{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,3]],"date-time":"2026-06-03T15:43:45Z","timestamp":1780501425372,"version":"3.54.1"},"reference-count":79,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"2","license":[{"start":{"date-parts":[[2021,3,1]],"date-time":"2021-03-01T00:00:00Z","timestamp":1614556800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2021,3,1]],"date-time":"2021-03-01T00:00:00Z","timestamp":1614556800000},"content-version":"am","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2021,3,1]],"date-time":"2021-03-01T00:00:00Z","timestamp":1614556800000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2021,3,1]],"date-time":"2021-03-01T00:00:00Z","timestamp":1614556800000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"DOI":"10.13039\/100000006","name":"Office of Naval Research","doi-asserted-by":"publisher","award":["ONR-N00014-17-1-2498"],"award-info":[{"award-number":["ONR-N00014-17-1-2498"]}],"id":[{"id":"10.13039\/100000006","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/100000001","name":"National Science Foundation","doi-asserted-by":"publisher","award":["OAC-1541105"],"award-info":[{"award-number":["OAC-1541105"]}],"id":[{"id":"10.13039\/100000001","id-type":"DOI","asserted-by":"publisher"}]},{"name":"Security and Software Engineering Research Center"},{"DOI":"10.13039\/100000001","name":"National Science Foundation","doi-asserted-by":"publisher","id":[{"id":"10.13039\/100000001","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans. Dependable and Secure Comput."],"published-print":{"date-parts":[[2021,3,1]]},"DOI":"10.1109\/tdsc.2019.2906161","type":"journal-article","created":{"date-parts":[[2019,3,19]],"date-time":"2019-03-19T20:17:27Z","timestamp":1553026647000},"page":"825-842","source":"Crossref","is-referenced-by-count":35,"title":["Checking is Believing: Event-Aware Program Anomaly Detection in Cyber-Physical Systems"],"prefix":"10.1109","volume":"18","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-1736-0873","authenticated-orcid":false,"given":"Long","family":"Cheng","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-6784-5820","authenticated-orcid":false,"given":"Ke","family":"Tian","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Danfeng Daphne","family":"Yao","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Lui","family":"Sha","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Raheem A.","family":"Beyah","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref73","first-page":"21","article-title":"Security and privacy vulnerabilities of in-car wireless networks: A tire pressure monitoring system case study","author":"rouf","year":"2010","journal-title":"Proc 19th USENIX Conf Secur"},{"key":"ref72","doi-asserted-by":"publisher","DOI":"10.1145\/2735960.2735977"},{"key":"ref71","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2014.2312327"},{"key":"ref70","doi-asserted-by":"publisher","DOI":"10.1109\/TSMC.2013.2265083"},{"key":"ref76","doi-asserted-by":"publisher","DOI":"10.1145\/2523649.2523673"},{"key":"ref77","doi-asserted-by":"publisher","DOI":"10.1145\/2461446.2461456"},{"key":"ref74","doi-asserted-by":"publisher","DOI":"10.1109\/DSN.2017.34"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1145\/2810103.2813654"},{"key":"ref75","doi-asserted-by":"publisher","DOI":"10.1145\/3196494.3196532"},{"key":"ref38","doi-asserted-by":"crossref","first-page":"61","DOI":"10.1145\/1127345.1127348","article-title":"Anomalous system call detection","volume":"9","author":"darren","year":"2006","journal-title":"ACM Trans Inf Syst Secur"},{"key":"ref78","first-page":"21","article-title":"Securecore: A multicore-based intrusion detection architecture for real-time embedded systems","author":"yoon","year":"2013","journal-title":"Proc IEEE Real-Time and Embedded Technol and Appl Symp"},{"key":"ref79","doi-asserted-by":"publisher","DOI":"10.1145\/2976749.2978406"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1109\/CSF.2015.37"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1109\/SECPRI.1999.766910"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1145\/3054977.3054999"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2017.23051"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1109\/MSP.2014.114"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2017.23313"},{"key":"ref35","first-page":"1","article-title":"PCFIRE: Towards provable preventative control-flow integrity enforcement for realistic embedded software","author":"tan","year":"2016","journal-title":"Proc Int Conf Embedded Softw"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2014.23043"},{"key":"ref60","first-page":"115","article-title":"Netcheck: Network diagnoses from blackbox traces","author":"zhuang","year":"2014","journal-title":"Proc 11th USENIX Conf Netw Syst Des Implementation"},{"key":"ref62","year":"2017"},{"key":"ref61","doi-asserted-by":"publisher","DOI":"10.1109\/NOMS.2016.7502939"},{"key":"ref63","year":"2017"},{"key":"ref28","year":"2017"},{"key":"ref64","first-page":"194","article-title":"Formalizing sensitivity in static analysis for intrusion detection","author":"feng","year":"2004","journal-title":"Proc IEEE Secur Privacy"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1109\/MIC.2016.104"},{"key":"ref65","doi-asserted-by":"crossref","first-page":"4069e","DOI":"10.1002\/cpe.4069","article-title":"Hardware-assisted software event tracing","volume":"29","author":"adrien","year":"2017","journal-title":"Concurrency Comput Practice Experience"},{"key":"ref66","first-page":"33","article-title":"Ninja: Towards transparent tracing and debugging on arm","author":"ning","year":"2017","journal-title":"Proc 26th USENIX Secur Symp"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1145\/2502524.2502540"},{"key":"ref67","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2018.2846741"},{"key":"ref68","year":"2017"},{"key":"ref69","doi-asserted-by":"publisher","DOI":"10.1109\/DCOSS.2014.61"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1145\/2627534.2627558"},{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1145\/3134600.3134640"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1109\/CPSNA.2013.6614242"},{"key":"ref22","first-page":"161","article-title":"Control-flow bending: On the effectiveness of control-flow integrity","author":"carlini","year":"2015","journal-title":"Proc 24th USENIX Conf Secur Symp"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1145\/2818362.2818365"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2016.62"},{"key":"ref23","first-page":"12","article-title":"Non-control-data attacks are realistic threats","author":"chen","year":"2005","journal-title":"Proc 14th Conf USENIX Secur Symp - Vol 14"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1109\/ICCPS.2016.7479109"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-11212-1_23"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE.2003.1201211"},{"key":"ref51","first-page":"8","article-title":"On gray-box program tracking for anomaly detection","author":"gao","year":"2004","journal-title":"Proc 13th Conf USENIX Secur Symp - Vol 13"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.4108\/ICST.MOBIQUITOUS2009.7056"},{"key":"ref58","year":"2017"},{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.1145\/1653662.1653666"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.1145\/2664243.2664277"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.1145\/2976749.2978388"},{"key":"ref54","year":"2017"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-30143-1_1"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.1109\/SECPRI.2001.924296"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1145\/1795194.1795210"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1109\/ICDCS.2015.71"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1145\/2556288.2557420"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2016.23415"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2017.23313"},{"key":"ref14","article-title":"Hardscope: Thwarting DOP with hardware-assisted run-time scope enforcement","volume":"abs 1705 10295","author":"nyman","year":"2017","journal-title":"CoRR"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1145\/1455770.1455775"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-26362-5_13"},{"key":"ref17","first-page":"191","article-title":"Secure execution via program shepherding","author":"kiriansky","year":"2002","journal-title":"Proc 11th USENIX Secur Symp"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1145\/1102120.1102165"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1145\/1655077.1655083"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1145\/1966913.1966959"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1109\/JPROC.2011.2165269"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1145\/2542049"},{"key":"ref5","year":"2017"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1109\/MSPEC.2013.6471059"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1145\/2976749.2978358"},{"key":"ref49","year":"2017"},{"key":"ref9","year":"2017"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1145\/586110.586145"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1145\/3105761"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2010.26"},{"key":"ref47","year":"2017"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-94496-8_2"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.37"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1109\/SECPRI.2001.924295"},{"key":"ref43","article-title":"OEI: operation execution integrity for embedded devices","volume":"abs 1802 3462","author":"sun","year":"2018","journal-title":"CoRR"}],"container-title":["IEEE Transactions on Dependable and Secure Computing"],"original-title":[],"link":[{"URL":"https:\/\/ieeexplore.ieee.org\/ielam\/8858\/9372344\/8669815-aam.pdf","content-type":"application\/pdf","content-version":"am","intended-application":"syndication"},{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/8858\/9372344\/08669815.pdf?arnumber=8669815","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2022,4,8]],"date-time":"2022-04-08T18:51:28Z","timestamp":1649443888000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/8669815\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2021,3,1]]},"references-count":79,"journal-issue":{"issue":"2"},"URL":"https:\/\/doi.org\/10.1109\/tdsc.2019.2906161","relation":{},"ISSN":["1545-5971","1941-0018","2160-9209"],"issn-type":[{"value":"1545-5971","type":"print"},{"value":"1941-0018","type":"electronic"},{"value":"2160-9209","type":"electronic"}],"subject":[],"published":{"date-parts":[[2021,3,1]]}}}