{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,30]],"date-time":"2026-04-30T10:07:18Z","timestamp":1777543638487,"version":"3.51.4"},"reference-count":15,"publisher":"Association for Computing Machinery (ACM)","issue":"1","license":[{"start":{"date-parts":[[2005,3,1]],"date-time":"2005-03-01T00:00:00Z","timestamp":1109635200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["SIGARCH Comput. Archit. News"],"published-print":{"date-parts":[[2005,3]]},"abstract":"<jats:p>\n            Despite the pervasive use of anti-virus (AV) software, there has not been a systematic study of the characteristics of the execution of this workload. In this paper we present a characterization of four commonly used anti-virus software packages. Using the Virtutech Simics toolset, we profile the behavior of four popular anti-virus packages as run on an Intel PentiumIV platform running Microsoft Windows-XP.In our study, we focus on the overhead introduced by the anti-virus software during\n            <jats:italic>on-access<\/jats:italic>\n            execution. The overhead associated with anti-virus execution can dominate overall performance. The AV-Test group has already reported that this overhead can range from 23-129% on live systems running\n            <jats:italic>on-access<\/jats:italic>\n            experiments [3].\n            <jats:sup>1<\/jats:sup>\n            The performance impact of the anti-virus execution is clearly an important issue, and we present the first quantitative study of the characteristics of this workload. Our study includes the impact of both operating system execution and system call execution.\n          <\/jats:p>","DOI":"10.1145\/1055626.1055639","type":"journal-article","created":{"date-parts":[[2005,11,7]],"date-time":"2005-11-07T19:28:32Z","timestamp":1131391712000},"page":"90-98","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":18,"title":["Characterizing antivirus workload execution"],"prefix":"10.1145","volume":"33","author":[{"given":"Derek","family":"Uluski","sequence":"first","affiliation":[{"name":"Northeastern University, Boston, MA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Micha","family":"Moffie","sequence":"additional","affiliation":[{"name":"Northeastern University, Boston, MA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"David","family":"Kaeli","sequence":"additional","affiliation":[{"name":"Northeastern University, Boston, MA"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"320","published-online":{"date-parts":[[2005,3]]},"reference":[{"key":"e_1_2_1_1_1","unstructured":"Clam Anti-Virus. Clam AntiVirus http:\/\/www.clamav.net\/.  Clam Anti-Virus. Clam AntiVirus http:\/\/www.clamav.net\/."},{"key":"e_1_2_1_2_1","unstructured":"Open Anti-Virus. http:\/\/www.openantivirus.org\/.  Open Anti-Virus. http:\/\/www.openantivirus.org\/."},{"key":"e_1_2_1_3_1","unstructured":"AV-Test. http:\/\/www.av-test.org\/.  AV-Test. http:\/\/www.av-test.org\/."},{"key":"e_1_2_1_4_1","doi-asserted-by":"publisher","DOI":"10.5555\/1267724.1267745"},{"key":"e_1_2_1_5_1","unstructured":"Virus Bulletin. http:\/\/www.virusbtn.com\/.  Virus Bulletin. http:\/\/www.virusbtn.com\/."},{"key":"e_1_2_1_6_1","unstructured":"CERT. http:\/\/www.cert.org\/.  CERT. http:\/\/www.cert.org\/."},{"key":"e_1_2_1_7_1","volume-title":"Proc. 7th USENIX Security Conference","author":"Cowan C.","year":"1998","unstructured":"C. Cowan , C. Pu , D. Maier , H. Hinton , P. Bakke , S. Beattie , A. Grier , P. Wagle , and Z. Qian . Stackguard: Automatic adaptive detection and prevention of buffer-overflow attacks. pages 63--78 . Proc. 7th USENIX Security Conference , Jan 1998 . C. Cowan, C. Pu, D. Maier, H. Hinton, P. Bakke, S. Beattie, A. Grier, P. Wagle, and Z. Qian. Stackguard: Automatic adaptive detection and prevention of buffer-overflow attacks. pages 63--78. Proc. 7th USENIX Security Conference, Jan 1998."},{"key":"e_1_2_1_8_1","volume-title":"Proc. of the 10th USENIX Security Symposium","author":"Frantzen M.","year":"2001","unstructured":"M. Frantzen and M. Shuey . Stackghost: Hardware facilitated stack protection . Proc. of the 10th USENIX Security Symposium , Aug 2001 . M. Frantzen and M. Shuey. Stackghost: Hardware facilitated stack protection. Proc. of the 10th USENIX Security Symposium, Aug 2001."},{"key":"e_1_2_1_9_1","unstructured":"M. Silberstein. Designing a cam-based coprocessor for boosting performance of antivirus software. http:\/\/tx.technion.ac.il\/marks\/.  M. Silberstein. Designing a cam-based coprocessor for boosting performance of antivirus software. http:\/\/tx.technion.ac.il\/marks\/."},{"key":"e_1_2_1_10_1","first-page":"319","article-title":"In transit detection of computer virus with safeguard","volume":"5","author":"Symantec","year":"1994","unstructured":"Symantec . In transit detection of computer virus with safeguard . Symantec Patent , 5 , 319 ,776, Jun 1994 . Symantec. In transit detection of computer virus with safeguard. Symantec Patent, 5,319,776, Jun 1994.","journal-title":"Symantec Patent"},{"key":"e_1_2_1_11_1","volume-title":"Understanding heuristics: Symantec's bloodhound technology. Technical report","year":"1997","unstructured":"Symantec. Understanding heuristics: Symantec's bloodhound technology. Technical report , 1997 . Symantec White Paper Series, Volume XXXIV. Symantec. Understanding heuristics: Symantec's bloodhound technology. Technical report, 1997. Symantec White Paper Series, Volume XXXIV."},{"key":"e_1_2_1_12_1","unstructured":"Tarari. Regex content processor. http:\/\/www.tarari.com\/regex\/.  Tarari. Regex content processor. http:\/\/www.tarari.com\/regex\/."},{"key":"e_1_2_1_13_1","unstructured":"Simics Virtutech. http:\/\/www.simics.com\/.  Simics Virtutech. http:\/\/www.simics.com\/."},{"key":"e_1_2_1_14_1","volume-title":"Proc. of the 18th Annual Computer Security Applications Conference","author":"Williamson M. M.","year":"2002","unstructured":"M. M. Williamson . Throttling viruses : Restricting propagation to defeat malicious mobile code . Proc. of the 18th Annual Computer Security Applications Conference , Dec 2002 . M. M. Williamson. Throttling viruses: Restricting propagation to defeat malicious mobile code. Proc. of the 18th Annual Computer Security Applications Conference, Dec 2002."},{"key":"e_1_2_1_15_1","volume-title":"Workshop on Architectural Support for Anti-virus and Security","author":"Ye D.","year":"2004","unstructured":"D. Ye and D. Kaeli . A reliable return address stack: Microarchitectural features to defeat stack smashing . In Workshop on Architectural Support for Anti-virus and Security , Oct 2004 . D. Ye and D. Kaeli. A reliable return address stack: Microarchitectural features to defeat stack smashing. In Workshop on Architectural Support for Anti-virus and Security, Oct 2004."}],"container-title":["ACM SIGARCH Computer Architecture News"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/1055626.1055639","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/1055626.1055639","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,18]],"date-time":"2025-06-18T16:31:27Z","timestamp":1750264287000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/1055626.1055639"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2005,3]]},"references-count":15,"journal-issue":{"issue":"1","published-print":{"date-parts":[[2005,3]]}},"alternative-id":["10.1145\/1055626.1055639"],"URL":"https:\/\/doi.org\/10.1145\/1055626.1055639","relation":{},"ISSN":["0163-5964"],"issn-type":[{"value":"0163-5964","type":"print"}],"subject":[],"published":{"date-parts":[[2005,3]]},"assertion":[{"value":"2005-03-01","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}