{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,3,19]],"date-time":"2025-03-19T15:54:40Z","timestamp":1742399680177},"publisher-location":"New York, NY, USA","reference-count":46,"publisher":"ACM","content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2004,8,30]]},"DOI":"10.1145\/1015467.1015489","type":"proceedings-article","created":{"date-parts":[[2004,10,7]],"date-time":"2004-10-07T17:39:48Z","timestamp":1097170788000},"update-policy":"http:\/\/dx.doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":122,"title":["Shield"],"prefix":"10.1145","author":[{"given":"Helen J.","family":"Wang","sequence":"first","affiliation":[{"name":"Microsoft Research"}]},{"given":"Chuanxiong","family":"Guo","sequence":"additional","affiliation":[{"name":"Microsoft Research"}]},{"given":"Daniel R.","family":"Simon","sequence":"additional","affiliation":[{"name":"Microsoft Research"}]},{"given":"Alf","family":"Zugenmaier","sequence":"additional","affiliation":[{"name":"Microsoft Research"}]}],"member":"320","published-online":{"date-parts":[[2004,8,30]]},"reference":[{"key":"e_1_3_2_1_1_1","doi-asserted-by":"publisher","DOI":"10.1109\/2.889093"},{"key":"e_1_3_2_1_2_1","volume-title":"LISA XVI","author":"Beattie Steve","year":"2002","unstructured":"Steve Beattie , Seth Arnold , Crispin Cowan , Perry Wagle , and Chris Wright . Timing the application of security patches for optimal uptime . In LISA XVI , November 2002 .]] Steve Beattie, Seth Arnold, Crispin Cowan, Perry Wagle, and Chris Wright. Timing the application of security patches for optimal uptime. In LISA XVI, November 2002.]]"},{"key":"e_1_3_2_1_3_1","doi-asserted-by":"publisher","DOI":"10.1002\/(SICI)1097-024X(200006)30:7%3C775::AID-SPE309%3E3.0.CO;2-H"},{"key":"e_1_3_2_1_4_1","unstructured":"Byacc. http:\/\/dickey.his.com\/byacc\/byacc.html.]] Byacc. http:\/\/dickey.his.com\/byacc\/byacc.html.]]"},{"key":"e_1_3_2_1_5_1","volume-title":"Proceedings of the 13th Usenix Security Symposium","author":"Chen H.","year":"2004","unstructured":"H. Chen and B. Karp . Autograph: Toward automated, distributed worm signature detection . In Proceedings of the 13th Usenix Security Symposium , 2004 .]] H. Chen and B. Karp. Autograph: Toward automated, distributed worm signature detection. In Proceedings of the 13th Usenix Security Symposium, 2004.]]"},{"key":"e_1_3_2_1_6_1","doi-asserted-by":"publisher","DOI":"10.1109\/INFCOM.2003.1209211"},{"key":"e_1_3_2_1_7_1","unstructured":"Microsoft Security Bulletin MS01-033 November 2003. http:\/\/www.microsoft.com\/technet\/treeview\/default.asp?url=\/technet\/security\/bulletin\/MS01-033.asp.]] Microsoft Security Bulletin MS01-033 November 2003. http:\/\/www.microsoft.com\/technet\/treeview\/default.asp?url=\/technet\/security\/bulletin\/MS01-033.asp.]]"},{"key":"e_1_3_2_1_8_1","unstructured":"Microsoft Corp. URLScan Security Tool. http:\/\/www.microsoft.com\/technet\/security\/URLScan.asp.]] Microsoft Corp. URLScan Security Tool. http:\/\/www.microsoft.com\/technet\/security\/URLScan.asp.]]"},{"key":"e_1_3_2_1_9_1","volume-title":"Qian Zhang. StackGuard: Automatic Adaptive Detection and Prevention of Buffer-Overflow Attacks. In Proceedings of 7th USENIX Security Conference","author":"Cowan Crispin","year":"1998","unstructured":"Crispin Cowan , Calton Pu , Dave Maier , Heather Hintony , Jonathan Walpole , Peat Bakke , Steve Beattie , Aaron Grier , Perry Wagle , and Qian Zhang. StackGuard: Automatic Adaptive Detection and Prevention of Buffer-Overflow Attacks. In Proceedings of 7th USENIX Security Conference , 1998 .]] Crispin Cowan, Calton Pu, Dave Maier, Heather Hintony, Jonathan Walpole, Peat Bakke, Steve Beattie, Aaron Grier, Perry Wagle, and Qian Zhang. StackGuard: Automatic Adaptive Detection and Prevention of Buffer-Overflow Attacks. In Proceedings of 7th USENIX Security Conference, 1998.]]"},{"key":"e_1_3_2_1_10_1","volume-title":"RAID","author":"Dagon David","year":"2004","unstructured":"David Dagon , Xinzhou Qin , Guofei Gu , Wenke Lee , Julian Grizzard , John Levine , and Henry Owen . HoneyStat : LocalWorm Detection Using Honeypots . In RAID , 2004 .]] David Dagon, Xinzhou Qin, Guofei Gu, Wenke Lee, Julian Grizzard, John Levine, and Henry Owen. HoneyStat: LocalWorm Detection Using Honeypots. In RAID, 2004.]]"},{"key":"e_1_3_2_1_11_1","volume-title":"Morgan Kaufmann Publishers","author":"Dubuisson O.","year":"2000","unstructured":"O. Dubuisson . ASN.1 - Communication Between Heterogeneous Systems . Morgan Kaufmann Publishers , 2000 .]] O. Dubuisson. ASN.1 - Communication Between Heterogeneous Systems. Morgan Kaufmann Publishers, 2000.]]"},{"key":"e_1_3_2_1_12_1","volume-title":"June","author":"Fielding R.","year":"1999","unstructured":"R. Fielding , J. Gettys , J. Mogul , H. Frystyk , L. Masinter , P. Leach , and T. Berners-Lee . Hypertext Transfer Protocol -- HTTP\/1.1 (RFC 2616) , June 1999 .]] R. Fielding, J. Gettys, J. Mogul, H. Frystyk, L. Masinter, P. Leach, and T. Berners-Lee. Hypertext Transfer Protocol -- HTTP\/1.1 (RFC 2616), June 1999.]]"},{"key":"e_1_3_2_1_13_1","unstructured":"Alan O. Freier Philip Karlton and Paul C. Kocher. The SSL Protocol Version 3.0. http:\/\/wp.netscape.com\/eng\/ssl3\/ssl-toc.html.]] Alan O. Freier Philip Karlton and Paul C. Kocher. The SSL Protocol Version 3.0. http:\/\/wp.netscape.com\/eng\/ssl3\/ssl-toc.html.]]"},{"key":"e_1_3_2_1_14_1","volume-title":"Proceedings of USENIX Security Symposium","author":"Handley Mark","year":"2001","unstructured":"Mark Handley , Vern Paxson , and Christian Kreibich . Network Intrusion Detection: Evasion, Traffic Normalization, and End-to-End Protocol Semantics . In Proceedings of USENIX Security Symposium , August 2001 .]] Mark Handley, Vern Paxson, and Christian Kreibich. Network Intrusion Detection: Evasion, Traffic Normalization, and End-to-End Protocol Semantics. In Proceedings of USENIX Security Symposium, August 2001.]]"},{"key":"e_1_3_2_1_15_1","doi-asserted-by":"publisher","DOI":"10.1145\/570645.570656"},{"key":"e_1_3_2_1_16_1","volume-title":"Network Programming for Microsoft Windows","author":"Jones Anthony","year":"2002","unstructured":"Anthony Jones and Jim Ohlund . Network Programming for Microsoft Windows . Microsoft Publishing , 2002 .]] Anthony Jones and Jim Ohlund. Network Programming for Microsoft Windows. Microsoft Publishing, 2002.]]"},{"key":"e_1_3_2_1_17_1","volume-title":"April","author":"Klensin J.","year":"2001","unstructured":"J. Klensin . Simple Mail Transfer Protocol (RFC 2821) , April 2001 .]] J. Klensin. Simple Mail Transfer Protocol (RFC 2821), April 2001.]]"},{"key":"e_1_3_2_1_18_1","volume-title":"HotNets-II","author":"Kreibich C.","year":"2003","unstructured":"C. Kreibich and J. Crowcroft . Honeycomb: Creating Intrusion Detection Signatures Using Honeypots . In HotNets-II , 2003 .]] C. Kreibich and J. Crowcroft. Honeycomb: Creating Intrusion Detection Signatures Using Honeypots. In HotNets-II, 2003.]]"},{"key":"e_1_3_2_1_19_1","unstructured":"David Litchfield. Defeating the stack based buffer overflow prevention mechanism of microsoft windows 2003 server. http:\/\/www.nextgenss.com\/papers.htm September 2003.]] David Litchfield. Defeating the stack based buffer overflow prevention mechanism of microsoft windows 2003 server. http:\/\/www.nextgenss.com\/papers.htm September 2003.]]"},{"key":"e_1_3_2_1_20_1","doi-asserted-by":"publisher","DOI":"10.1109\/INFCOM.2000.832535"},{"key":"e_1_3_2_1_21_1","doi-asserted-by":"publisher","DOI":"10.1145\/347059.347563"},{"key":"e_1_3_2_1_22_1","doi-asserted-by":"publisher","DOI":"10.1109\/MSECP.2003.1219056"},{"key":"e_1_3_2_1_23_1","doi-asserted-by":"publisher","DOI":"10.1145\/637201.637244"},{"key":"e_1_3_2_1_24_1","unstructured":"Microsoft Security Bulletin MS03-026 September 2003. http:\/\/www.microsoft.com\/technet\/treeview\/default.asp?url=\/technet\/security\/bulletin\/MS03-026.asp.]] Microsoft Security Bulletin MS03-026 September 2003. http:\/\/www.microsoft.com\/technet\/treeview\/default.asp?url=\/technet\/security\/bulletin\/MS03-026.asp.]]"},{"key":"e_1_3_2_1_25_1","doi-asserted-by":"publisher","DOI":"10.1145\/190314.190341"},{"key":"e_1_3_2_1_26_1","unstructured":"Vern Paxson. Flex - a scanner generator - Table of Contents. http:\/\/www.gnu.org\/software\/flex\/manual\/.]] Vern Paxson. Flex - a scanner generator - Table of Contents. http:\/\/www.gnu.org\/software\/flex\/manual\/.]]"},{"key":"e_1_3_2_1_27_1","doi-asserted-by":"publisher","DOI":"10.1016\/S1389-1286(99)00112-7"},{"key":"e_1_3_2_1_28_1","unstructured":"Jonathan Pincus and Brandon Baker. Mitigations for Low-level Coding Vulnerabilities: Incomparability and Limitations. http:\/\/research.microsoft.com\/users\/jpincus\/mitigations.pdf 2004.]] Jonathan Pincus and Brandon Baker. Mitigations for Low-level Coding Vulnerabilities: Incomparability and Limitations. http:\/\/research.microsoft.com\/users\/jpincus\/mitigations.pdf 2004.]]"},{"key":"e_1_3_2_1_29_1","volume-title":"May","author":"Postel J.","year":"1983","unstructured":"J. Postel and J. Reynolds . Telnet Protocol Specification (RFC 854) , May 1983 .]] J. Postel and J. Reynolds. Telnet Protocol Specification (RFC 854), May 1983.]]"},{"key":"e_1_3_2_1_30_1","volume-title":"October","author":"Postel J.","year":"1985","unstructured":"J. Postel and J. Reynolds . RFC 765 - File Transfer Protocol (FTP) , October 1985 .]] J. Postel and J. Reynolds. RFC 765 - File Transfer Protocol (FTP), October 1985.]]"},{"key":"e_1_3_2_1_32_1","volume-title":"January","author":"Ptacek Thomas H.","year":"1998","unstructured":"Thomas H. Ptacek and Timothy N. Newsham . Insertion, evasion, and denial of service: Eluding network intrusion detection , January 1998 . http:\/\/www.insecure.org\/stf\/secnet ids\/secnet ids.html.]] Thomas H. Ptacek and Timothy N. Newsham. Insertion, evasion, and denial of service: Eluding network intrusion detection, January 1998. http:\/\/www.insecure.org\/stf\/secnet ids\/secnet ids.html.]]"},{"key":"e_1_3_2_1_33_1","volume-title":"Proceedings of USENIX Security Symposium","author":"Rescorla Eric","year":"2003","unstructured":"Eric Rescorla . Security holes... Who cares ? In Proceedings of USENIX Security Symposium , August 2003 .]] Eric Rescorla. Security holes... Who cares? In Proceedings of USENIX Security Symposium, August 2003.]]"},{"key":"e_1_3_2_1_34_1","unstructured":"DCE 1.1: Remote Procedure Call. http:\/\/www.opengroup.org\/onlinepubs\/9629399\/.]] DCE 1.1: Remote Procedure Call. http:\/\/www.opengroup.org\/onlinepubs\/9629399\/.]]"},{"key":"e_1_3_2_1_35_1","unstructured":"W32.Sasser.Worm April 2004. http:\/\/securityresponse.symantec.com\/avcenter\/venc\/data\/w32.sasser.worm.html.]] W32.Sasser.Worm April 2004. http:\/\/securityresponse.symantec.com\/avcenter\/venc\/data\/w32.sasser.worm.html.]]"},{"key":"e_1_3_2_1_36_1","volume-title":"RTP: A Transport Protocol for Real-Time Applications (RFC","author":"Schulzrinne H.","year":"1889","unstructured":"H. Schulzrinne , S. Casner , R. Frederick , and V. Jacobson . RTP: A Transport Protocol for Real-Time Applications (RFC 1889 ), January 1996.]] H. Schulzrinne, S. Casner, R. Frederick, and V. Jacobson. RTP: A Transport Protocol for Real-Time Applications (RFC 1889), January 1996.]]"},{"key":"e_1_3_2_1_37_1","volume-title":"Shankar and Vern Paxson. Active Mapping: Resisting NIDS Evasion Without Altering Traffic. In Proceedings of IEEE Symposium on Security and Privacy","author":"Umesh","year":"2003","unstructured":"Umesh Shankar and Vern Paxson. Active Mapping: Resisting NIDS Evasion Without Altering Traffic. In Proceedings of IEEE Symposium on Security and Privacy , May 2003 .]] Umesh Shankar and Vern Paxson. Active Mapping: Resisting NIDS Evasion Without Altering Traffic. In Proceedings of IEEE Symposium on Security and Privacy, May 2003.]]"},{"key":"e_1_3_2_1_38_1","unstructured":"Richard Sharpe. Server message block. http:\/\/samba.anu.edu.au\/cifs\/docs\/what-is-smb.html.]] Richard Sharpe. Server message block. http:\/\/samba.anu.edu.au\/cifs\/docs\/what-is-smb.html.]]"},{"key":"e_1_3_2_1_40_1","unstructured":"Microsoft security bulletin ms02-039 January 2003. http:\/\/www.microsoft.com\/technet\/treeview\/default.asp?url=\/technet\/security\/bulletin\/MS02-039.asp.]] Microsoft security bulletin ms02-039 January 2003. http:\/\/www.microsoft.com\/technet\/treeview\/default.asp?url=\/technet\/security\/bulletin\/MS02-039.asp.]]"},{"key":"e_1_3_2_1_41_1","unstructured":"The Open Source Network Intrusion Detection System. http:\/\/www.snort.org\/.]] The Open Source Network Intrusion Detection System. http:\/\/www.snort.org\/.]]"},{"key":"e_1_3_2_1_42_1","doi-asserted-by":"publisher","DOI":"10.5555\/647253.720288"},{"key":"e_1_3_2_1_43_1","unstructured":"Peter Szor and Peter Ferrie. Hunting for Metamorphic. Symantec Security Response.]] Peter Szor and Peter Ferrie. Hunting for Metamorphic. Symantec Security Response.]]"},{"key":"e_1_3_2_1_44_1","volume-title":"NDSS","author":"Wagner David","year":"2000","unstructured":"David Wagner , Jeffrey S. Foster , Eric A. Brewer , and Alexander Aiken . A First Step Towards Automated Detection of Buffer Overrun Vulnerabilities . In NDSS , 2000 .]] David Wagner, Jeffrey S. Foster, Eric A. Brewer, and Alexander Aiken. A First Step Towards Automated Detection of Buffer Overrun Vulnerabilities. In NDSS, 2000.]]"},{"key":"e_1_3_2_1_45_1","unstructured":"Nicholas Weaver Vern Paxson Stuart Staniford and Robert Cunningham. Large Scale Malicious Code: A Research Agenda. http:\/\/www.cs.berkeley.edu\/~nweaver\/large scale malicious code.pdf 2003.]] Nicholas Weaver Vern Paxson Stuart Staniford and Robert Cunningham. Large Scale Malicious Code: A Research Agenda. http:\/\/www.cs.berkeley.edu\/~nweaver\/large scale malicious code.pdf 2003.]]"},{"key":"e_1_3_2_1_46_1","volume-title":"Very Fast Containment of Scanning Worms","author":"Weaver Nicholas","year":"2004","unstructured":"Nicholas Weaver , Stuart Staniford , and Vern Paxson . Very Fast Containment of Scanning Worms , 2004 . http:\/\/www.icsi.berkeley.edu\/nweaver\/containment\/.]] Nicholas Weaver, Stuart Staniford, and Vern Paxson. Very Fast Containment of Scanning Worms, 2004. http:\/\/www.icsi.berkeley.edu\/nweaver\/containment\/.]]"},{"key":"e_1_3_2_1_47_1","unstructured":"Nick Weaver. The potential for very fast internet plagues. http:\/\/www.cs.berkeley.edu\/~nweaver\/warhol.html.]] Nick Weaver. The potential for very fast internet plagues. http:\/\/www.cs.berkeley.edu\/~nweaver\/warhol.html.]]"},{"key":"e_1_3_2_1_49_1","unstructured":"Rafal Wojtczuk. Defeating Solar Designer's Non-executable Stack Patch. http:\/\/www.insecure.org\/sploits\/non-executable.stack.problems.html January 1998.]] Rafal Wojtczuk. Defeating Solar Designer's Non-executable Stack Patch. http:\/\/www.insecure.org\/sploits\/non-executable.stack.problems.html January 1998.]]"}],"event":{"name":"SIGCOMM04: ACM SIGCOMM 2004 Conference","location":"Portland Oregon USA","acronym":"SIGCOMM04","sponsor":["SIGCOMM ACM Special Interest Group on Data Communication","ACM Association for Computing Machinery"]},"container-title":["Proceedings of the 2004 conference on Applications, technologies, architectures, and protocols for computer communications"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/1015467.1015489","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2023,9,4]],"date-time":"2023-09-04T13:33:58Z","timestamp":1693834438000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/1015467.1015489"}},"subtitle":["vulnerability-driven network filters for preventing known vulnerability exploits"],"short-title":[],"issued":{"date-parts":[[2004,8,30]]},"references-count":46,"alternative-id":["10.1145\/1015467.1015489","10.1145\/1015467"],"URL":"https:\/\/doi.org\/10.1145\/1015467.1015489","relation":{"is-identical-to":[{"id-type":"doi","id":"10.1145\/1030194.1015489","asserted-by":"object"}]},"subject":[],"published":{"date-parts":[[2004,8,30]]},"assertion":[{"value":"2004-08-30","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}