{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,8]],"date-time":"2026-10-08T10:38:24Z","timestamp":1791455904833,"version":"4.3.4"},"publisher-location":"Cham","reference-count":49,"publisher":"Springer International Publishing","isbn-type":[{"value":"9783030302146","type":"print"},{"value":"9783030302153","type":"electronic"}],"license":[{"start":{"date-parts":[[2019,1,1]],"date-time":"2019-01-01T00:00:00Z","timestamp":1546300800000},"content-version":"tdm","delay-in-days":0,"URL":"http:\/\/www.springer.com\/tdm"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2019]]},"DOI":"10.1007\/978-3-030-30215-3_17","type":"book-chapter","created":{"date-parts":[[2019,9,1]],"date-time":"2019-09-01T19:02:43Z","timestamp":1567364563000},"page":"341-359","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":16,"title":["Barnum: Detecting Document Malware via Control Flow Anomalies in Hardware Traces"],"prefix":"10.1007","author":[{"given":"Carter","family":"Yagemann","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Salmin","family":"Sultana","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Li","family":"Chen","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Wenke","family":"Lee","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"297","published-online":{"date-parts":[[2019,9,2]]},"reference":[{"key":"17_CR1","unstructured":"01org: libipt (2018). https:\/\/github.com\/01org\/processor-trace"},{"key":"17_CR2","doi-asserted-by":"crossref","unstructured":"Aditham, S., Ranganathan, N., Katkoori, S.: LSTM-based memory profiling for predicting data attacks in distributed big data systems. In: 2017 IEEE International Parallel and Distributed Processing Symposium Workshops (IPDPSW), pp. 1259\u20131267. IEEE (2017)","DOI":"10.1109\/IPDPSW.2017.76"},{"key":"17_CR3","unstructured":"C.B., et al.: McAfee Labs Threat Report. Technical report, McAfee Labs, September 2018"},{"key":"17_CR4","unstructured":"Athalye, A., Carlini, N., Wagner, D.: Obfuscated gradients give a false sense of security: circumventing defenses to adversarial examples. arXiv preprint arXiv:1802.00420 (2018)"},{"key":"17_CR5","doi-asserted-by":"crossref","unstructured":"Bearden, R., Lo, D.C.T.: Automated microsoft office macro malware detection using machine learning. In: 2017 IEEE International Conference on Big Data (Big Data), pp. 4448\u20134452. IEEE (2017)","DOI":"10.1109\/BigData.2017.8258483"},{"key":"17_CR6","unstructured":"Carlini, N., Wagner, D.: ROP is still dangerous: breaking modern defenses. In: Proceedings of the 23rd USENIX Conference on Security Symposium (2014)"},{"key":"17_CR7","doi-asserted-by":"crossref","unstructured":"Chen, L., Sultana, S., Sahita, R.: HeNet: a deep learning approach on Intel processor trace for effective exploit detection. arXiv preprint arXiv:1801.02318 (2018)","DOI":"10.1109\/SPW.2018.00025"},{"key":"17_CR8","unstructured":"Chen, S., Xu, J., Sezer, E.C., Gauriar, P., Iyer, R.K.: Non-control-data attacks are realistic threats. In: Proceedings of the 14th USENIX Security Symposium (2005)"},{"key":"17_CR9","doi-asserted-by":"crossref","unstructured":"Corona, I., Maiorca, D., Ariu, D., Giacinto, G.: Lux0R: detection of malicious PDF-embedded Javascript code through discriminant analysis of API references. In: Proceedings of the 2014 Workshop on Artificial Intelligent and Security Workshop, pp. 47\u201357. ACM (2014)","DOI":"10.1145\/2666652.2666657"},{"key":"17_CR10","unstructured":"Davis, A., Wolff, M.: Deep learning on disassembly data. In: BlackHat USA (2015)"},{"issue":"8","key":"17_CR11","doi-asserted-by":"publisher","first-page":"1003","DOI":"10.1109\/43.936381","volume":"20","author":"F Fallah","year":"2001","unstructured":"Fallah, F., Devadas, S., Keutzer, K.: OCCOM-efficient computation of observability-based code coverage metrics for functional verification. IEEE Trans. Comput.-Aided Des. Integr. Circ. Syst. 20(8), 1003\u20131015 (2001)","journal-title":"IEEE Trans. Comput.-Aided Des. Integr. Circ. Syst."},{"key":"17_CR12","first-page":"1","volume":"55","author":"P Ferrie","year":"2007","unstructured":"Ferrie, P.: Attacks on more virtual machine emulators. Symantec Technol. Exch. 55, 1\u201317 (2007)","journal-title":"Symantec Technol. Exch."},{"key":"17_CR13","unstructured":"Gao, D., Reiter, M.K., Song, D.: On gray-box program tracking for anomaly detection, p. 24. Department of Electrical and Computing Engineering (2004)"},{"issue":"1\u20132","key":"17_CR14","doi-asserted-by":"publisher","first-page":"18","DOI":"10.1016\/j.cose.2008.08.003","volume":"28","author":"P Garcia-Teodoro","year":"2009","unstructured":"Garcia-Teodoro, P., Diaz-Verdejo, J., Maci\u00e1-Fern\u00e1ndez, G., V\u00e1zquez, E.: Anomaly-based network intrusion detection: techniques, systems and challenges. Comput. Secur. 28(1\u20132), 18\u201328 (2009)","journal-title":"Comput. Secur."},{"key":"17_CR15","doi-asserted-by":"crossref","unstructured":"Grosse, K., Papernot, N., Manoharan, P., Backes, M., McDaniel, P.D.: Adversarial perturbations against deep neural networks for malware classification. CoRR abs\/1606.04435 (2016)","DOI":"10.1109\/SP.2016.41"},{"key":"17_CR16","unstructured":"Hestness, J., et al.: Deep learning scaling is predictable, empirically. arXiv preprint arXiv:1712.00409 (2017)"},{"key":"17_CR17","unstructured":"Hu, W., Tan, Y.: Black-box attacks against RNN based malware detection algorithms. CoRR abs\/1705.08131 (2017)"},{"key":"17_CR18","unstructured":"Karademir, S., Dean, T., Leblanc, S.: Using clone detection to find malware in acrobat files. In: Proceedings of the 2013 Conference of the Center for Advanced Studies on Collaborative Research, pp. 70\u201380. IBM Corporation (2013)"},{"key":"17_CR19","unstructured":"Kim, G., Yi, H., Lee, J., Paek, Y., Yoon, S.: LSTM-Based System-Call Language Modeling and Robust Ensemble Method for Designing Host-Based Intrusion Detection Systems. CoRR abs\/1611.01726 (2016)"},{"key":"17_CR20","doi-asserted-by":"crossref","unstructured":"Kolbitsch, C., Kirda, E., Kruegel, C.: The power of procrastination: detection and mitigation of execution-stalling malicious code. In: Proceedings of the 18th ACM Conference on Computer and Communications Security, pp. 285\u2013296. ACM (2011)","DOI":"10.1145\/2046707.2046740"},{"key":"17_CR21","doi-asserted-by":"publisher","first-page":"137","DOI":"10.1007\/978-3-319-50127-7_11","volume-title":"AI 2016: Advances in Artificial Intelligence","author":"Bojan Kolosnjaji","year":"2016","unstructured":"Kolosnjaji, B., Zarras, A., Webster, G., Eckert, C.: Deep Learning for Classification of Malware System Call Sequences, pp. 137\u2013149 (2016)"},{"key":"17_CR22","unstructured":"Kuznetsov, V., Szekeres, L., Payer, M., Candea, G., Sekar, R., Song, D.: Code-pointer integrity. In: Proceedings of the 11th USENIX Conference on Operating Systems Design and Implementation (2014)"},{"key":"17_CR23","doi-asserted-by":"crossref","unstructured":"Laskov, P., \u0160rndi\u0107, N.: Static detection of malicious Javascript-bearing PDF documents. In: Proceedings of the 27th Annual Computer Security Applications Conference, pp. 373\u2013382. ACM (2011)","DOI":"10.1145\/2076732.2076785"},{"key":"17_CR24","doi-asserted-by":"crossref","unstructured":"Lazarevic, A., Ertoz, L., Kumar, V., Ozgur, A., Srivastava, J.: A comparative study of anomaly detection schemes in network intrusion detection. In: Proceedings of the 2003 SIAM International Conference on Data Mining, pp. 25\u201336. SIAM (2003)","DOI":"10.1137\/1.9781611972733.3"},{"key":"17_CR25","doi-asserted-by":"crossref","unstructured":"Liu, D., Wang, H., Stavrou, A.: Detecting malicious Javascript in PDF through document instrumentation. In: 2014 44th Annual IEEE\/IFIP International Conference on Dependable Systems and Networks (DSN), pp. 100\u2013111. IEEE (2014)","DOI":"10.1109\/DSN.2014.92"},{"key":"17_CR26","doi-asserted-by":"crossref","unstructured":"Lu, X., Zhuge, J., Wang, R., Cao, Y., Chen, Y.: De-obfuscation and detection of malicious PDF files with high accuracy. In: 2013 46th Hawaii International Conference on System Sciences (HICSS), pp. 4890\u20134899. IEEE (2013)","DOI":"10.1109\/HICSS.2013.166"},{"key":"17_CR27","doi-asserted-by":"crossref","unstructured":"Mahadevan, V., Li, W., Bhalodia, V., Vasconcelos, N.: Anomaly detection in crowded scenes. In: 2010 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pp. 1975\u20131981. IEEE (2010)","DOI":"10.1109\/CVPR.2010.5539872"},{"key":"17_CR28","series-title":"Lecture Notes in Computer Science (Lecture Notes in Artificial Intelligence)","doi-asserted-by":"publisher","first-page":"510","DOI":"10.1007\/978-3-642-31537-4_40","volume-title":"Machine Learning and Data Mining in Pattern Recognition","author":"D Maiorca","year":"2012","unstructured":"Maiorca, D., Giacinto, G., Corona, I.: A pattern recognition system for malicious PDF files detection. In: Perner, P. (ed.) MLDM 2012. LNCS (LNAI), vol. 7376, pp. 510\u2013524. Springer, Heidelberg (2012). https:\/\/doi.org\/10.1007\/978-3-642-31537-4_40"},{"key":"17_CR29","unstructured":"Microsoft: New feature in office 2016 can block macros and help prevent infection (2016). https:\/\/cloudblogs.microsoft.com\/microsoftsecure\/2016\/03\/22\/new-feature-in-office-2016-can-block-macros-and-help-prevent-infection\/"},{"key":"17_CR30","unstructured":"Mila: 16,800 clean and 11,960 malicious files for signature testing and research (2013). http:\/\/contagiodump.blogspot.com\/2013\/03\/16800-clean-and-11960-malicious-files.html"},{"key":"17_CR31","doi-asserted-by":"crossref","unstructured":"Miramirkhani, N., Appini, M.P., Nikiforakis, N., Polychronakis, M.: Spotless sandboxes: evading malware analysis systems using wear-and-tear artifacts. In: 2017 IEEE Symposium on Security and Privacy (SP), pp. 1009\u20131024. IEEE (2017)","DOI":"10.1109\/SP.2017.42"},{"issue":"3","key":"17_CR32","doi-asserted-by":"publisher","first-page":"631","DOI":"10.1109\/TIFS.2016.2631905","volume":"12","author":"N Nissim","year":"2017","unstructured":"Nissim, N., Cohen, A., Elovici, Y.: ALDOCX: detection of unknown malicious microsoft office documents using designated active learning methods based on new structural feature extraction methodology. IEEE Trans. Inf. Forensics Secur. 12(3), 631\u2013646 (2017)","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"key":"17_CR33","doi-asserted-by":"crossref","unstructured":"Niu, B., Tan, G.: RockJIT: securing just-in-time compilation using modular control-flow integrity. In: Proceedings of the 21st ACM SIGSAC Conference on Computer and Communications Security (2014)","DOI":"10.1145\/2660267.2660281"},{"key":"17_CR34","unstructured":"Proofpoint: The human factor report 2016 (2016). https:\/\/www.proofpoint.com\/sites\/default\/files\/human-factor-report-2016.pdf"},{"key":"17_CR35","unstructured":"Raff, E., Barker, J., Sylvester, J., Brandon, R., Catanzaro, B., Nicholas, C.: Malware Detection by Eating a Whole EXE. ArXiv e-prints, October 2017"},{"key":"17_CR36","doi-asserted-by":"crossref","unstructured":"Raff, E., Sylvester, J., Nicholas, C.: Learning the PE Header. Malware Detection with Minimal Domain Knowledge, ArXiv e-prints, September 2017","DOI":"10.1145\/3128572.3140442"},{"key":"17_CR37","doi-asserted-by":"crossref","unstructured":"Rosenberg, I., Shabtai, A., Rokach, L., Elovici, Y.: Generic black-box end-to-end attack against RNNs and other API calls based malware classifiers. ArXiv e-prints, July 2017","DOI":"10.1007\/978-3-030-00470-5_23"},{"key":"17_CR38","unstructured":"Sandbox, C.: Cuckoo sandbox (2018). https:\/\/cuckoosandbox.org\/"},{"key":"17_CR39","doi-asserted-by":"crossref","unstructured":"Saxe, J., Berlin, K.: Deep neural network based malware detection using two dimensional binary program features. In: International Conference on Malicious and Unwanted Software (MALWARE), pp. 11\u201320, October 2015","DOI":"10.1109\/MALWARE.2015.7413680"},{"key":"17_CR40","doi-asserted-by":"crossref","unstructured":"Schmitt, F., Gassen, J., Gerhards-Padilla, E.: PDF scrutinizer: detecting Javascript-based attacks in PDF documents. In: 2012 Tenth Annual International Conference on Privacy, Security and Trust, pp. 104\u2013111. IEEE (2012)","DOI":"10.1109\/PST.2012.6297926"},{"key":"17_CR41","unstructured":"Schumilo, S., Aschermann, C., Gawlik, R., Schinzel, S., Holz, T.: KAFL: hardware-assisted feedback fuzzing for OS Kernels. In: 26th USENIX Security Symposium, USENIX Security 2017, pp. 167\u2013182. USENIX Association (2017)"},{"key":"17_CR42","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"230","DOI":"10.1007\/978-3-319-45719-2_11","volume-title":"Research in Attacks, Intrusions, and Defenses","author":"M Sebasti\u00e1n","year":"2016","unstructured":"Sebasti\u00e1n, M., Rivera, R., Kotzias, P., Caballero, J.: AVclass: a tool for massive malware labeling. In: Monrose, F., Dacier, M., Blanc, G., Garcia-Alfaro, J. (eds.) RAID 2016. LNCS, vol. 9854, pp. 230\u2013253. Springer, Cham (2016). https:\/\/doi.org\/10.1007\/978-3-319-45719-2_11"},{"key":"17_CR43","doi-asserted-by":"crossref","unstructured":"Smutz, C., Stavrou, A.: Malicious PDF detection using metadata and structural features. In: Proceedings of the 28th Annual Computer Security Applications Conference, pp. 239\u2013248. ACM (2012)","DOI":"10.1145\/2420950.2420987"},{"key":"17_CR44","unstructured":"Snow, K.Z., Krishnan, S., Monrose, F., Provos, N.: SHELLOS: enabling fast detection and forensic analysis of code injection attacks. In: USENIX Security Symposium, pp. 183\u2013200 (2011)"},{"key":"17_CR45","unstructured":"\u0160rndic, N., Laskov, P.: Mimicus: a library for adversarial classifier evasion (2016)"},{"key":"17_CR46","doi-asserted-by":"crossref","unstructured":"Tzermias, Z., Sykiotakis, G., Polychronakis, M., Markatos, E.P.: Combining static and dynamic analysis for the detection of malicious documents. In: Proceedings of the Fourth European Workshop on System Security, p. 4. ACM (2011)","DOI":"10.1145\/1972551.1972555"},{"key":"17_CR47","doi-asserted-by":"crossref","unstructured":"Willems, C., Freiling, F.C., Holz, T.: Using memory management to detect and extract illegitimate code for malware analysis. In: Proceedings of the 28th Annual Computer Security Applications Conference, pp. 179\u2013188. ACM (2012)","DOI":"10.1145\/2420950.2420979"},{"key":"17_CR48","unstructured":"Xu, M., Kim, T.: PlatPal: detecting malicious documents with platform diversity. In: 26th USENIX Security Symposium, USENIX Security 2017, pp. 271\u2013287. USENIX Association (2017)"},{"key":"17_CR49","unstructured":"Xu, W., Qi, Y., Evans, D.: Automatically evading classifiers. In: Proceedings of the 2016 Network and Distributed Systems Symposium (2016)"}],"container-title":["Lecture Notes in Computer Science","Information Security"],"original-title":[],"language":"en","link":[{"URL":"http:\/\/link.springer.com\/content\/pdf\/10.1007\/978-3-030-30215-3_17","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2022,9,26]],"date-time":"2022-09-26T23:59:07Z","timestamp":1664236747000},"score":1,"resource":{"primary":{"URL":"http:\/\/link.springer.com\/10.1007\/978-3-030-30215-3_17"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2019]]},"ISBN":["9783030302146","9783030302153"],"references-count":49,"URL":"https:\/\/doi.org\/10.1007\/978-3-030-30215-3_17","relation":{},"ISSN":["0302-9743","1611-3349"],"issn-type":[{"value":"0302-9743","type":"print"},{"value":"1611-3349","type":"electronic"}],"subject":[],"published":{"date-parts":[[2019]]},"assertion":[{"value":"2 September 2019","order":1,"name":"first_online","label":"First Online","group":{"name":"ChapterHistory","label":"Chapter History"}},{"value":"ISC","order":1,"name":"conference_acronym","label":"Conference Acronym","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"International Conference on Information Security","order":2,"name":"conference_name","label":"Conference Name","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"New York City, NY","order":3,"name":"conference_city","label":"Conference City","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"USA","order":4,"name":"conference_country","label":"Conference Country","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"2019","order":5,"name":"conference_year","label":"Conference Year","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"16 September 2019","order":7,"name":"conference_start_date","label":"Conference Start Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"18 September 2019","order":8,"name":"conference_end_date","label":"Conference End Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"22","order":9,"name":"conference_number","label":"Conference Number","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"isw2019","order":10,"name":"conference_id","label":"Conference ID","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"https:\/\/isc2019.cs.stonybrook.edu\/","order":11,"name":"conference_url","label":"Conference URL","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Double-blind","order":1,"name":"type","label":"Type","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"HotCRP","order":2,"name":"conference_management_system","label":"Conference Management System","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"86","order":3,"name":"number_of_submissions_sent_for_review","label":"Number of Submissions Sent for Review","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"23","order":4,"name":"number_of_full_papers_accepted","label":"Number of Full Papers Accepted","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"0","order":5,"name":"number_of_short_papers_accepted","label":"Number of Short Papers Accepted","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"27% - The value is computed by the equation \"Number of Full Papers Accepted \/ Number of Submissions Sent for Review * 100\" and then rounded to a whole number.","order":6,"name":"acceptance_rate_of_full_papers","label":"Acceptance Rate of Full Papers","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"3","order":7,"name":"average_number_of_reviews_per_paper","label":"Average Number of Reviews per Paper","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"5-7","order":8,"name":"average_number_of_papers_per_reviewer","label":"Average Number of Papers per Reviewer","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"Yes","order":9,"name":"external_reviewers_involved","label":"External Reviewers Involved","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}}]}}