.%20Logical%20extraction%20consists%20of%20identifying%20and%20retaining%20information%20about%20the%20locations%20of%20the%20elements%20comprising%20the%20functional%20component%20within%20its%20original%20program%2C%20and%20in%20situ%20reuse%20is%20the%20process%20of%20driving%20the%20original%20program%20to%20execute%20the%20logically%20extracted%20functional%20component%20in%20whatever%20manner%20the%20new%20programmer%20sees%20fit.%22%2C%22date%22%3A%222012%5C%2F08%5C%2F01%22%2C%22language%22%3A%22en%22%2C%22DOI%22%3A%2210.1007%5C%2Fs11416-012-0167-y%22%2C%22ISSN%22%3A%221772-9890%2C%201772-9904%22%2C%22url%22%3A%22http%3A%5C%2F%5C%2Flink.springer.com%5C%2Farticle%5C%2F10.1007%5C%2Fs11416-012-0167-y%22%2C%22collections%22%3A%5B%22SRRJ7DPN%22%5D%2C%22dateModified%22%3A%222014-01-06T20%3A33%3A22Z%22%7D%7D%5D%7D
Harman, M., Lakhotia, A., & Binkley, D. (2006). Theory and algorithms for slicing unstructured programs. Information and Software Technology, 48(7), 549–565. https://doi.org/10.1016/j.infsof.2005.06.001 Cite Download
Chan, T. W., & Lakhotia, A. (1998). Debugging program failure exhibited by voluminous data. Journal of Software Maintenance: Research and Practice, 10(2), 111–150. https://doi.org/10.1002/(SICI)1096-908X(199803/04)10:2<111::AID-SMR167>3.0.CO;2-8 Cite
Lakhotia, A., & Deprez, J.-C. (1998). Restructuring programs by tucking statements into functions. Information and Software Technology, 40(11–12), 677–689. https://doi.org/10.1016/S0950-5849(98)00091-3 Cite Download
Lakhotia, A., Boccardo, D. R., Singh, A., & Jr, A. M. (2010). Context-sensitive analysis without calling-context. Higher-Order and Symbolic Computation, 23(3), 275–313. https://doi.org/10.1007/s10990-011-9080-1 Cite
Lakhotia, A., Kumar, E. U., & Venable, M. (2005). A method for detecting obfuscated calls in malicious binaries. IEEE Transactions on Software Engineering, 31(11), 955–968. https://doi.org/10.1109/TSE.2005.120 Cite Download
Chouchane, R., Stakhanova, N., Walenstein, A., & Lakhotia, A. (2013). Detecting machine-morphed malware variants via engine attribution. Journal of Computer Virology and Hacking Techniques, 9(3), 137–157. https://doi.org/10.1007/s11416-013-0183-6 Cite Download
Hayes, M., Walenstein, A., & Lakhotia, A. (2009). Evaluation of malware phylogeny modelling systems using automated variant generation. Journal in Computer Virology, 5(4), 335–343. https://doi.org/10.1007/s11416-008-0100-6 Cite Download
Karim, M. E., Walenstein, A., Lakhotia, A., & Parida, L. (2005). Malware phylogeny generation using permutations of code. Journal in Computer Virology, 1(1–2), 13–23. https://doi.org/10.1007/s11416-005-0002-9 Cite Download
Lakhotia, A., Walenstein, A., Miles, C., & Singh, A. (2013). VILO: a rapid learning nearest-neighbor classifier for malware triage. Journal of Computer Virology and Hacking Techniques, 9(3), 109–123. https://doi.org/10.1007/s11416-013-0178-3 Cite Download
Miles, C., Lakhotia, A., & Walenstein, A. (2012). In situ reuse of logically extracted functional components. Journal in Computer Virology, 8(3), 73–84. https://doi.org/10.1007/s11416-012-0167-y Cite Download
Theses and Dissertations
136048
E736XXUM
apa
50
1
1
639
http://ulsrl.org/wp-content/plugins/zotpress/
%7B%22status%22%3A%22success%22%2C%22updateneeded%22%3Afalse%2C%22instance%22%3A%22zotpress-17ec52109e4878d09a977954871cd77c%22%2C%22meta%22%3A%7B%22request_last%22%3A0%2C%22request_next%22%3A0%2C%22used_cache%22%3Atrue%7D%2C%22data%22%3A%5B%7B%22key%22%3A%22ASSHG9X8%22%2C%22library%22%3A%7B%22id%22%3A136048%7D%2C%22meta%22%3A%7B%22creatorSummary%22%3A%22Notani%22%2C%22parsedDate%22%3A%222009%22%2C%22numChildren%22%3A1%7D%2C%22bib%22%3A%22%3Cdiv%20class%3D%5C%22csl-bib-body%5C%22%20style%3D%5C%22line-height%3A%202%3B%20padding-left%3A%202em%3B%20text-indent%3A-2em%3B%5C%22%3E%5Cn%20%20%3Cdiv%20class%3D%5C%22csl-entry%5C%22%3ENotani%2C%20V.%20%282009%29.%20%3Ci%3EBehavioral%20Analysis%20of%20Malware%3C%5C%2Fi%3E%20%28Bachelor%26%23x2019%3Bs%20Thesis%29.%20BIRLA%20INSTITUTE%20OF%20TECHNOLOGY.%20Retrieved%20from%20%3Ca%20href%3D%27http%3A%5C%2F%5C%2Fwww.cacs.louisiana.edu%5C%2F~arun%5C%2Fpapers%5C%2F2013-vivek-notani-thesis.pdf%27%3Ehttp%3A%5C%2F%5C%2Fwww.cacs.louisiana.edu%5C%2F~arun%5C%2Fpapers%5C%2F2013-vivek-notani-thesis.pdf%3C%5C%2Fa%3E%20%3Ca%20title%3D%27Cite%20in%20RIS%20Format%27%20class%3D%27zp-CiteRIS%27%20href%3D%27http%3A%5C%2F%5C%2Fulsrl.org%5C%2Fwp-content%5C%2Fplugins%5C%2Fzotpress%5C%2Flib%5C%2Frequest%5C%2Frequest.cite.php%3Fapi_user_id%3D136048%26amp%3Bitem_key%3DASSHG9X8%27%3ECite%3C%5C%2Fa%3E%20%20%3Ca%20title%3D%27Download%27%20class%3D%27zp-DownloadURL%27%20href%3D%27http%3A%5C%2F%5C%2Fulsrl.org%5C%2Fwp-content%5C%2Fplugins%5C%2Fzotpress%5C%2Flib%5C%2Frequest%5C%2Frequest.dl.php%3Fapi_user_id%3D136048%26amp%3Bdlkey%3D324NNWFR%26amp%3Bcontent_type%3Dapplication%5C%2Fpdf%27%3EDownload%3C%5C%2Fa%3E%3C%5C%2Fdiv%3E%5Cn%3C%5C%2Fdiv%3E%22%2C%22data%22%3A%7B%22itemType%22%3A%22thesis%22%2C%22title%22%3A%22Behavioral%20Analysis%20of%20Malware%22%2C%22creators%22%3A%5B%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22Vivek%22%2C%22lastName%22%3A%22Notani%22%7D%5D%2C%22abstractNote%22%3A%22%22%2C%22thesisType%22%3A%22Bachelor%27s%20Thesis%22%2C%22university%22%3A%22BIRLA%20INSTITUTE%20OF%20TECHNOLOGY%22%2C%22date%22%3A%222009%22%2C%22language%22%3A%22%22%2C%22url%22%3A%22http%3A%5C%2F%5C%2Fwww.cacs.louisiana.edu%5C%2F~arun%5C%2Fpapers%5C%2F2013-vivek-notani-thesis.pdf%22%2C%22collections%22%3A%5B%22E736XXUM%22%5D%2C%22dateModified%22%3A%222014-01-20T20%3A56%3A51Z%22%7D%7D%2C%7B%22key%22%3A%22ZQ4JT9FG%22%2C%22library%22%3A%7B%22id%22%3A136048%7D%2C%22meta%22%3A%7B%22creatorSummary%22%3A%22Nandigam%22%2C%22parsedDate%22%3A%221995%22%2C%22numChildren%22%3A1%7D%2C%22bib%22%3A%22%3Cdiv%20class%3D%5C%22csl-bib-body%5C%22%20style%3D%5C%22line-height%3A%202%3B%20padding-left%3A%202em%3B%20text-indent%3A-2em%3B%5C%22%3E%5Cn%20%20%3Cdiv%20class%3D%5C%22csl-entry%5C%22%3ENandigam%2C%20J.%20%281995%29.%20%3Ci%3EA%20measure%20for%20module%20cohesion%3C%5C%2Fi%3E%20%28PhD%20Dissertation%29.%20University%20of%20Louisiana%20at%20Lafayette.%20Retrieved%20from%20%3Ca%20href%3D%27http%3A%5C%2F%5C%2Fciteseerx.ist.psu.edu%5C%2Fviewdoc%5C%2Fdownload%3Fdoi%3D10.1.1.61.6490%26rep%3Drep1%26type%3Dpdf%27%3Ehttp%3A%5C%2F%5C%2Fciteseerx.ist.psu.edu%5C%2Fviewdoc%5C%2Fdownload%3Fdoi%3D10.1.1.61.6490%26rep%3Drep1%26type%3Dpdf%3C%5C%2Fa%3E%20%3Ca%20title%3D%27Cite%20in%20RIS%20Format%27%20class%3D%27zp-CiteRIS%27%20href%3D%27http%3A%5C%2F%5C%2Fulsrl.org%5C%2Fwp-content%5C%2Fplugins%5C%2Fzotpress%5C%2Flib%5C%2Frequest%5C%2Frequest.cite.php%3Fapi_user_id%3D136048%26amp%3Bitem_key%3DZQ4JT9FG%27%3ECite%3C%5C%2Fa%3E%20%20%3Ca%20title%3D%27Download%27%20class%3D%27zp-DownloadURL%27%20href%3D%27http%3A%5C%2F%5C%2Fulsrl.org%5C%2Fwp-content%5C%2Fplugins%5C%2Fzotpress%5C%2Flib%5C%2Frequest%5C%2Frequest.dl.php%3Fapi_user_id%3D136048%26amp%3Bdlkey%3DKMGZM8PH%26amp%3Bcontent_type%3Dapplication%5C%2Fpdf%27%3EDownload%3C%5C%2Fa%3E%3C%5C%2Fdiv%3E%5Cn%3C%5C%2Fdiv%3E%22%2C%22data%22%3A%7B%22itemType%22%3A%22thesis%22%2C%22title%22%3A%22A%20measure%20for%20module%20cohesion%22%2C%22creators%22%3A%5B%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22Jagadeesh%22%2C%22lastName%22%3A%22Nandigam%22%7D%5D%2C%22abstractNote%22%3A%22%22%2C%22thesisType%22%3A%22PhD%20Dissertation%22%2C%22university%22%3A%22University%20of%20Louisiana%20at%20Lafayette%22%2C%22date%22%3A%221995%22%2C%22language%22%3A%22%22%2C%22url%22%3A%22http%3A%5C%2F%5C%2Fciteseerx.ist.psu.edu%5C%2Fviewdoc%5C%2Fdownload%3Fdoi%3D10.1.1.61.6490%26rep%3Drep1%26type%3Dpdf%22%2C%22collections%22%3A%5B%22E736XXUM%22%5D%2C%22dateModified%22%3A%222014-01-20T20%3A53%3A59Z%22%7D%7D%2C%7B%22key%22%3A%22379VK8IG%22%2C%22library%22%3A%7B%22id%22%3A136048%7D%2C%22meta%22%3A%7B%22creatorSummary%22%3A%22Singh%22%2C%22parsedDate%22%3A%222002%22%2C%22numChildren%22%3A1%7D%2C%22bib%22%3A%22%3Cdiv%20class%3D%5C%22csl-bib-body%5C%22%20style%3D%5C%22line-height%3A%202%3B%20padding-left%3A%202em%3B%20text-indent%3A-2em%3B%5C%22%3E%5Cn%20%20%3Cdiv%20class%3D%5C%22csl-entry%5C%22%3ESingh%2C%20P.%20K.%20%282002%29.%20%3Ci%3EA%20Physiological%20Decomposition%20of%20Virus%20and%20Worm%20Programs%3C%5C%2Fi%3E%20%28Master%26%23x2019%3Bs%20thesis%29.%20University%20of%20Louisiana%20at%20Lafayette.%20Retrieved%20from%20%3Ca%20href%3D%27http%3A%5C%2F%5C%2Fwww.megasecurity.org%5C%2Fpapers%5C%2Fmasterthesis.pdf%27%3Ehttp%3A%5C%2F%5C%2Fwww.megasecurity.org%5C%2Fpapers%5C%2Fmasterthesis.pdf%3C%5C%2Fa%3E%20%3Ca%20title%3D%27Cite%20in%20RIS%20Format%27%20class%3D%27zp-CiteRIS%27%20href%3D%27http%3A%5C%2F%5C%2Fulsrl.org%5C%2Fwp-content%5C%2Fplugins%5C%2Fzotpress%5C%2Flib%5C%2Frequest%5C%2Frequest.cite.php%3Fapi_user_id%3D136048%26amp%3Bitem_key%3D379VK8IG%27%3ECite%3C%5C%2Fa%3E%20%20%3Ca%20title%3D%27Download%27%20class%3D%27zp-DownloadURL%27%20href%3D%27http%3A%5C%2F%5C%2Fulsrl.org%5C%2Fwp-content%5C%2Fplugins%5C%2Fzotpress%5C%2Flib%5C%2Frequest%5C%2Frequest.dl.php%3Fapi_user_id%3D136048%26amp%3Bdlkey%3DH8J5HTIM%26amp%3Bcontent_type%3Dapplication%5C%2Fpdf%27%3EDownload%3C%5C%2Fa%3E%3C%5C%2Fdiv%3E%5Cn%3C%5C%2Fdiv%3E%22%2C%22data%22%3A%7B%22itemType%22%3A%22thesis%22%2C%22title%22%3A%22A%20Physiological%20Decomposition%20of%20Virus%20and%20Worm%20Programs%22%2C%22creators%22%3A%5B%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22Prabhat%20Kumar%22%2C%22lastName%22%3A%22Singh%22%7D%5D%2C%22abstractNote%22%3A%22%22%2C%22thesisType%22%3A%22Master%27s%20thesis%22%2C%22university%22%3A%22University%20of%20Louisiana%20at%20Lafayette%22%2C%22date%22%3A%222002%22%2C%22language%22%3A%22%22%2C%22url%22%3A%22http%3A%5C%2F%5C%2Fwww.megasecurity.org%5C%2Fpapers%5C%2Fmasterthesis.pdf%22%2C%22collections%22%3A%5B%22E736XXUM%22%5D%2C%22dateModified%22%3A%222014-01-20T20%3A52%3A43Z%22%7D%7D%2C%7B%22key%22%3A%22B4R54Q7T%22%2C%22library%22%3A%7B%22id%22%3A136048%7D%2C%22meta%22%3A%7B%22creatorSummary%22%3A%22Deprez%22%2C%22parsedDate%22%3A%221997%22%2C%22numChildren%22%3A1%7D%2C%22bib%22%3A%22%3Cdiv%20class%3D%5C%22csl-bib-body%5C%22%20style%3D%5C%22line-height%3A%202%3B%20padding-left%3A%202em%3B%20text-indent%3A-2em%3B%5C%22%3E%5Cn%20%20%3Cdiv%20class%3D%5C%22csl-entry%5C%22%3EDeprez%2C%20J.-C.%20%281997%29.%20%3Ci%3EDetecting%20Ripple%20Effects%20of%20Program%20Modifications%20on%20a%20Software%20System%26%23x2019%3Bs%20Functionality%3C%5C%2Fi%3E%20%28PhD%20Dissertation%29.%20University%20of%20Louisiana%20at%20Lafayette.%20Retrieved%20from%20%3Ca%20href%3D%27http%3A%5C%2F%5C%2Fwww.cacs.louisiana.edu%5C%2F~arun%5C%2Fpapers%5C%2F2003-jean-christophe-dissertation.pdf%27%3Ehttp%3A%5C%2F%5C%2Fwww.cacs.louisiana.edu%5C%2F~arun%5C%2Fpapers%5C%2F2003-jean-christophe-dissertation.pdf%3C%5C%2Fa%3E%20%3Ca%20title%3D%27Cite%20in%20RIS%20Format%27%20class%3D%27zp-CiteRIS%27%20href%3D%27http%3A%5C%2F%5C%2Fulsrl.org%5C%2Fwp-content%5C%2Fplugins%5C%2Fzotpress%5C%2Flib%5C%2Frequest%5C%2Frequest.cite.php%3Fapi_user_id%3D136048%26amp%3Bitem_key%3DB4R54Q7T%27%3ECite%3C%5C%2Fa%3E%20%20%3Ca%20title%3D%27Download%27%20class%3D%27zp-DownloadURL%27%20href%3D%27http%3A%5C%2F%5C%2Fulsrl.org%5C%2Fwp-content%5C%2Fplugins%5C%2Fzotpress%5C%2Flib%5C%2Frequest%5C%2Frequest.dl.php%3Fapi_user_id%3D136048%26amp%3Bdlkey%3DD27HIAMF%26amp%3Bcontent_type%3Dapplication%5C%2Fpdf%27%3EDownload%3C%5C%2Fa%3E%3C%5C%2Fdiv%3E%5Cn%3C%5C%2Fdiv%3E%22%2C%22data%22%3A%7B%22itemType%22%3A%22thesis%22%2C%22title%22%3A%22Detecting%20Ripple%20Effects%20of%20Program%20Modifications%20on%20a%20Software%20System%5Cu2019s%20Functionality%22%2C%22creators%22%3A%5B%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22Jean-Christophe%22%2C%22lastName%22%3A%22Deprez%22%7D%5D%2C%22abstractNote%22%3A%22%22%2C%22thesisType%22%3A%22PhD%20Dissertation%22%2C%22university%22%3A%22University%20of%20Louisiana%20at%20Lafayette%22%2C%22date%22%3A%2212%5C%2F1997%22%2C%22language%22%3A%22%22%2C%22url%22%3A%22http%3A%5C%2F%5C%2Fwww.cacs.louisiana.edu%5C%2F~arun%5C%2Fpapers%5C%2F2003-jean-christophe-dissertation.pdf%22%2C%22collections%22%3A%5B%22E736XXUM%22%5D%2C%22dateModified%22%3A%222014-01-20T20%3A52%3A08Z%22%7D%7D%2C%7B%22key%22%3A%22GZIT52J5%22%2C%22library%22%3A%7B%22id%22%3A136048%7D%2C%22meta%22%3A%7B%22creatorSummary%22%3A%22Mohammed%22%2C%22numChildren%22%3A1%7D%2C%22bib%22%3A%22%3Cdiv%20class%3D%5C%22csl-bib-body%5C%22%20style%3D%5C%22line-height%3A%202%3B%20padding-left%3A%202em%3B%20text-indent%3A-2em%3B%5C%22%3E%5Cn%20%20%3Cdiv%20class%3D%5C%22csl-entry%5C%22%3EMohammed%2C%20M.%20%28n.d.%29.%20%3Ci%3EZeroing%20in%20on%20Metamorphic%20Computer%20Viruses%3C%5C%2Fi%3E%20%28Master%26%23x2019%3Bs%20thesis%29.%20University%20of%20Louisiana%20at%20Lafayette.%20Retrieved%20from%20%3Ca%20href%3D%27http%3A%5C%2F%5C%2Fwww.cacs.louisiana.edu%5C%2F~arun%5C%2Fpapers%5C%2Fmoin-mohammed-thesis-dec2003.pdf%27%3Ehttp%3A%5C%2F%5C%2Fwww.cacs.louisiana.edu%5C%2F~arun%5C%2Fpapers%5C%2Fmoin-mohammed-thesis-dec2003.pdf%3C%5C%2Fa%3E%20%3Ca%20title%3D%27Cite%20in%20RIS%20Format%27%20class%3D%27zp-CiteRIS%27%20href%3D%27http%3A%5C%2F%5C%2Fulsrl.org%5C%2Fwp-content%5C%2Fplugins%5C%2Fzotpress%5C%2Flib%5C%2Frequest%5C%2Frequest.cite.php%3Fapi_user_id%3D136048%26amp%3Bitem_key%3DGZIT52J5%27%3ECite%3C%5C%2Fa%3E%20%20%3Ca%20title%3D%27Download%27%20class%3D%27zp-DownloadURL%27%20href%3D%27http%3A%5C%2F%5C%2Fulsrl.org%5C%2Fwp-content%5C%2Fplugins%5C%2Fzotpress%5C%2Flib%5C%2Frequest%5C%2Frequest.dl.php%3Fapi_user_id%3D136048%26amp%3Bdlkey%3DU3ZUP4RU%26amp%3Bcontent_type%3Dapplication%5C%2Fpdf%27%3EDownload%3C%5C%2Fa%3E%3C%5C%2Fdiv%3E%5Cn%3C%5C%2Fdiv%3E%22%2C%22data%22%3A%7B%22itemType%22%3A%22thesis%22%2C%22title%22%3A%22Zeroing%20in%20on%20Metamorphic%20Computer%20Viruses%22%2C%22creators%22%3A%5B%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22Moinuddin%22%2C%22lastName%22%3A%22Mohammed%22%7D%5D%2C%22abstractNote%22%3A%22%22%2C%22thesisType%22%3A%22Master%27s%20thesis%22%2C%22university%22%3A%22University%20of%20Louisiana%20at%20Lafayette%22%2C%22date%22%3A%22%22%2C%22language%22%3A%22%22%2C%22url%22%3A%22http%3A%5C%2F%5C%2Fwww.cacs.louisiana.edu%5C%2F~arun%5C%2Fpapers%5C%2Fmoin-mohammed-thesis-dec2003.pdf%22%2C%22collections%22%3A%5B%22E736XXUM%22%2C%22APED9CV8%22%5D%2C%22dateModified%22%3A%222014-01-20T20%3A49%3A59Z%22%7D%7D%2C%7B%22key%22%3A%22UKKSFIGB%22%2C%22library%22%3A%7B%22id%22%3A136048%7D%2C%22meta%22%3A%7B%22creatorSummary%22%3A%22Kumar%22%2C%22parsedDate%22%3A%222004%22%2C%22numChildren%22%3A1%7D%2C%22bib%22%3A%22%3Cdiv%20class%3D%5C%22csl-bib-body%5C%22%20style%3D%5C%22line-height%3A%202%3B%20padding-left%3A%202em%3B%20text-indent%3A-2em%3B%5C%22%3E%5Cn%20%20%3Cdiv%20class%3D%5C%22csl-entry%5C%22%3EKumar%2C%20E.%20U.%20%282004%29.%20%3Ci%3EAbstract%20Stack%20Graph%20as%20a%20Representation%20to%20Detect%20Obfuscated%20Calls%20in%20Binaries%3C%5C%2Fi%3E%20%28Master%26%23x2019%3Bs%20thesis%29.%20University%20of%20Louisiana%20at%20Lafayette.%20Retrieved%20from%20%3Ca%20href%3D%27http%3A%5C%2F%5C%2Fwww.cacs.louisiana.edu%5C%2F~arun%5C%2Fpapers%5C%2Fuday-kumar-thesis-dec2004.pdf%27%3Ehttp%3A%5C%2F%5C%2Fwww.cacs.louisiana.edu%5C%2F~arun%5C%2Fpapers%5C%2Fuday-kumar-thesis-dec2004.pdf%3C%5C%2Fa%3E%20%3Ca%20title%3D%27Cite%20in%20RIS%20Format%27%20class%3D%27zp-CiteRIS%27%20href%3D%27http%3A%5C%2F%5C%2Fulsrl.org%5C%2Fwp-content%5C%2Fplugins%5C%2Fzotpress%5C%2Flib%5C%2Frequest%5C%2Frequest.cite.php%3Fapi_user_id%3D136048%26amp%3Bitem_key%3DUKKSFIGB%27%3ECite%3C%5C%2Fa%3E%20%20%3Ca%20title%3D%27Download%27%20class%3D%27zp-DownloadURL%27%20href%3D%27http%3A%5C%2F%5C%2Fulsrl.org%5C%2Fwp-content%5C%2Fplugins%5C%2Fzotpress%5C%2Flib%5C%2Frequest%5C%2Frequest.dl.php%3Fapi_user_id%3D136048%26amp%3Bdlkey%3D5DNV5GA3%26amp%3Bcontent_type%3Dapplication%5C%2Fpdf%27%3EDownload%3C%5C%2Fa%3E%3C%5C%2Fdiv%3E%5Cn%3C%5C%2Fdiv%3E%22%2C%22data%22%3A%7B%22itemType%22%3A%22thesis%22%2C%22title%22%3A%22Abstract%20Stack%20Graph%20as%20a%20Representation%20to%20Detect%20Obfuscated%20Calls%20in%20Binaries%22%2C%22creators%22%3A%5B%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22Eric%20U.%22%2C%22lastName%22%3A%22Kumar%22%7D%5D%2C%22abstractNote%22%3A%22%22%2C%22thesisType%22%3A%22Master%27s%20thesis%22%2C%22university%22%3A%22University%20of%20Louisiana%20at%20Lafayette%22%2C%22date%22%3A%2212%5C%2F2004%22%2C%22language%22%3A%22%22%2C%22url%22%3A%22http%3A%5C%2F%5C%2Fwww.cacs.louisiana.edu%5C%2F~arun%5C%2Fpapers%5C%2Fuday-kumar-thesis-dec2004.pdf%22%2C%22collections%22%3A%5B%22E736XXUM%22%5D%2C%22dateModified%22%3A%222014-01-20T20%3A48%3A10Z%22%7D%7D%2C%7B%22key%22%3A%22MWRG6S8X%22%2C%22library%22%3A%7B%22id%22%3A136048%7D%2C%22meta%22%3A%7B%22creatorSummary%22%3A%22Mathur%22%2C%22parsedDate%22%3A%222006%22%2C%22numChildren%22%3A1%7D%2C%22bib%22%3A%22%3Cdiv%20class%3D%5C%22csl-bib-body%5C%22%20style%3D%5C%22line-height%3A%202%3B%20padding-left%3A%202em%3B%20text-indent%3A-2em%3B%5C%22%3E%5Cn%20%20%3Cdiv%20class%3D%5C%22csl-entry%5C%22%3EMathur%2C%20R.%20%282006%29.%20%3Ci%3ENormalizing%20metamorphic%20malware%20using%20term%20rewriting%3C%5C%2Fi%3E%20%28Master%26%23x2019%3Bs%20thesis%29.%20University%20of%20Louisiana%20at%20Lafayette.%20Retrieved%20from%20%3Ca%20href%3D%27http%3A%5C%2F%5C%2Fweb.cacs.louisiana.edu%5C%2F~arun%5C%2Fpapers%5C%2F2006-rachit-thesis.pdf%27%3Ehttp%3A%5C%2F%5C%2Fweb.cacs.louisiana.edu%5C%2F~arun%5C%2Fpapers%5C%2F2006-rachit-thesis.pdf%3C%5C%2Fa%3E%20%3Ca%20title%3D%27Cite%20in%20RIS%20Format%27%20class%3D%27zp-CiteRIS%27%20href%3D%27http%3A%5C%2F%5C%2Fulsrl.org%5C%2Fwp-content%5C%2Fplugins%5C%2Fzotpress%5C%2Flib%5C%2Frequest%5C%2Frequest.cite.php%3Fapi_user_id%3D136048%26amp%3Bitem_key%3DMWRG6S8X%27%3ECite%3C%5C%2Fa%3E%20%20%3Ca%20title%3D%27Download%27%20class%3D%27zp-DownloadURL%27%20href%3D%27http%3A%5C%2F%5C%2Fulsrl.org%5C%2Fwp-content%5C%2Fplugins%5C%2Fzotpress%5C%2Flib%5C%2Frequest%5C%2Frequest.dl.php%3Fapi_user_id%3D136048%26amp%3Bdlkey%3DMVB2TERZ%26amp%3Bcontent_type%3Dapplication%5C%2Fpdf%27%3EDownload%3C%5C%2Fa%3E%3C%5C%2Fdiv%3E%5Cn%3C%5C%2Fdiv%3E%22%2C%22data%22%3A%7B%22itemType%22%3A%22thesis%22%2C%22title%22%3A%22Normalizing%20metamorphic%20malware%20using%20term%20rewriting%22%2C%22creators%22%3A%5B%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22Rachit%22%2C%22lastName%22%3A%22Mathur%22%7D%5D%2C%22abstractNote%22%3A%22%22%2C%22thesisType%22%3A%22Master%27s%20thesis%22%2C%22university%22%3A%22University%20of%20Louisiana%20at%20Lafayette%22%2C%22date%22%3A%222006%22%2C%22language%22%3A%22%22%2C%22url%22%3A%22http%3A%5C%2F%5C%2Fweb.cacs.louisiana.edu%5C%2F~arun%5C%2Fpapers%5C%2F2006-rachit-thesis.pdf%22%2C%22collections%22%3A%5B%22E736XXUM%22%2C%22APED9CV8%22%5D%2C%22dateModified%22%3A%222014-01-20T20%3A45%3A24Z%22%7D%7D%2C%7B%22key%22%3A%22TVIHGKPK%22%2C%22library%22%3A%7B%22id%22%3A136048%7D%2C%22meta%22%3A%7B%22creatorSummary%22%3A%22Puntambekar%22%2C%22parsedDate%22%3A%222006%22%2C%22numChildren%22%3A1%7D%2C%22bib%22%3A%22%3Cdiv%20class%3D%5C%22csl-bib-body%5C%22%20style%3D%5C%22line-height%3A%202%3B%20padding-left%3A%202em%3B%20text-indent%3A-2em%3B%5C%22%3E%5Cn%20%20%3Cdiv%20class%3D%5C%22csl-entry%5C%22%3EPuntambekar%2C%20A.%20%282006%29.%20%3Ci%3ETerrain%20modeling%20and%20obstacle%20detection%20for%20unmanned%20autonomous%20ground%20robots%3C%5C%2Fi%3E%20%28Master%26%23x2019%3Bs%20thesis%29.%20University%20of%20Louisiana%20at%20Lafayette.%20Retrieved%20from%20%3Ca%20href%3D%27http%3A%5C%2F%5C%2Fcajunbot.com%5C%2Fpapers%5C%2F2006-amit-thesis_-_terrain_mapping_and_obstacle_detection_for_unmanned_autonomous_ground_robots_without_sensor_stabilization.pdf%27%3Ehttp%3A%5C%2F%5C%2Fcajunbot.com%5C%2Fpapers%5C%2F2006-amit-thesis_-_terrain_mapping_and_obstacle_detection_for_unmanned_autonomous_ground_robots_without_sensor_stabilization.pdf%3C%5C%2Fa%3E%20%3Ca%20title%3D%27Cite%20in%20RIS%20Format%27%20class%3D%27zp-CiteRIS%27%20href%3D%27http%3A%5C%2F%5C%2Fulsrl.org%5C%2Fwp-content%5C%2Fplugins%5C%2Fzotpress%5C%2Flib%5C%2Frequest%5C%2Frequest.cite.php%3Fapi_user_id%3D136048%26amp%3Bitem_key%3DTVIHGKPK%27%3ECite%3C%5C%2Fa%3E%20%20%3Ca%20title%3D%27Download%27%20class%3D%27zp-DownloadURL%27%20href%3D%27http%3A%5C%2F%5C%2Fulsrl.org%5C%2Fwp-content%5C%2Fplugins%5C%2Fzotpress%5C%2Flib%5C%2Frequest%5C%2Frequest.dl.php%3Fapi_user_id%3D136048%26amp%3Bdlkey%3DDNXGA7X3%26amp%3Bcontent_type%3Dapplication%5C%2Fpdf%27%3EDownload%3C%5C%2Fa%3E%3C%5C%2Fdiv%3E%5Cn%3C%5C%2Fdiv%3E%22%2C%22data%22%3A%7B%22itemType%22%3A%22thesis%22%2C%22title%22%3A%22Terrain%20modeling%20and%20obstacle%20detection%20for%20unmanned%20autonomous%20ground%20robots%22%2C%22creators%22%3A%5B%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22Amit%22%2C%22lastName%22%3A%22Puntambekar%22%7D%5D%2C%22abstractNote%22%3A%22%22%2C%22thesisType%22%3A%22Master%27s%20thesis%22%2C%22university%22%3A%22University%20of%20Louisiana%20at%20Lafayette%22%2C%22date%22%3A%222006%22%2C%22language%22%3A%22%22%2C%22url%22%3A%22http%3A%5C%2F%5C%2Fcajunbot.com%5C%2Fpapers%5C%2F2006-amit-thesis_-_terrain_mapping_and_obstacle_detection_for_unmanned_autonomous_ground_robots_without_sensor_stabilization.pdf%22%2C%22collections%22%3A%5B%22E736XXUM%22%5D%2C%22dateModified%22%3A%222014-01-20T20%3A44%3A24Z%22%7D%7D%2C%7B%22key%22%3A%22XGXEFUB7%22%2C%22library%22%3A%7B%22id%22%3A136048%7D%2C%22meta%22%3A%7B%22creatorSummary%22%3A%22Hayes%22%2C%22parsedDate%22%3A%222008%22%2C%22numChildren%22%3A0%7D%2C%22bib%22%3A%22%3Cdiv%20class%3D%5C%22csl-bib-body%5C%22%20style%3D%5C%22line-height%3A%202%3B%20padding-left%3A%202em%3B%20text-indent%3A-2em%3B%5C%22%3E%5Cn%20%20%3Cdiv%20class%3D%5C%22csl-entry%5C%22%3EHayes%2C%20M.%20E.%20%282008%29.%20%3Ci%3ESimulating%20malware%20evolution%20for%20evaluating%20program%20phylogenies%3C%5C%2Fi%3E%20%28Master%26%23x2019%3Bs%20thesis%29.%20University%20of%20Louisiana%20at%20Lafayette.%20%3Ca%20title%3D%27Cite%20in%20RIS%20Format%27%20class%3D%27zp-CiteRIS%27%20href%3D%27http%3A%5C%2F%5C%2Fulsrl.org%5C%2Fwp-content%5C%2Fplugins%5C%2Fzotpress%5C%2Flib%5C%2Frequest%5C%2Frequest.cite.php%3Fapi_user_id%3D136048%26amp%3Bitem_key%3DXGXEFUB7%27%3ECite%3C%5C%2Fa%3E%20%3C%5C%2Fdiv%3E%5Cn%3C%5C%2Fdiv%3E%22%2C%22data%22%3A%7B%22itemType%22%3A%22thesis%22%2C%22title%22%3A%22Simulating%20malware%20evolution%20for%20evaluating%20program%20phylogenies%22%2C%22creators%22%3A%5B%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22Matthew%20E%22%2C%22lastName%22%3A%22Hayes%22%7D%5D%2C%22abstractNote%22%3A%22%22%2C%22thesisType%22%3A%22Master%27s%20thesis%22%2C%22university%22%3A%22University%20of%20Louisiana%20at%20Lafayette%22%2C%22date%22%3A%222008%22%2C%22language%22%3A%22%22%2C%22url%22%3A%22%22%2C%22collections%22%3A%5B%22E736XXUM%22%5D%2C%22dateModified%22%3A%222014-01-20T20%3A43%3A09Z%22%7D%7D%2C%7B%22key%22%3A%22XWWBUB83%22%2C%22library%22%3A%7B%22id%22%3A136048%7D%2C%22meta%22%3A%7B%22creatorSummary%22%3A%22Chouchane%22%2C%22parsedDate%22%3A%222008%22%2C%22numChildren%22%3A1%7D%2C%22bib%22%3A%22%3Cdiv%20class%3D%5C%22csl-bib-body%5C%22%20style%3D%5C%22line-height%3A%202%3B%20padding-left%3A%202em%3B%20text-indent%3A-2em%3B%5C%22%3E%5Cn%20%20%3Cdiv%20class%3D%5C%22csl-entry%5C%22%3EChouchane%2C%20M.%20R.%20%282008%29.%20%3Ci%3EApproximate%20Detection%20of%20Machine-morphed%20Variants%20of%20Malicious%20Programs%3C%5C%2Fi%3E%20%28PhD%20Dissertation%29.%20University%20of%20Louisiana%20at%20Lafayette.%20%3Ca%20title%3D%27Cite%20in%20RIS%20Format%27%20class%3D%27zp-CiteRIS%27%20href%3D%27http%3A%5C%2F%5C%2Fulsrl.org%5C%2Fwp-content%5C%2Fplugins%5C%2Fzotpress%5C%2Flib%5C%2Frequest%5C%2Frequest.cite.php%3Fapi_user_id%3D136048%26amp%3Bitem_key%3DXWWBUB83%27%3ECite%3C%5C%2Fa%3E%20%3C%5C%2Fdiv%3E%5Cn%3C%5C%2Fdiv%3E%22%2C%22data%22%3A%7B%22itemType%22%3A%22thesis%22%2C%22title%22%3A%22Approximate%20Detection%20of%20Machine-morphed%20Variants%20of%20Malicious%20Programs%22%2C%22creators%22%3A%5B%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22Mohamed%20Radhouane%22%2C%22lastName%22%3A%22Chouchane%22%7D%5D%2C%22abstractNote%22%3A%22A%20morphing%20malware%20is%20malicious%20software%20that%20uses%20a%20code%20morphing%20program%2C%20or%20morphing%20engine%2C%20to%20transform%20its%20own%20code%20into%20a%20morphed%20variant.%20The%20goal%20of%20this%20transformation%20is%20to%20evade%20recognition%20by%20malware%20detectors.%20This%20dissertation%20proposes%20and%20evaluates%20a%20new%20method%20for%20detecting%20morphed%20malware%20variants.%20The%20method%20uses%20information%20about%20the%20morphing%20engine%20to%20recognize%20variants%20created%20by%20that%20engine.%20In%20particular%2C%20it%20is%20shown%20that%20implementation%20of%20the%20requirements%20of%20good%20design%20practices%20of%20morphing%20malware%20can%20be%20capitalized%20upon%20to%20efficiently%20discriminate%20programs%20generated%20by%20a%20morphing%20engine%20implementing%20these%20requirements%20from%20programs%20that%20have%20not%20been%20generated%20by%20the%20engine.%20Exact%20recognition%20techniques%20implementing%20this%20method%20are%20proposed%20and%20shown%20to%20be%20computationally%20costly.%20Approximate%20efficient%20variations%20on%20these%20techniques%20are%20then%20proposed%20and%20successfully%20evaluated%20to%20recognize%20programs%20generated%20by%20a%20real%20world%20morphing%20engine%2C%20W32.%20Evo1.%20Finally%2C%20the%20variation%20of%20a%20malware%27s%20instruction%20distribution%20underlying%20a%20probabilistic%20morphing%20engine%20is%20modeled%20as%20a%20Markov%20chain.%20Techniques%20from%20Markov%20chain%20theory%20are%20suggested%20to%20enable%20the%20use%2C%20for%20detection%20purposes%2C%20of%20the%20distribution%20of%20the%20instruction-frequency%20vectors%20of%20the%20various%20generations%20of%20variants%20of%20morphed%20malware%20generated%20by%20a%20probabilistic%20morphing%20engine.%22%2C%22thesisType%22%3A%22PhD%20Dissertation%22%2C%22university%22%3A%22University%20of%20Louisiana%20at%20Lafayette%22%2C%22date%22%3A%222008%22%2C%22language%22%3A%22en%22%2C%22url%22%3A%22%22%2C%22collections%22%3A%5B%22E736XXUM%22%5D%2C%22dateModified%22%3A%222014-01-20T20%3A41%3A54Z%22%7D%7D%2C%7B%22key%22%3A%223BFCRZDB%22%2C%22library%22%3A%7B%22id%22%3A136048%7D%2C%22meta%22%3A%7B%22creatorSummary%22%3A%22Golconda%22%2C%22parsedDate%22%3A%222010%22%2C%22numChildren%22%3A1%7D%2C%22bib%22%3A%22%3Cdiv%20class%3D%5C%22csl-bib-body%5C%22%20style%3D%5C%22line-height%3A%202%3B%20padding-left%3A%202em%3B%20text-indent%3A-2em%3B%5C%22%3E%5Cn%20%20%3Cdiv%20class%3D%5C%22csl-entry%5C%22%3EGolconda%2C%20S.%20%282010%29.%20%3Ci%3ECajunBot%20Path%20Planner%20Architecture%20for%20Autonomous%20Ground%20Vehicles%20in%20an%20Urban%20Environment%3C%5C%2Fi%3E%20%28PhD%20Dissertation%29.%20University%20of%20Louisiana.%20Retrieved%20from%20%3Ca%20href%3D%27http%3A%5C%2F%5C%2Fwww.iscas2007.org%5C%2F~arun%5C%2Fpapers%5C%2F2010-Golconda-dissertation.pdf%27%3Ehttp%3A%5C%2F%5C%2Fwww.iscas2007.org%5C%2F~arun%5C%2Fpapers%5C%2F2010-Golconda-dissertation.pdf%3C%5C%2Fa%3E%20%3Ca%20title%3D%27Cite%20in%20RIS%20Format%27%20class%3D%27zp-CiteRIS%27%20href%3D%27http%3A%5C%2F%5C%2Fulsrl.org%5C%2Fwp-content%5C%2Fplugins%5C%2Fzotpress%5C%2Flib%5C%2Frequest%5C%2Frequest.cite.php%3Fapi_user_id%3D136048%26amp%3Bitem_key%3D3BFCRZDB%27%3ECite%3C%5C%2Fa%3E%20%20%3Ca%20title%3D%27Download%27%20class%3D%27zp-DownloadURL%27%20href%3D%27http%3A%5C%2F%5C%2Fulsrl.org%5C%2Fwp-content%5C%2Fplugins%5C%2Fzotpress%5C%2Flib%5C%2Frequest%5C%2Frequest.dl.php%3Fapi_user_id%3D136048%26amp%3Bdlkey%3DP3VMI3IB%26amp%3Bcontent_type%3Dapplication%5C%2Fpdf%27%3EDownload%3C%5C%2Fa%3E%3C%5C%2Fdiv%3E%5Cn%3C%5C%2Fdiv%3E%22%2C%22data%22%3A%7B%22itemType%22%3A%22thesis%22%2C%22title%22%3A%22CajunBot%20Path%20Planner%20Architecture%20for%20Autonomous%20Ground%20Vehicles%20in%20an%20Urban%20Environment%22%2C%22creators%22%3A%5B%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22Suresh%22%2C%22lastName%22%3A%22Golconda%22%7D%5D%2C%22abstractNote%22%3A%22%22%2C%22thesisType%22%3A%22PhD%20Dissertation%22%2C%22university%22%3A%22University%20of%20Louisiana%22%2C%22date%22%3A%222010%22%2C%22language%22%3A%22%22%2C%22url%22%3A%22http%3A%5C%2F%5C%2Fwww.iscas2007.org%5C%2F~arun%5C%2Fpapers%5C%2F2010-Golconda-dissertation.pdf%22%2C%22collections%22%3A%5B%22E736XXUM%22%5D%2C%22dateModified%22%3A%222014-01-20T20%3A40%3A28Z%22%7D%7D%2C%7B%22key%22%3A%2266JCPJKD%22%2C%22library%22%3A%7B%22id%22%3A136048%7D%2C%22meta%22%3A%7B%22creatorSummary%22%3A%22Golconda%22%2C%22parsedDate%22%3A%222005%22%2C%22numChildren%22%3A1%7D%2C%22bib%22%3A%22%3Cdiv%20class%3D%5C%22csl-bib-body%5C%22%20style%3D%5C%22line-height%3A%202%3B%20padding-left%3A%202em%3B%20text-indent%3A-2em%3B%5C%22%3E%5Cn%20%20%3Cdiv%20class%3D%5C%22csl-entry%5C%22%3EGolconda%2C%20S.%20%282005%29.%20%3Ci%3ESteering%20control%20for%20a%20skid-steered%20autonomous%20ground%20vehicle%20at%20varying%20speed%3C%5C%2Fi%3E%20%28Maste%29.%20University%20of%20Louisiana%20at%20Lafayette.%20Retrieved%20from%20%3Ca%20href%3D%27http%3A%5C%2F%5C%2Fcajunbot.com%5C%2Fpapers%5C%2F2005_02-steering_control_for_a_skid-steered_autonomous_ground_vehicle_at_varying_speed.pdf.pdf%27%3Ehttp%3A%5C%2F%5C%2Fcajunbot.com%5C%2Fpapers%5C%2F2005_02-steering_control_for_a_skid-steered_autonomous_ground_vehicle_at_varying_speed.pdf.pdf%3C%5C%2Fa%3E%20%3Ca%20title%3D%27Cite%20in%20RIS%20Format%27%20class%3D%27zp-CiteRIS%27%20href%3D%27http%3A%5C%2F%5C%2Fulsrl.org%5C%2Fwp-content%5C%2Fplugins%5C%2Fzotpress%5C%2Flib%5C%2Frequest%5C%2Frequest.cite.php%3Fapi_user_id%3D136048%26amp%3Bitem_key%3D66JCPJKD%27%3ECite%3C%5C%2Fa%3E%20%20%3Ca%20title%3D%27Download%27%20class%3D%27zp-DownloadURL%27%20href%3D%27http%3A%5C%2F%5C%2Fulsrl.org%5C%2Fwp-content%5C%2Fplugins%5C%2Fzotpress%5C%2Flib%5C%2Frequest%5C%2Frequest.dl.php%3Fapi_user_id%3D136048%26amp%3Bdlkey%3DG8R5B6X2%26amp%3Bcontent_type%3Dapplication%5C%2Fpdf%27%3EDownload%3C%5C%2Fa%3E%3C%5C%2Fdiv%3E%5Cn%3C%5C%2Fdiv%3E%22%2C%22data%22%3A%7B%22itemType%22%3A%22thesis%22%2C%22title%22%3A%22Steering%20control%20for%20a%20skid-steered%20autonomous%20ground%20vehicle%20at%20varying%20speed%22%2C%22creators%22%3A%5B%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22Suresh%22%2C%22lastName%22%3A%22Golconda%22%7D%5D%2C%22abstractNote%22%3A%22%22%2C%22thesisType%22%3A%22Maste%22%2C%22university%22%3A%22University%20of%20Louisiana%20at%20Lafayette%22%2C%22date%22%3A%222005%22%2C%22language%22%3A%22%22%2C%22url%22%3A%22http%3A%5C%2F%5C%2Fcajunbot.com%5C%2Fpapers%5C%2F2005_02-steering_control_for_a_skid-steered_autonomous_ground_vehicle_at_varying_speed.pdf.pdf%22%2C%22collections%22%3A%5B%22E736XXUM%22%5D%2C%22dateModified%22%3A%222014-01-20T20%3A39%3A11Z%22%7D%7D%2C%7B%22key%22%3A%22M6GXUN8T%22%2C%22library%22%3A%7B%22id%22%3A136048%7D%2C%22meta%22%3A%7B%22creatorSummary%22%3A%22Singh%22%2C%22parsedDate%22%3A%222012%22%2C%22numChildren%22%3A0%7D%2C%22bib%22%3A%22%3Cdiv%20class%3D%5C%22csl-bib-body%5C%22%20style%3D%5C%22line-height%3A%202%3B%20padding-left%3A%202em%3B%20text-indent%3A-2em%3B%5C%22%3E%5Cn%20%20%3Cdiv%20class%3D%5C%22csl-entry%5C%22%3ESingh%2C%20A.%20%282012%29.%20%3Ci%3EOn%20Concept%20Drift%2C%20Deployability%2C%20and%20Adversarial%20Selection%20in%20Machine%20Learning-based%20Malware%20Detection%3C%5C%2Fi%3E.%20University%20of%20Louisiana%20at%20Lafayette.%20%3Ca%20title%3D%27Cite%20in%20RIS%20Format%27%20class%3D%27zp-CiteRIS%27%20href%3D%27http%3A%5C%2F%5C%2Fulsrl.org%5C%2Fwp-content%5C%2Fplugins%5C%2Fzotpress%5C%2Flib%5C%2Frequest%5C%2Frequest.cite.php%3Fapi_user_id%3D136048%26amp%3Bitem_key%3DM6GXUN8T%27%3ECite%3C%5C%2Fa%3E%20%3C%5C%2Fdiv%3E%5Cn%3C%5C%2Fdiv%3E%22%2C%22data%22%3A%7B%22itemType%22%3A%22thesis%22%2C%22title%22%3A%22On%20Concept%20Drift%2C%20Deployability%2C%20and%20Adversarial%20Selection%20in%20Machine%20Learning-based%20Malware%20Detection%22%2C%22creators%22%3A%5B%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22Anshuman%22%2C%22lastName%22%3A%22Singh%22%7D%5D%2C%22abstractNote%22%3A%22Machine%20learning-based%20methods%20are%20used%20for%20malware%20detection%20due%20to%20their%20ability%20to%20automatically%20learn%20the%20detection%20rules%20from%20examples.%20The%20effective%20application%20of%20machine%20learning-based%20methods%20requires%20addressing%20some%20problems%20that%20arise%20due%20to%20%20adversarial%20nature%20of%20the%20malware%20domain.%20We%20address%20three%20such%20problems%20in%20this%20dissertation%3A%20concept%20drift%2C%20deployable%20classifier%20selection%2C%20and%20adversarial%20configuration%20of%20selection-based%20AV%20system.%20%20Concept%20drift%20results%20from%20nonstationary%20populations.%20Malware%20populations%20may%20not%20be%20stationary%20due%20to%20evolution%20for%20evading%20detection.%20Machine%20learning%20methods%20for%20malware%20detection%20assume%20that%20malware%20population%20is%20stationary%20i.e.%20probability%20%20distribution%20of%20the%20observed%20characteristics%20%28features%29%20of%20malware%20populations%20do%20not%20change%20over%20time.%20We%20investigate%20this%20assumption%20for%20malware%20families%20as%20populations.%20We%20propose%20two%20measures%20for%20tracking%20concept%20drift%20in%20malware%20families%20when%20feature%20sets%20are%20very%20large-relative%20temporal%20similarity%20and%20metafeatures.%20Our%20study%20using%20the%20proposed%20measures%20on%204000%2B%20samples%20from%20three%20real%20world%20families%20of%20x86%20malware%2C%20%20spanning%20over%205%20years%2C%20shows%20negligible%20drift%20in%20mnemonic%202-grams%20extracted%20from%20unpacked%20versions%20of%20the%20samples.%20%20A%20novel%20classifier%20selection%20criterion%2C%20called%20deployability%2C%20is%20proposed.%20Deployability%20explicitly%20takes%20into%20account%20the%20performance%20target%20that%20the%20deployed%20classifier%20is%20%20expected%20to%20meet%20on%20unseen%20data.%20The%20performance%20target%20in%20conjunction%20with%20interval%20estimate%20of%20generalization%20performance%20of%20candidate%20classifiers%20can%20be%20used%20to%20select%20deployable%20classifiers.%20An%20evaluation%20of%20the%20criterion%20shows%20least%20expected%20cost%20classifier%20%20may%20not%20be%20deployable%20for%20a%20given%20cost%20target%20and%20higher%20expected%20cost%20classifiers%20may%20be%20deployable%20for%20a%20given%20cost%20target%20and%20confidence%20level.%20%20A%20game-theoretic%20model%20of%20dynamic%20classifier%20selection-based%20AV%20system%20is%20proposed.%20The%20model%20takes%20into%20accoint%20the%20possible%20evasion%20of%20the%20selector.%20A%20backward%20induction%20based%20equlibrium%20solution%20of%20the%20game%20between%20adversary%20and%20defender%20gives%20optimal%20%20configuration%20of%20the%20classifiers%20in%20the%20systemn%20for%20the%20expected%20cost%20of%20defender%20to%20be%20minimum.%20%20%20The%20solutions%20to%20each%20of%20the%20three%20problems%20would%20help%20in%20effective%20application%20of%20machine%20learning-based%20methods%20to%20malware%20detection.%22%2C%22thesisType%22%3A%22%22%2C%22university%22%3A%22University%20of%20Louisiana%20at%20Lafayette%22%2C%22date%22%3A%222012%22%2C%22language%22%3A%22%22%2C%22url%22%3A%22%22%2C%22collections%22%3A%5B%22E736XXUM%22%5D%2C%22dateModified%22%3A%222014-01-20T20%3A37%3A31Z%22%7D%7D%2C%7B%22key%22%3A%22B4KERCBG%22%2C%22library%22%3A%7B%22id%22%3A136048%7D%2C%22meta%22%3A%7B%22creatorSummary%22%3A%22Deprez%22%2C%22parsedDate%22%3A%221997%22%2C%22numChildren%22%3A1%7D%2C%22bib%22%3A%22%3Cdiv%20class%3D%5C%22csl-bib-body%5C%22%20style%3D%5C%22line-height%3A%202%3B%20padding-left%3A%202em%3B%20text-indent%3A-2em%3B%5C%22%3E%5Cn%20%20%3Cdiv%20class%3D%5C%22csl-entry%5C%22%3EDeprez%2C%20J.-C.%20%281997%29.%20%3Ci%3EA%20context-sensitive%20formal%20transformation%20for%20restructuring%20programs%3C%5C%2Fi%3E.%20University%20of%20Southwestern%20Louisiana.%20Retrieved%20from%20%3Ca%20href%3D%27http%3A%5C%2F%5C%2Fweb.cacs.louisiana.edu%5C%2F~arun%5C%2Fpapers%5C%2Fjcd-thesis.pdf%27%3Ehttp%3A%5C%2F%5C%2Fweb.cacs.louisiana.edu%5C%2F~arun%5C%2Fpapers%5C%2Fjcd-thesis.pdf%3C%5C%2Fa%3E%20%3Ca%20title%3D%27Cite%20in%20RIS%20Format%27%20class%3D%27zp-CiteRIS%27%20href%3D%27http%3A%5C%2F%5C%2Fulsrl.org%5C%2Fwp-content%5C%2Fplugins%5C%2Fzotpress%5C%2Flib%5C%2Frequest%5C%2Frequest.cite.php%3Fapi_user_id%3D136048%26amp%3Bitem_key%3DB4KERCBG%27%3ECite%3C%5C%2Fa%3E%20%20%3Ca%20title%3D%27Download%27%20class%3D%27zp-DownloadURL%27%20href%3D%27http%3A%5C%2F%5C%2Fulsrl.org%5C%2Fwp-content%5C%2Fplugins%5C%2Fzotpress%5C%2Flib%5C%2Frequest%5C%2Frequest.dl.php%3Fapi_user_id%3D136048%26amp%3Bdlkey%3DBPVDSQBX%26amp%3Bcontent_type%3Dapplication%5C%2Fpdf%27%3EDownload%3C%5C%2Fa%3E%3C%5C%2Fdiv%3E%5Cn%3C%5C%2Fdiv%3E%22%2C%22data%22%3A%7B%22itemType%22%3A%22thesis%22%2C%22title%22%3A%22A%20context-sensitive%20formal%20transformation%20for%20restructuring%20programs%22%2C%22creators%22%3A%5B%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22Jean-Christophe%22%2C%22lastName%22%3A%22Deprez%22%7D%5D%2C%22abstractNote%22%3A%22%22%2C%22thesisType%22%3A%22%22%2C%22university%22%3A%22University%20of%20Southwestern%20Louisiana%22%2C%22date%22%3A%221997%22%2C%22language%22%3A%22%22%2C%22url%22%3A%22http%3A%5C%2F%5C%2Fweb.cacs.louisiana.edu%5C%2F~arun%5C%2Fpapers%5C%2Fjcd-thesis.pdf%22%2C%22collections%22%3A%5B%22E736XXUM%22%5D%2C%22dateModified%22%3A%222014-01-20T20%3A35%3A57Z%22%7D%7D%2C%7B%22key%22%3A%222DN78F6U%22%2C%22library%22%3A%7B%22id%22%3A136048%7D%2C%22meta%22%3A%7B%22creatorSummary%22%3A%22Karim%22%2C%22parsedDate%22%3A%222007%22%2C%22numChildren%22%3A1%7D%2C%22bib%22%3A%22%3Cdiv%20class%3D%5C%22csl-bib-body%5C%22%20style%3D%5C%22line-height%3A%202%3B%20padding-left%3A%202em%3B%20text-indent%3A-2em%3B%5C%22%3E%5Cn%20%20%3Cdiv%20class%3D%5C%22csl-entry%5C%22%3EKarim%2C%20M.%20E.%20%282007%29.%20%3Ci%3EMinMax%20Interval%20Trees%3C%5C%2Fi%3E.%20ProQuest.%20%3Ca%20title%3D%27Cite%20in%20RIS%20Format%27%20class%3D%27zp-CiteRIS%27%20href%3D%27http%3A%5C%2F%5C%2Fulsrl.org%5C%2Fwp-content%5C%2Fplugins%5C%2Fzotpress%5C%2Flib%5C%2Frequest%5C%2Frequest.cite.php%3Fapi_user_id%3D136048%26amp%3Bitem_key%3D2DN78F6U%27%3ECite%3C%5C%2Fa%3E%20%3C%5C%2Fdiv%3E%5Cn%3C%5C%2Fdiv%3E%22%2C%22data%22%3A%7B%22itemType%22%3A%22book%22%2C%22title%22%3A%22MinMax%20Interval%20Trees%22%2C%22creators%22%3A%5B%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22Md%20Enamul%22%2C%22lastName%22%3A%22Karim%22%7D%5D%2C%22abstractNote%22%3A%22We%20design%20a%20MinMax%20interval%20tree%2C%20a%20data%20structure%20that%20stores%20a%20given%20integer%20sequence%20using%20a%20set%20of%20Min%20and%20Max%20nodes.%20For%20a%20sequence%20of%20length%20n%2C%20computation%20of%20its%20MinMax%20interval%20tree%20requires%20O%28%20n%29%20time%20and%20space.%20All%20K%20intervals%20of%20a%20given%20sequence%20can%20be%20enumerated%20from%20its%20MinMax%20interval%20tree%20at%20a%20cost%20of%20O%28%20K%29.%20We%20also%20introduce%20a%20model%20for%20gapped%20intervals%20and%20compute%20the%20gapped%20intervals%20from%20a%20MinMax%20tree%20at%20a%20cost%20of%20O%28%20n%29.%20Transitively%20reduced%20partial%20orders%20of%20the%20elements%20in%20the%20Min%20nodes%20of%20a%20MinMax%20tree%20can%20be%20derived%20from%20the%20tree%20at%20a%20cost%20of%20O%28n%29.%20We%20also%20show%20that%20MinMax%20intervals%20trees%20for%20k%20different%20permutations%20can%20be%20merged%20at%20a%20cost%20of%20O%28%20kn%29.%20The%20merged%20tree%20can%20be%20used%20to%20enumerate%20all%20common%20intervals%20of%20k%20permutations%20and%20to%20derive%20transitively%20reduced%20partial%20order%20relationship%20for%20elements%20in%20the%20Min%20nodes%20for%20all%20permutations%20using%20the%20same%20costs%20as%20required%20by%20a%20tree%20for%20a%20single%20permutation.%20We%20also%20show%20how%20we%20can%20extract%20the%20irreducible%20intervals%20and%20the%20PQ%20tree%20from%20a%20MinMax%20tree%20in%20O%28n%29%20time.%20Common%20intervals%20and%20partial%20order%20relationship%20of%20the%20elements%20of%20permutations%20have%20direct%20applications%20in%20wide%20range%20of%20areas%20including%20genome%20mining%2C%20preference%20based%20ordering%20and%20content%20sensitive%20cross%20over%20operations%20in%20genetic%20algorithms.%22%2C%22date%22%3A%222007%22%2C%22language%22%3A%22en%22%2C%22ISBN%22%3A%229780549395225%22%2C%22url%22%3A%22%22%2C%22collections%22%3A%5B%22E736XXUM%22%5D%2C%22dateModified%22%3A%222014-01-20T20%3A31%3A29Z%22%7D%7D%2C%7B%22key%22%3A%22V6HS7S5G%22%2C%22library%22%3A%7B%22id%22%3A136048%7D%2C%22meta%22%3A%7B%22creatorSummary%22%3A%22Boccardo%22%2C%22parsedDate%22%3A%222009%22%2C%22numChildren%22%3A2%7D%2C%22bib%22%3A%22%3Cdiv%20class%3D%5C%22csl-bib-body%5C%22%20style%3D%5C%22line-height%3A%202%3B%20padding-left%3A%202em%3B%20text-indent%3A-2em%3B%5C%22%3E%5Cn%20%20%3Cdiv%20class%3D%5C%22csl-entry%5C%22%3EBoccardo%2C%20D.%20R.%20%282009%29.%20Context-Sensitive%20Analysis%20of%20x86%20Obfuscated%20Executables%20%5BTese%20%5C%2F%20Thesis%5D.%20Retrieved%20January%206%2C%202014%2C%20from%20%3Ca%20href%3D%27http%3A%5C%2F%5C%2Fxrepo01s.inmetro.gov.br%5C%2Fhandle%5C%2F10926%5C%2F1069%27%3Ehttp%3A%5C%2F%5C%2Fxrepo01s.inmetro.gov.br%5C%2Fhandle%5C%2F10926%5C%2F1069%3C%5C%2Fa%3E%20%3Ca%20title%3D%27Cite%20in%20RIS%20Format%27%20class%3D%27zp-CiteRIS%27%20href%3D%27http%3A%5C%2F%5C%2Fulsrl.org%5C%2Fwp-content%5C%2Fplugins%5C%2Fzotpress%5C%2Flib%5C%2Frequest%5C%2Frequest.cite.php%3Fapi_user_id%3D136048%26amp%3Bitem_key%3DV6HS7S5G%27%3ECite%3C%5C%2Fa%3E%20%20%3Ca%20title%3D%27Download%27%20class%3D%27zp-DownloadURL%27%20href%3D%27http%3A%5C%2F%5C%2Fulsrl.org%5C%2Fwp-content%5C%2Fplugins%5C%2Fzotpress%5C%2Flib%5C%2Frequest%5C%2Frequest.dl.php%3Fapi_user_id%3D136048%26amp%3Bdlkey%3DNR4ISMP5%26amp%3Bcontent_type%3Dapplication%5C%2Fpdf%27%3EDownload%3C%5C%2Fa%3E%3C%5C%2Fdiv%3E%5Cn%3C%5C%2Fdiv%3E%22%2C%22data%22%3A%7B%22itemType%22%3A%22webpage%22%2C%22title%22%3A%22Context-Sensitive%20Analysis%20of%20x86%20Obfuscated%20Executables%22%2C%22creators%22%3A%5B%7B%22creatorType%22%3A%22author%22%2C%22firstName%22%3A%22Davidson%20Rodrigo%22%2C%22lastName%22%3A%22Boccardo%22%7D%5D%2C%22abstractNote%22%3A%22Ofusca%5Cu00e7%5Cu00e3o%20de%20c%5Cu00f3digo%20tem%20por%20finalidade%20dificultar%20a%20detec%5Cu00e7%5Cu00e3o%20de%20propriedades%20intr%5Cu00ednsecas%20de%20um%20algoritmo%20atrav%5Cu00e9s%20de%20altera%5Cu00e7%5Cu00f5es%20em%20sua%20sintaxe%2C%20entretanto%20preservando%20sua%20sem%5Cu00e2ntica.%20Desenvolvedores%20de%20software%20usam%20ofusca%5Cu00e7%5Cu00e3o%20de%20c%5Cu00f3digo%20para%20defender%20seus%20programas%20contra%20ataques%20de%20propriedade%20intelectual%20e%20para%20aumentar%20a%20seguran%5Cu00e7a%20do%20c%5Cu00f3digo.%20%20Por%20outro%20lado%2C%20programadores%20maliciosos%20geralmente%20ofuscam%20seus%20c%5Cu00f3digos%20para%20esconder%20comportamento%20malicioso%20e%20para%20evitar%20detec%5Cu00e7%5Cu00e3o%20pelos%20anti-v%5Cu00edrus.%20Nesta%20tese%2C%20%5Cu00e9%20introduzido%20um%20m%5Cu00e9todo%20para%20realizar%20an%20alise%20com%20sensitividade%20ao%20contexto%20em%20bin%5Cu00e1rios%20com%20ofuscamento%20de%20chamada%20e%20retorno%20de%20procedimento.%20Para%20obter%20sem%5Cu00e2ntica%20equivalente%2C%20estes%20bin%5Cu00e1rios%20utilizam%20opera%5Cu00e7%5Cu00f5es%20diretamente%20na%20pilha%20ao%20inv%5Cu00e9s%20de%20instru%5Cu00e7%5Cu00f5es%20convencionais%20de%20chamada%20e%20retorno%20de%20procedimento.%20No%20estado%20da%20arte%20atual%2C%20a%20defini%5Cu00e7%5Cu00e3o%20de%20sensitividade%20ao%20contexto%20est%5Cu00e1%20associada%20com%20opera%5Cu00e7%5Cu00f5es%20de%20chamada%20e%20retorno%20de%20procedimento%2C%20assim%2C%20an%5Cu00e1lises%20interprocedurais%20cl%5Cu00e1ssicas%20n%5Cu00e3o%20s%5Cu00e3o%20confi%5Cu00e1veis%20para%20analisar%20bin%5Cu00e1rios%20cujas%20opera%5Cu00e7%5Cu00f5es%20n%5Cu00e3o%20podem%20ser%20determinadas.%20Uma%20nova%20defini%5Cu00e7%5Cu00e3o%20de%20sensitividade%20ao%20contexto%20%5Cu00e9%20introduzida%2C%20baseada%20no%20estado%20da%20pilha%20em%20qualquer%20instru%5Cu00e7%5Cu00e3o.%20Enquanto%20mudan%5Cu00e7as%20em%20contextos%20%5Cu00e1%20chamada%20de%20procedimento%20s%5Cu00e3o%20intrinsicamente%20relacionadas%20com%20transfer%5Cu00eancia%20de%20controle%2C%20assim%2C%20podendo%20ser%20obtidas%20em%20termos%20de%20caminhos%20em%20um%20grafo%20de%20controle%20de%20%20fluxo%20interprocedural%2C%20o%20mesmo%20n%5Cu00e3o%20%5Cu00e9%20aplic%5Cu00e1vel%20para%20mudan%5Cu00e7as%20em%20contextos%20%5Cu00e0%20pilha.%20Um%20framework%20baseado%20em%20interpreta%5Cu00e7%5Cu00e3o%20abstrata%20%5Cu00e9%20desenvolvido%20para%20avaliar%20contexto%20baseado%20no%20estado%20da%20pilha%20e%20para%20derivar%20m%5Cu00e9todos%20baseado%20em%20contextos%20%5Cu00e0%20%20chamada%20de%20procedimento%20para%20uso%20com%20contextos%20baseado%20no%20estado%20da%20pilha.%20O%20m%5Cu00e9todo%20proposto%5Cnn%5Cu00e3o%20requer%20o%20uso%20expl%5Cu00edcito%20de%20instru%5Cu00e7%5Cu00f5es%20de%20chamada%20e%20retorno%20de%20procedimento%2C%20por%5Cu00e9m%5Cndepende%20do%20conhecimento%20de%20como%20o%20ponteiro%20da%20pilha%20%5Cu00e9%20representado%20e%20manipulado.%20O%20m%5Cu00e9todo%20apresentado%20%5Cu00e9%20utilizado%20para%20criar%20uma%20vers%5Cu00e3o%20com%20sensitividade%20ao%20contexto%20de%20um%20algoritmo%20para%20detec%5Cu00e7%5Cu00e3o%20de%20ofuscamento%20de%20chamadas%20de%20Venable%20et%20al..%20Resultados%20experimentais%20mostram%20que%20a%20vers%5Cu00e3o%20com%20sensitividade%20ao%20contexto%20do%20algoritmo%20gera%20resultados%20mais%20precisos%2C%20como%20tamb%5Cu00e9m%2C%20%5Cu00e9%20computacionalmente%20mais%20eficiente%20do%20que%20a%5Cnvers%5Cu00e3o%20sem%20sensitividade%20ao%20contexto.%5Cn____________________________________________________________________________________.%22%2C%22date%22%3A%222009%22%2C%22url%22%3A%22http%3A%5C%2F%5C%2Fxrepo01s.inmetro.gov.br%5C%2Fhandle%5C%2F10926%5C%2F1069%22%2C%22language%22%3A%22por%22%2C%22collections%22%3A%5B%22E736XXUM%22%2C%22CFD996TJ%22%5D%2C%22dateModified%22%3A%222014-01-06T20%3A54%3A57Z%22%7D%7D%2C%7B%22key%22%3A%22DI4JVB79%22%2C%22library%22%3A%7B%22id%22%3A136048%7D%2C%22meta%22%3A%7B%22creatorSummary%22%3A%22Charles%20LeDoux%22%2C%22parsedDate%22%3A%222011%22%2C%22numChildren%22%3A1%7D%2C%22bib%22%3A%22%3Cdiv%20class%3D%5C%22csl-bib-body%5C%22%20style%3D%5C%22line-height%3A%202%3B%20padding-left%3A%202em%3B%20text-indent%3A-2em%3B%5C%22%3E%5Cn%20%20%3Cdiv%20class%3D%5C%22csl-entry%5C%22%3ECharles%20LeDoux.%20%282011%29.%20%3Ci%3EFeature%20Fusion%20Across%20Domains%20for%20Improved%20Malware%20Classification%3C%5C%2Fi%3E%20%28Masters%29.%20University%20of%20Louisiana%20at%20Lafayette.%20%3Ca%20title%3D%27Cite%20in%20RIS%20Format%27%20class%3D%27zp-CiteRIS%27%20href%3D%27http%3A%5C%2F%5C%2Fulsrl.org%5C%2Fwp-content%5C%2Fplugins%5C%2Fzotpress%5C%2Flib%5C%2Frequest%5C%2Frequest.cite.php%3Fapi_user_id%3D136048%26amp%3Bitem_key%3DDI4JVB79%27%3ECite%3C%5C%2Fa%3E%20%20%3Ca%20title%3D%27Download%27%20class%3D%27zp-DownloadURL%27%20href%3D%27http%3A%5C%2F%5C%2Fulsrl.org%5C%2Fwp-content%5C%2Fplugins%5C%2Fzotpress%5C%2Flib%5C%2Frequest%5C%2Frequest.dl.php%3Fapi_user_id%3D136048%26amp%3Bdlkey%3DQVNHW7TM%26amp%3Bcontent_type%3Dapplication%5C%2Fpdf%27%3EDownload%3C%5C%2Fa%3E%3C%5C%2Fdiv%3E%5Cn%3C%5C%2Fdiv%3E%22%2C%22data%22%3A%7B%22itemType%22%3A%22thesis%22%2C%22title%22%3A%22Feature%20Fusion%20Across%20Domains%20for%20Improved%20Malware%20Classification%22%2C%22creators%22%3A%5B%7B%22creatorType%22%3A%22author%22%2C%22name%22%3A%22Charles%20LeDoux%22%7D%5D%2C%22abstractNote%22%3A%22%22%2C%22thesisType%22%3A%22Masters%22%2C%22university%22%3A%22University%20of%20Louisiana%20at%20Lafayette%22%2C%22date%22%3A%222011%22%2C%22language%22%3A%22%22%2C%22url%22%3A%22%22%2C%22collections%22%3A%5B%22E736XXUM%22%5D%2C%22dateModified%22%3A%222013-01-03T22%3A33%3A42Z%22%7D%7D%5D%7D
Notani, V. (2009). Behavioral Analysis of Malware (Bachelor’s Thesis). BIRLA INSTITUTE OF TECHNOLOGY. Retrieved from http://www.cacs.louisiana.edu/~arun/papers/2013-vivek-notani-thesis.pdf Cite Download
Nandigam, J. (1995). A measure for module cohesion (PhD Dissertation). University of Louisiana at Lafayette. Retrieved from http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.61.6490&rep=rep1&type=pdf Cite Download
Singh, P. K. (2002). A Physiological Decomposition of Virus and Worm Programs (Master’s thesis). University of Louisiana at Lafayette. Retrieved from http://www.megasecurity.org/papers/masterthesis.pdf Cite Download
Deprez, J.-C. (1997). Detecting Ripple Effects of Program Modifications on a Software System’s Functionality (PhD Dissertation). University of Louisiana at Lafayette. Retrieved from http://www.cacs.louisiana.edu/~arun/papers/2003-jean-christophe-dissertation.pdf Cite Download
Mohammed, M. (n.d.). Zeroing in on Metamorphic Computer Viruses (Master’s thesis). University of Louisiana at Lafayette. Retrieved from http://www.cacs.louisiana.edu/~arun/papers/moin-mohammed-thesis-dec2003.pdf Cite Download
Kumar, E. U. (2004). Abstract Stack Graph as a Representation to Detect Obfuscated Calls in Binaries (Master’s thesis). University of Louisiana at Lafayette. Retrieved from http://www.cacs.louisiana.edu/~arun/papers/uday-kumar-thesis-dec2004.pdf Cite Download
Mathur, R. (2006). Normalizing metamorphic malware using term rewriting (Master’s thesis). University of Louisiana at Lafayette. Retrieved from http://web.cacs.louisiana.edu/~arun/papers/2006-rachit-thesis.pdf Cite Download
Puntambekar, A. (2006). Terrain modeling and obstacle detection for unmanned autonomous ground robots (Master’s thesis). University of Louisiana at Lafayette. Retrieved from http://cajunbot.com/papers/2006-amit-thesis_-_terrain_mapping_and_obstacle_detection_for_unmanned_autonomous_ground_robots_without_sensor_stabilization.pdf Cite Download
Hayes, M. E. (2008). Simulating malware evolution for evaluating program phylogenies (Master’s thesis). University of Louisiana at Lafayette. Cite
Chouchane, M. R. (2008). Approximate Detection of Machine-morphed Variants of Malicious Programs (PhD Dissertation). University of Louisiana at Lafayette. Cite
Golconda, S. (2010). CajunBot Path Planner Architecture for Autonomous Ground Vehicles in an Urban Environment (PhD Dissertation). University of Louisiana. Retrieved from http://www.iscas2007.org/~arun/papers/2010-Golconda-dissertation.pdf Cite Download
Golconda, S. (2005). Steering control for a skid-steered autonomous ground vehicle at varying speed (Maste). University of Louisiana at Lafayette. Retrieved from http://cajunbot.com/papers/2005_02-steering_control_for_a_skid-steered_autonomous_ground_vehicle_at_varying_speed.pdf.pdf Cite Download
Singh, A. (2012). On Concept Drift, Deployability, and Adversarial Selection in Machine Learning-based Malware Detection. University of Louisiana at Lafayette. Cite
Deprez, J.-C. (1997). A context-sensitive formal transformation for restructuring programs. University of Southwestern Louisiana. Retrieved from http://web.cacs.louisiana.edu/~arun/papers/jcd-thesis.pdf Cite Download
Karim, M. E. (2007). MinMax Interval Trees. ProQuest. Cite
Boccardo, D. R. (2009). Context-Sensitive Analysis of x86 Obfuscated Executables [Tese / Thesis]. Retrieved January 6, 2014, from http://xrepo01s.inmetro.gov.br/handle/10926/1069 Cite Download