{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,9]],"date-time":"2026-07-09T15:18:33Z","timestamp":1783610313836,"version":"3.55.0"},"reference-count":67,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","license":[{"start":{"date-parts":[[2022,1,1]],"date-time":"2022-01-01T00:00:00Z","timestamp":1640995200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2022,1,1]],"date-time":"2022-01-01T00:00:00Z","timestamp":1640995200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2022,1,1]],"date-time":"2022-01-01T00:00:00Z","timestamp":1640995200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62072109"],"award-info":[{"award-number":["62072109"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["U1804263"],"award-info":[{"award-number":["U1804263"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["U1836112"],"award-info":[{"award-number":["U1836112"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100003392","name":"Natural Science Foundation of Fujian Province","doi-asserted-by":"publisher","award":["2021J06013"],"award-info":[{"award-number":["2021J06013"]}],"id":[{"id":"10.13039\/501100003392","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans.Inform.Forensic Secur."],"published-print":{"date-parts":[[2022]]},"DOI":"10.1109\/tifs.2022.3183409","type":"journal-article","created":{"date-parts":[[2022,6,15]],"date-time":"2022-06-15T20:02:05Z","timestamp":1655323325000},"page":"2311-2323","source":"Crossref","is-referenced-by-count":8,"title":["Retrofitting LBR Profiling to Enhance Virtual Machine Introspection"],"prefix":"10.1109","volume":"17","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-3054-766X","authenticated-orcid":false,"given":"Weijie","family":"Liu","sequence":"first","affiliation":[{"name":"Luddy School of Informatics, Computing, and Engineering, Indiana University, Bloomington, IN, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-4238-3295","authenticated-orcid":false,"given":"Ximeng","family":"Liu","sequence":"additional","affiliation":[{"name":"College of Computer and Data Science, Fuzhou University, Fuzhou, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-9510-1888","authenticated-orcid":false,"given":"Zhi","family":"Li","sequence":"additional","affiliation":[{"name":"School of Cyber Science and Engineering, Huazhong University of Science and Technology, Wuhan, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7394-7236","authenticated-orcid":false,"given":"Bin","family":"Liu","sequence":"additional","affiliation":[{"name":"School of Computer and Information Engineering, Hubei University, Wuhan, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Rongwei","family":"Yu","sequence":"additional","affiliation":[{"name":"School of Cyber Science and Engineering, Wuhan University, Wuhan, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-8085-1312","authenticated-orcid":false,"given":"Lina","family":"Wang","sequence":"additional","affiliation":[{"name":"School of Cyber Science and Engineering, Wuhan University, Wuhan, China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1145\/3361216"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-24212-0_3"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1109\/SADFE.2011.17"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1007\/978-1-4614-3296-8"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1145\/2817817.2731196"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.5555\/3361338.3361356"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-45719-2_6"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00021"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1109\/ARES.2015.43"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1145\/2775111"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.2172\/1055635"},{"key":"ref12","volume-title":"Hardware-Assisted (LBR-Based) Attack Tracing on Cloud Platforms","year":"2022"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2014.45"},{"key":"ref14","first-page":"191","article-title":"A virtual machine introspection based architecture for intrusion detection","volume-title":"Proc. NDSS","volume":"3","author":"Garfinkel"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-26362-5_4"},{"key":"ref16","volume-title":"Capturing 0day Exploits With PERFectly Placed Hardware Traps","year":"2022"},{"key":"ref17","article-title":"Advanced hardware profiling and sampling (PEBS, IBS, etc.): Creating a new PAPI sampling interface","author":"Weaver","year":"2016"},{"key":"ref18","first-page":"541","article-title":"Establishing a base of trust with performance counters for enterprise workloads","volume-title":"Proc. USENIX Annu. Tech. Conf. (USENIX ATC)","author":"Nowak"},{"key":"ref19","volume-title":"PERFMON2","year":"2022"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1109\/TC.2011.233"},{"key":"ref21","first-page":"447","article-title":"Transparent ROP exploit mitigation using indirect branch tracing","volume-title":"Proc. 22nd USENIX Secur. Symp. (USENIX Security)","author":"Pappas"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1109\/HPCA.2014.6835951"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2012.40"},{"key":"ref24","article-title":"Leveraging forensic tools for virtual machine introspection","author":"Dolan-Gavitt","year":"2011"},{"key":"ref25","volume-title":"Intel 64 and IA-32 Architectures Software Developer\u2019s Manual","year":"2022"},{"key":"ref26","volume-title":"libVMI API","year":"2022"},{"key":"ref27","volume-title":"Rekall Memory Forensics Framework","year":"2022"},{"key":"ref28","first-page":"385","article-title":"ROP is still dangerous: Breaking modern defenses","volume-title":"Proc. 23rd USENIX Secur. Symp. (USENIX Security)","author":"Carlini"},{"key":"ref29","first-page":"401","article-title":"Stitching the gadgets: On the ineffectiveness of coarse-grained control-flow integrity protection","volume-title":"Proc. 23rd USENIX Secur. Symp. (USENIX Security)","author":"Davi"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1145\/2810103.2813673"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1145\/2810103.2813676"},{"key":"ref32","article-title":"SIGDROP: Signature-based ROP detection using hardware performance counters","author":"Wang","year":"2016","journal-title":"arXiv:1609.02667"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP51992.2021.00048"},{"key":"ref34","author":"Lipp","year":"2017","journal-title":"Meltdown"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1145\/3399742"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1109\/IISWC.2008.4636099"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1109\/ACSAC.2006.20"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2015.45"},{"key":"ref39","volume-title":"Time Series Analysis: Forecasting and Control","author":"Box","year":"2015"},{"key":"ref40","volume-title":"Linux\/Unix nbench","year":"2019"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1145\/1186736.1186737"},{"key":"ref42","first-page":"72","article-title":"The PARSEC benchmark suite: Characterization and architectural implications","volume-title":"Proc. 17th Int. Conf. Parallel Architectures Compilation Techn.","author":"Bienia"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1016\/j.diin.2014.05.016"},{"key":"ref44","volume-title":"Byte-Unixbench","year":"2019"},{"key":"ref45","volume-title":"Stealthy Monitoring With Xen Altp2m","year":"2022"},{"key":"ref46","volume-title":"Siege\u2014HTTP Load Testing and Benchmarking Utility","year":"2022"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2011.11"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1145\/2664243.2664252"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.1109\/DSN.2014.59"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-05051-1_28"},{"key":"ref51","first-page":"2541","article-title":"Agamotto: Accelerating kernel driver fuzzing with lightweight virtual machine checkpoints","volume-title":"Proc. 29th USENIX Secur. Symp. (USENIX Security)","author":"Song"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.1145\/1653662.1653720"},{"key":"ref53","first-page":"1","article-title":"AntFarm: Tracking processes in a virtual machine environment","volume-title":"Proc. USENIX Annu. Tech. Conf., Gen. Track","author":"Jones"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2008.24"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-00470-5_31"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2015.11"},{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.1109\/SANER.2016.25"},{"key":"ref58","doi-asserted-by":"publisher","DOI":"10.1145\/3274694.3274698"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.1109\/DSN.2012.6263958"},{"key":"ref60","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-11379-1_6"},{"key":"ref61","doi-asserted-by":"publisher","DOI":"10.1002\/cpe.4069"},{"key":"ref62","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58951-6_16"},{"key":"ref63","doi-asserted-by":"publisher","DOI":"10.1145\/3093337.3037716"},{"key":"ref64","first-page":"557","article-title":"Inferring fine-grained control flow inside SGX enclaves with branch shadowing","volume-title":"Proc. 26th USENIX Secur. Symp. (USENIX Security)","author":"Lee"},{"key":"ref65","volume-title":"Perf-Intel-PT\u2014Linux Manual Page","year":"2022"},{"key":"ref66","volume-title":"Advanced Usage of Last Branch Records","year":"2022"},{"key":"ref67","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-66332-6_18"}],"container-title":["IEEE Transactions on Information Forensics and Security"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/10206\/9652463\/09796471.pdf?arnumber=9796471","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,2,1]],"date-time":"2024-02-01T05:05:23Z","timestamp":1706763923000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/9796471\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022]]},"references-count":67,"URL":"https:\/\/doi.org\/10.1109\/tifs.2022.3183409","relation":{},"ISSN":["1556-6013","1556-6021"],"issn-type":[{"value":"1556-6013","type":"print"},{"value":"1556-6021","type":"electronic"}],"subject":[],"published":{"date-parts":[[2022]]}}}