{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,31]],"date-time":"2026-07-31T15:43:25Z","timestamp":1785512605362,"version":"3.56.0"},"reference-count":134,"publisher":"IEEE","license":[{"start":{"date-parts":[[2022,5,1]],"date-time":"2022-05-01T00:00:00Z","timestamp":1651363200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-009"},{"start":{"date-parts":[[2022,5,1]],"date-time":"2022-05-01T00:00:00Z","timestamp":1651363200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-001"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2022,5]]},"DOI":"10.1109\/sp46214.2022.9833745","type":"proceedings-article","created":{"date-parts":[[2022,7,27]],"date-time":"2022-07-27T19:28:05Z","timestamp":1658950085000},"page":"1791-1807","source":"Crossref","is-referenced-by-count":35,"title":["HARDLOG: Practical Tamper-Proof System Auditing Using a Novel Audit Device"],"prefix":"10.1109","author":[{"given":"Adil","family":"Ahmad","sequence":"first","affiliation":[{"name":"Purdue University"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Sangho","family":"Lee","sequence":"additional","affiliation":[{"name":"Microsoft Research"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Marcus","family":"Peinado","sequence":"additional","affiliation":[{"name":"Microsoft Research"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.1145\/2694344.2694386"},{"key":"ref56","article-title":"Shellcodes database for study cases","author":"salwan","year":"0"},{"key":"ref59","article-title":"Virtualization-based Security (VBS)","year":"0"},{"key":"ref58","article-title":"Overview of single root i\/o virtualization (SR-IOV)","year":"0"},{"key":"ref53","article-title":"When technology fails","year":"0"},{"key":"ref52","article-title":"Common reasons for computer failure in business industry","author":"williams","year":"0"},{"key":"ref55","article-title":"Exploit Database – Exploits for Penetration Testers, Researchers, and Ethical Hackers","year":"0"},{"key":"ref54","article-title":"Metasploit | Penetration Testing Software, Pen Testing Security","year":"0"},{"key":"ref51","article-title":"KSI Signature Provider","year":"0"},{"key":"ref50","article-title":"Read-only Mode Memory Card","year":"0"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1145\/2741948.2741958"},{"key":"ref45","article-title":"Remote Data Storage, Mitigation M1029 - Enterprise","year":"0"},{"key":"ref48","author":"gregg","year":"2014","journal-title":"Systems Performance Enterprise and the Cloud"},{"key":"ref47","article-title":"PESOS: Policy Enhanced Secure Object Store","author":"krahn","year":"2018","journal-title":"Proceedings of the European Conference on Computer Systems (EuroSys)"},{"key":"ref42","article-title":"7-Zip","author":"pavlov","year":"0"},{"key":"ref41","article-title":"SQLite home page","year":"0"},{"key":"ref44","article-title":"Understanding Linux Audit","year":"0"},{"key":"ref43","article-title":"OpenSSL: Cryptography and SSL\/TLS Toolkit","year":"2017"},{"key":"ref49","article-title":"WORM (Write-Once-Read-Many) USB Device","year":"0"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1109\/SP40000.2020.00096"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2019.23349"},{"key":"ref9","article-title":"Securing Remote Work: Protecting Endpoints the Right Way - Cisco Blogs","author":"hombrebueno","year":"2020"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3134045"},{"key":"ref3","article-title":"MPI: Multiple Perspective Attack Investigation with Semantic Aware Execution Partitioning","author":"ma","year":"2017","journal-title":"Proceedings of the 26th USENIX Security Symposium (Security)"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2018.23254"},{"key":"ref5","article-title":"Enabling Refinable Cross-Host Attack Investigation with Efficient Data Flow Tagging and Tracking","author":"ji","year":"2018","journal-title":"Proceedings of the 27th USENIX Security Symposium (Security)"},{"key":"ref100","article-title":"Kernel-Supported Cost-Effective Audit Logging for Causality Tracking","author":"ma","year":"2018","journal-title":"Proceedings of the 2018 USENIX Annual Technical Conference (ATC)"},{"key":"ref101","article-title":"Speedometer 2.0","year":"0"},{"key":"ref40","article-title":"memcached - a distributed memory object caching system","year":"0"},{"key":"ref35","article-title":"lmbench: Portable tools for performance analysis","author":"mcvoy","year":"1996","journal-title":"Proceedings of the 1996 USENIX Annual Technical Conference (ATC)"},{"key":"ref34","article-title":"RockPro64 | Pine64","year":"0"},{"key":"ref37","article-title":"GNU Octave","author":"eaton","year":"0"},{"key":"ref36","article-title":"Firefox - protect your life online with privacy-first products","year":"0"},{"key":"ref31","article-title":"Enhancements to the Linux Kernel for Blocking Buffer Overflow Based Attacks","author":"bernaschi","year":"2000","journal-title":"Proceedings of the 4th Annual Linux Showcase & Conference"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-24177-7_31"},{"key":"ref33","article-title":"Real-time systems","year":"0"},{"key":"ref32","article-title":"Temporal System Call Specialization for Attack Surface Reduction","author":"ghavamnia","year":"2020","journal-title":"Proceedings of the 29th USENIX Security Symposium (Security)"},{"key":"ref39","article-title":"Redis","year":"0"},{"key":"ref38","article-title":"NGINX High Performance Load Balancer, Web Server, & Reverse Proxy","year":"0"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1109\/CNS.2017.8228649"},{"key":"ref23","article-title":"Secure logging with syslog-ng: Forward integrity and confidentiality of system logs","author":"marwedel","year":"2020","journal-title":"Free and Open Source Software Developers' European Meeting"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1145\/1502777.1502779"},{"key":"ref25","article-title":"Cryptographic Support for Secure Logs on Untrusted Machines","author":"schneier","year":"1998","journal-title":"Proceedings of the 7th USENIX Security Symposium (Security)"},{"key":"ref20","article-title":"Indicator Removal on Host: Clear Windows Event Logs, Sub-technique T1070.001 - Enterprise","year":"0"},{"key":"ref22","article-title":"Receiving Messages from a Remote System","year":"0"},{"key":"ref21","article-title":"Indicator Removal on Host: Clear Linux or Mac System Logs, Sub-technique T1070.002 - Enterprise","year":"0"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-32946-3_12"},{"key":"ref27","article-title":"Efficient Data Structures for Tamper-Evident Logging","author":"crosby","year":"2009","journal-title":"Proceedings of the 18th USENIX Security Symposium (Security)"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-11379-1_3"},{"key":"ref13","article-title":"WORM","year":"0"},{"key":"ref12","article-title":"Executive Order on Improving the Nation’s Cybersecurity","year":"2021"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1145\/3052973.3053034"},{"key":"ref128","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2019.23197"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2020.24065"},{"key":"ref129","doi-asserted-by":"publisher","DOI":"10.1145\/1352592.1352625"},{"key":"ref97","article-title":"Toshiba BG3 SSD","year":"0"},{"key":"ref126","doi-asserted-by":"publisher","DOI":"10.1145\/3372297.3417265"},{"key":"ref96","article-title":"Red Hat Enterprise Linux 7: 7.4. Starting the Audit Service","year":"0"},{"key":"ref127","doi-asserted-by":"publisher","DOI":"10.1145\/3320269.3384717"},{"key":"ref11","article-title":"The SolarWinds Cyber-Attack: What You Need to Know","year":"2021"},{"key":"ref99","article-title":"netlink(7) – linux manual page","year":"0"},{"key":"ref124","article-title":"SEAL: Storage-efficient Causality Analysis on Enterprise Logs with Query-friendly Compression","author":"fei","year":"2021","journal-title":"Proceedings of the 30th USENIX Security Symposium (Security)"},{"key":"ref10","article-title":"ISTR 24: Symantec’s Annual Threat Report Reveals More Ambitious and Destructive Attacks","year":"0"},{"key":"ref98","article-title":"Lat_syscall (man page)","author":"staelin","year":"0"},{"key":"ref125","article-title":"ELISE: A Storage Efficient Logging System Powered by Redundancy Reduction and Representation Learning","author":"ding","year":"2021","journal-title":"Proceedings of the 30th USENIX Security Symposium (Security)"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1145\/3372297.3417862"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-08593-7_2"},{"key":"ref19","article-title":"BlackEnergy APT Attacks in Ukraine","year":"2021"},{"key":"ref18","article-title":"Hackers are increasingly destroying logs to hide attacks","author":"cimpanu","year":"0"},{"key":"ref93","article-title":"EverParse: Verified Secure Zero-Copy Parsers for Authenticated Message Formats","author":"ramananandro","year":"2019","journal-title":"Proceedings of the 28th USENIX Security Symposium (Security)"},{"key":"ref133","doi-asserted-by":"publisher","DOI":"10.1145\/3081333.3081349"},{"key":"ref92","article-title":"A file system for safely interacting with untrusted USB flash drives","author":"zhong","year":"2020","journal-title":"Proceedings of the12th USENIX Workshop on Hot Topics in Storage and File Systems (HotStorage)"},{"key":"ref134","article-title":"Let the Cloud Watch Over Your IoT File Systems","author":"guo","year":"2019","journal-title":"arXiv preprint arXiv 1902 06673"},{"key":"ref95","article-title":"SPADE: Support for Provenance Auditing in Distributed Environments","author":"gehani","year":"2012","journal-title":"Proceedings of The Annual ACM\/IFIP Middleware Conference (Middleware)"},{"key":"ref131","doi-asserted-by":"publisher","DOI":"10.1145\/2541940.2541949"},{"key":"ref94","doi-asserted-by":"publisher","DOI":"10.1109\/SP40000.2020.00114"},{"key":"ref132","doi-asserted-by":"publisher","DOI":"10.1109\/Trustcom.2015.378"},{"key":"ref130","article-title":"Shielding Applications from an Untrusted Cloud with Haven","author":"baumann","year":"2014","journal-title":"Proceedings of the USENIX Symposium on Operating Systems Design and Implementation (OSDI'02)"},{"key":"ref91","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00041"},{"key":"ref90","article-title":"Making USB Great Again with USBFILTER","author":"tian","year":"2016","journal-title":"Proceedings of the 25th USENIX Security Symposium (SECURITY)"},{"key":"ref89","article-title":"Defending Against Malicious Peripherals with Cinch","author":"angel","year":"2016","journal-title":"Proceedings of the 25th USENIX Security Symposium (SECURITY)"},{"key":"ref86","article-title":"Four Bytes of Power: Exploiting CVE-2021-26708 in the Linux kernel","author":"popov","year":"0"},{"key":"ref85","article-title":"Measurements of System Call Performance and Overhead – Arakanis Development","author":"soller","year":"0"},{"key":"ref88","doi-asserted-by":"publisher","DOI":"10.1109\/FPL.2007.4380686"},{"key":"ref87","doi-asserted-by":"publisher","DOI":"10.1145\/1629575.1629596"},{"key":"ref82","article-title":"Sloccount","author":"wheeler","year":"0"},{"key":"ref81","article-title":"RA-TLS Minimal Example","year":"0"},{"key":"ref84","article-title":"Mass Storage Gadget (MSG)","year":"0"},{"key":"ref83","article-title":"A block layer introduction part 1: The bio layer","author":"brown","year":"2017"},{"key":"ref80","article-title":"Code sample: Intel® software guard extensions remote attestation end-to-end example","year":"0"},{"key":"ref79","doi-asserted-by":"publisher","DOI":"10.1109\/HPCA.2016.7446082"},{"key":"ref108","article-title":"Lord of the ring(s): Side channel attacks on the CPU on-chip ring interconnect are practical","author":"paccagnella","year":"2021","journal-title":"Proceedings of the 30th USENIX Security Symposium (Security)"},{"key":"ref78","article-title":"HyperDegrade: From GHz to MHz Effective CPU Frequencies","author":"aldaya","year":"2022","journal-title":"Proceedings of the 31st USENIX Security Symposium (Security)"},{"key":"ref109","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00084"},{"key":"ref106","article-title":"Shielding software from privileged side-channel attacks","author":"dong","year":"2018","journal-title":"Proceedings of the 27th USENIX Security Symposium (Security)"},{"key":"ref107","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00004"},{"key":"ref75","doi-asserted-by":"publisher","DOI":"10.1109\/MICRO.2002.1176268"},{"key":"ref104","article-title":"memaslap – load testing and benchmarking a server","author":"zhuang","year":"0"},{"key":"ref74","doi-asserted-by":"publisher","DOI":"10.1117\/12.171701"},{"key":"ref105","article-title":"Phoronix test suite","year":"0"},{"key":"ref77","doi-asserted-by":"publisher","DOI":"10.1145\/2991079.2991084"},{"key":"ref102","article-title":"ab – Apache HTTP server benchmark tool","year":"0"},{"key":"ref76","doi-asserted-by":"publisher","DOI":"10.1109\/HPCA.2005.16"},{"key":"ref103","article-title":"Redis benchmark","year":"0"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2016.23350"},{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1145\/945465.945467"},{"key":"ref71","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2015.11"},{"key":"ref111","article-title":"Advanced Security Features of Intel vPro Technology","volume":"12","author":"levy","year":"2008","journal-title":"Intel Technology Journal"},{"key":"ref70","author":"bovet","year":"2006","journal-title":"Understanding the Linux Kernel"},{"key":"ref112","article-title":"AMD PRO Technologies","year":"0"},{"key":"ref73","doi-asserted-by":"publisher","DOI":"10.1145\/358818.358824"},{"key":"ref72","article-title":"Red Hat Enterprise Linux for Real Time 7: 3.3. Non-Maskable Interrupts","year":"0"},{"key":"ref110","doi-asserted-by":"publisher","DOI":"10.1145\/3369758"},{"key":"ref68","article-title":"Intel 64 and IA-32 Architectures Software Developer’s Manual","year":"2016","journal-title":"Volume 3A System Programming Guide"},{"key":"ref119","doi-asserted-by":"publisher","DOI":"10.1145\/3243734.3243763"},{"key":"ref67","article-title":"ExpRace: Exploiting Kernel Races through Raising Interrupts","author":"lee","year":"2021","journal-title":"Proceedings of the 30th USENIX Security Symposium (Security)"},{"key":"ref117","doi-asserted-by":"publisher","DOI":"10.1145\/2976749.2978378"},{"key":"ref69","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2012.42"},{"key":"ref118","article-title":"Dependence-Preserving Data Compaction for Scalable Forensic Analysis","author":"hossain","year":"2018","journal-title":"Proceedings of the 27th USENIX Security Symposium (Security)"},{"key":"ref64","article-title":"SCCT47B356SRB AVX","year":"0"},{"key":"ref115","doi-asserted-by":"publisher","DOI":"10.1145\/3243734.3243776"},{"key":"ref63","article-title":"Apple T2 Security Chip: Security Overview","year":"2018"},{"key":"ref116","doi-asserted-by":"publisher","DOI":"10.1145\/2508859.2516731"},{"key":"ref66","article-title":"Increase Scheduling Priority (Windows 10) - Windows Security","year":"0"},{"key":"ref113","article-title":"Shard: Fine-grained kernel specialization with context-aware hardening","author":"abubakar","year":"2021","journal-title":"Proceedings of the 30th USENIX Security Symposium (Security)"},{"key":"ref65","article-title":"Red Hat Enterprise Linux for Real Time 7: 4.5. Setting Real-time Scheduler Priorities","year":"0"},{"key":"ref114","doi-asserted-by":"publisher","DOI":"10.1145\/3127479.3129249"},{"key":"ref60","article-title":"TPM Main Specification Version 1.2 Rev. 116","year":"2011"},{"key":"ref122","article-title":"JetStream: Cluster-Scale Parallelization of Information Flow Queries","author":"quinn","year":"2016","journal-title":"Proceedings of the USENIX Symposium on Operating Systems Design and Implementation (OSDI'02)"},{"key":"ref123","article-title":"CLP: Efficient and Scalable Search on Compressed Text Logs","author":"rodrigues","year":"2021","journal-title":"Proceedings of the USENIX Symposium on Operating Systems Design and Implementation (OSDI'02)"},{"key":"ref62","article-title":"Titan in Depth: Security in Plaintext","author":"savagaonkar","year":"2017"},{"key":"ref120","doi-asserted-by":"publisher","DOI":"10.1145\/3427228.3427272"},{"key":"ref61","article-title":"Microsoft Creates Industry Standards for Datacenter Hardware Storage and Security","author":"vaid","year":"2018"},{"key":"ref121","article-title":"Eidetic Systems","author":"devecsery","year":"2014","journal-title":"Proceedings of the USENIX Symposium on Operating Systems Design and Implementation (OSDI'02)"}],"event":{"name":"2022 IEEE Symposium on Security and Privacy (SP)","location":"San Francisco, CA, USA","start":{"date-parts":[[2022,5,22]]},"end":{"date-parts":[[2022,5,26]]}},"container-title":["2022 IEEE Symposium on Security and Privacy (SP)"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/9833550\/9833558\/09833745.pdf?arnumber=9833745","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2023,11,8]],"date-time":"2023-11-08T23:26:46Z","timestamp":1699486006000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/9833745\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,5]]},"references-count":134,"URL":"https:\/\/doi.org\/10.1109\/sp46214.2022.9833745","relation":{},"subject":[],"published":{"date-parts":[[2022,5]]}}}