{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,11]],"date-time":"2026-04-11T08:44:05Z","timestamp":1775897045504,"version":"3.50.1"},"reference-count":38,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"9","license":[{"start":{"date-parts":[[2025,9,1]],"date-time":"2025-09-01T00:00:00Z","timestamp":1756684800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2025,9,1]],"date-time":"2025-09-01T00:00:00Z","timestamp":1756684800000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2025,9,1]],"date-time":"2025-09-01T00:00:00Z","timestamp":1756684800000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["U24B20145"],"award-info":[{"award-number":["U24B20145"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62133014"],"award-info":[{"award-number":["62133014"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62272155"],"award-info":[{"award-number":["62272155"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62362068"],"award-info":[{"award-number":["62362068"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans. Comput."],"published-print":{"date-parts":[[2025,9]]},"DOI":"10.1109\/tc.2025.3584274","type":"journal-article","created":{"date-parts":[[2025,6,30]],"date-time":"2025-06-30T13:37:47Z","timestamp":1751290667000},"page":"3032-3045","source":"Crossref","is-referenced-by-count":2,"title":["Hypercall-Oriented Abnormal VM Status Detection System: A Non-Intrusive Solution for Both Hypervisor and Guests"],"prefix":"10.1109","volume":"74","author":[{"ORCID":"https:\/\/orcid.org\/0009-0001-1581-6657","authenticated-orcid":false,"given":"Fangqi","family":"Bi","sequence":"first","affiliation":[{"name":"Engineering Research Center of Cyberspace, Yunnan Key Laboratory of Software Engineering, and the School of Software, Yunnan University, Kunming, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-6625-0350","authenticated-orcid":false,"given":"Guoqi","family":"Xie","sequence":"additional","affiliation":[{"name":"Key Laboratory for Embedded and Network Computing of Hunan Province College of Computer Science and Electronic Engineering, Hunan University, Changsha, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0009-0000-9762-1089","authenticated-orcid":false,"given":"Yuan","family":"Wang","sequence":"additional","affiliation":[{"name":"Engineering Research Center of Cyberspace, Yunnan Key Laboratory of Software Engineering, and the School of Software, Yunnan University, Kunming, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0009-0008-7264-4477","authenticated-orcid":false,"given":"Hao","family":"Wen","sequence":"additional","affiliation":[{"name":"Engineering Research Center of Cyberspace, Yunnan Key Laboratory of Software Engineering, and the School of Software, Yunnan University, Kunming, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-7986-2222","authenticated-orcid":false,"given":"Zhenli","family":"He","sequence":"additional","affiliation":[{"name":"Engineering Research Center of Cyberspace, Yunnan Key Laboratory of Software Engineering, and the School of Software, Yunnan University, Kunming, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-1516-4246","authenticated-orcid":false,"given":"Shaowen","family":"Yao","sequence":"additional","affiliation":[{"name":"Engineering Research Center of Cyberspace, Yunnan Key Laboratory of Software Engineering, and the School of Software, Yunnan University, Kunming, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-3363-4192","authenticated-orcid":false,"given":"Sirong","family":"Zhao","sequence":"additional","affiliation":[{"name":"Key Laboratory for Embedded and Network Computing of Hunan Province College of Computer Science and Electronic Engineering, Hunan University, Changsha, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-4822-2916","authenticated-orcid":false,"given":"Chenglai","family":"Xiong","sequence":"additional","affiliation":[{"name":"Key Laboratory for Embedded and Network Computing of Hunan Province College of Computer Science and Electronic Engineering, Hunan University, Changsha, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0009-0002-7711-5837","authenticated-orcid":false,"given":"Xingyu","family":"Hu","sequence":"additional","affiliation":[{"name":"Key Laboratory for Embedded and Network Computing of Hunan Province College of Computer Science and Electronic Engineering, Hunan University, Changsha, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0009-0003-8173-3221","authenticated-orcid":false,"given":"Bo","family":"Wan","sequence":"additional","affiliation":[{"name":"Huawei Technology Company Ltd., Hangzhou Research Institute, Hangzhou, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0009-0008-6688-4255","authenticated-orcid":false,"given":"Yiwen","family":"Jiang","sequence":"additional","affiliation":[{"name":"Huawei Technology Company Ltd., Hangzhou Research Institute, Hangzhou, China"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"263","reference":[{"issue":"3","key":"ref1","first-page":"222","article-title":"Hypervisor: A survey on concepts and taxonomy","volume":"2","author":"Desai","year":"2013","journal-title":"Int. J. Innovat. Technol. Exploring Eng."},{"issue":"8","key":"ref2","first-page":"225","article-title":"KVM: The Linux virtual machine monitor","volume-title":"Proc. Linux Symp.","volume":"1","author":"Kivity","year":"2007"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1109\/PDP.2015.108"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.5176\/2010-2283_1.1.26"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1145\/2856126"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1016\/j.oregeorev.2005.07.014"},{"key":"ref7","first-page":"919","article-title":"HyperPill: Fuzzing for hypervisor-bugs by leveraging the hardware virtualization interface","volume-title":"33rd USENIX Secur. Symp.","author":"Bulekov"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1109\/SECON.2015.7133049"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.5815\/ijcnis.2023.04.06"},{"key":"ref10","first-page":"413","article-title":"!Jump-Starting multivariate time series anomaly detection for online service systems","volume-title":"Proc. USENIX Annu. Tech. Conf. (USENIX ATC)","author":"Ma","year":"2021"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v33i01.33011409"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1145\/3292500.3330672"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.14778\/3514061.3514067"},{"key":"ref14","first-page":"1","article-title":"Anomaly transformer: Time series anomaly detection with association discrepancy","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Xu","year":"2022"},{"key":"ref15","first-page":"263","article-title":"XTRATUM: A hypervisor for safety critical embedded systems","volume-title":"Proc. 11th Real-Time Linux Workshop","volume":"9","author":"Masmano","year":"2009"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1109\/TCSII.2020.2995714"},{"key":"ref17","first-page":"1","article-title":"HINJECTOR: Injecting hypercall attacks for evaluating VMI-based intrusion detection systems","volume-title":"Proc. Annu. Comput. Secur. Appl. Conf. (ACSAC)","author":"Milenkoski","year":"2013"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1109\/SP40001.2021.00049"},{"key":"ref19","article-title":"Xen 0wning trilogy (part 1): Subverting the xen hypervisor","author":"Wojtczuk","year":"2008"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1145\/2815675.2815679"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1109\/ISSRE.2014.24"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1109\/ICPADS.2011.71"},{"key":"ref23","first-page":"41","article-title":"Specification and verification in the field: Applying formal methods to BPF just-in-time compilers in the Linux kernel","volume-title":"Proc. 14th USENIX Symp. Operat. Syst. Des. Implementation (OSDI)","author":"Nelson","year":"2020"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1109\/ISSRE.2014.24"},{"issue":"1","key":"ref25","first-page":"13","article-title":"On the efficient identification of an inflection point","volume":"6","author":"Christopoulos","year":"2016","journal-title":"Int. J. Math. Sci. Comput."},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.14778\/3389133.3389136"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1109\/ISSRE.2018.00013"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1109\/TIT.2005.858979"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1038\/srep31976"},{"key":"ref30","article-title":"Unixbench"},{"key":"ref31","article-title":"Phoronix test suite"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1016\/S0377-0427(00)00393-9"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2013.53"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1145\/2799647"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1109\/HPCA.2013.6522323"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2017.23455"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1109\/CSCloud.2016.40"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1016\/j.jss.2016.11.001"}],"container-title":["IEEE Transactions on Computers"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/12\/11121311\/11059849.pdf?arnumber=11059849","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,8,13]],"date-time":"2025-08-13T17:34:02Z","timestamp":1755106442000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11059849\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,9]]},"references-count":38,"journal-issue":{"issue":"9"},"URL":"https:\/\/doi.org\/10.1109\/tc.2025.3584274","relation":{},"ISSN":["0018-9340","1557-9956","2326-3814"],"issn-type":[{"value":"0018-9340","type":"print"},{"value":"1557-9956","type":"electronic"},{"value":"2326-3814","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025,9]]}}}