{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,9,29]],"date-time":"2026-09-29T10:51:36Z","timestamp":1790679096634,"version":"4.1.0"},"reference-count":54,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"1","license":[{"start":{"date-parts":[[2023,1,1]],"date-time":"2023-01-01T00:00:00Z","timestamp":1672531200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2023,1,1]],"date-time":"2023-01-01T00:00:00Z","timestamp":1672531200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2023,1,1]],"date-time":"2023-01-01T00:00:00Z","timestamp":1672531200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans. Dependable and Secure Comput."],"published-print":{"date-parts":[[2023,1,1]]},"DOI":"10.1109\/tdsc.2021.3133729","type":"journal-article","created":{"date-parts":[[2021,12,9]],"date-time":"2021-12-09T21:07:54Z","timestamp":1639084074000},"page":"392-406","source":"Crossref","is-referenced-by-count":5,"title":["Designing Robust API Monitoring Solutions"],"prefix":"10.1109","volume":"20","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-4358-976X","authenticated-orcid":false,"given":"Daniele Cono","family":"D'Elia","sequence":"first","affiliation":[{"name":"Sapienza University of Rome, Rome, RM, Italy"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-0831-8211","authenticated-orcid":false,"given":"Simone","family":"Nicchi","sequence":"additional","affiliation":[{"name":"Sapienza University of Rome, Rome, RM, Italy"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-0082-6104","authenticated-orcid":false,"given":"Matteo","family":"Mariani","sequence":"additional","affiliation":[{"name":"Sapienza University of Rome, Rome, RM, Italy"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-9230-9803","authenticated-orcid":false,"given":"Matteo","family":"Marini","sequence":"additional","affiliation":[{"name":"Sapienza University of Rome, Rome, RM, Italy"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-9096-2024","authenticated-orcid":false,"given":"Federico","family":"Palmaro","sequence":"additional","affiliation":[{"name":"Prisma S.r.l., Rome, RM, Italy"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1145\/2089125.2089126"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1109\/EDCC.2015.9"},{"key":"ref3","article-title":"System and method for troubleshooting software configuration problems using application tracing","author":"Golender","year":"2008"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2020.2976559"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1145\/1455770.1455779"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1145\/2523649.2523675"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1145\/2664243.2664252"},{"key":"ref8","first-page":"1","article-title":"Patterns of a cooperative malware analysis workflow","volume-title":"Proc. 5th Int. Conf. Cyber Conflict","author":"Plohmann"},{"key":"ref9","article-title":"A new open-source hypervisor-level malware monitoring and extraction system - current state and further challenges","volume-title":"VB2020 localhost. Virus Bull.","author":"Leszczy\u0144ski","year":"2020"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1109\/I4CT.2015.7219584"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1145\/3321705.3329819"},{"key":"ref12","article-title":"Exported functions that are really forwarders","year":"2021"},{"key":"ref13","article-title":"Argument passing and naming conventions","year":"2021"},{"key":"ref14","article-title":"Header annotations","year":"2021"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1109\/CGO.2003.1191551"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1145\/1065010.1065034"},{"key":"ref17","article-title":"QEMU, a fast and portable dynamic translator","volume-title":"Proc. Annu. Conf. USENIX Annu. Tech. Conf.","author":"Bellard"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2011.11"},{"key":"ref19","article-title":"Compatibility considerations for Import address filtering","year":"2021"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-41284-4_7"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1016\/j.diin.2019.04.011"},{"key":"ref22","article-title":"Deviare API hook"},{"key":"ref23","article-title":"MSDN crawler","year":"2021"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-88418-5_10"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1145\/2151024.2151043"},{"key":"ref26","article-title":"Instrumentation granularity","volume-title":"Pin Official Documentation (release 97998)","year":"2021"},{"key":"ref28","article-title":"Discussion on improvements around usermode hooking","year":"2021"},{"key":"ref29","article-title":"memdump: Dumps based on user mode API calls","year":"2021"},{"key":"ref31","article-title":"Drltrace","author":"Shudrak","year":"2021"},{"key":"ref32","article-title":"PyREBox: Python scriptable reverse engineering sandbox","year":"2021"},{"key":"ref33","first-page":"31","article-title":"DECAF++: Elastic whole-system dynamic taint analysis","volume-title":"Proc. 22nd Int. Symp. Res. Attacks, Intrusions Defenses.","author":"Davanian"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1145\/3478520"},{"key":"ref35","article-title":"Writing conformance tests (Wines developer guide)","year":"2021"},{"key":"ref36","article-title":"Al-Khaser","year":"2021"},{"key":"ref37","article-title":"SFG: Furtim malware analysis","year":"2016"},{"key":"ref38","article-title":"Release notes for Pin 3.20","year":"2021"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1145\/3274694.3274698"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-40667-1_11"},{"key":"ref41","article-title":"Evasion and countermeasures techniques to detect dynamic binary instrumentation frameworks","author":"Dos Santos Fh","year":"2021","journal-title":"Digit. Threats: Res. Practice"},{"key":"ref42","article-title":"Windows process injection in 2019 (Process injection techniques - gotta catch them all)","volume-title":"Black Hat USA","author":"Klein","year":"2019"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-66332-6_10"},{"key":"ref44","article-title":"Sysinternals suite","year":"2021"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1109\/MSP.2007.45"},{"key":"ref47","first-page":"135","article-title":"Detours: Binary interception of Win32 functions","volume-title":"Proc. 3rd USENIX Windows NT Symp.","author":"Hunt"},{"key":"ref48","article-title":"EasyHook","author":"Husse","year":"2021"},{"key":"ref49","article-title":"A virtual machine introspection based architecture for intrusion detection","volume-title":"Proc. Netw. Distrib. Syst. Secur. Symp.","author":"Garfinkel"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2008.24"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1145\/1653662.1653720"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.1145\/2810103.2813690"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-00470-5_31"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.1109\/SP40001.2021.00024"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.1145\/2522920.2522922"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.1145\/3274694.3274712"},{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP.2017.11"}],"container-title":["IEEE Transactions on Dependable and Secure Computing"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/8858\/10016903\/09645216.pdf?arnumber=9645216","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,3,14]],"date-time":"2024-03-14T02:30:59Z","timestamp":1710383459000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/9645216\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,1,1]]},"references-count":54,"journal-issue":{"issue":"1"},"URL":"https:\/\/doi.org\/10.1109\/tdsc.2021.3133729","relation":{},"ISSN":["1545-5971","1941-0018","2160-9209"],"issn-type":[{"value":"1545-5971","type":"print"},{"value":"1941-0018","type":"electronic"},{"value":"2160-9209","type":"electronic"}],"subject":[],"published":{"date-parts":[[2023,1,1]]}}}