{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,11,27]],"date-time":"2025-11-27T13:28:43Z","timestamp":1764250123406,"version":"3.41.0"},"reference-count":37,"publisher":"Association for Computing Machinery (ACM)","issue":"1","license":[{"start":{"date-parts":[[2016,3,28]],"date-time":"2016-03-28T00:00:00Z","timestamp":1459123200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["ACM Trans. Archit. Code Optim."],"published-print":{"date-parts":[[2016,4,5]]},"abstract":"<jats:p>Hardware Performance Counter-based (HPC) runtime checking is an effective way to identify malicious behaviors of malware and detect malicious modifications to a legitimate program\u2019s control flow. To reduce the overhead in the monitored system which has limited storage and computing resources, we present a \u201csample-locally-analyze-remotely\u201d technique. The sampled HPC data are sent to a remote server for further analysis. To minimize the I\/O bandwidth required for transmission, the fine-grained HPC profiles are compressed into much smaller vectors with Compressive Sensing. The experimental results demonstrate an 80% I\/O bandwidth reduction after applying Compressive Sensing, without compromising the detection and identification capabilities.<\/jats:p>","DOI":"10.1145\/2857055","type":"journal-article","created":{"date-parts":[[2016,3,28]],"date-time":"2016-03-28T12:53:25Z","timestamp":1459169605000},"page":"1-23","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":44,"title":["Hardware Performance Counter-Based Malware Identification and Detection with Adaptive Compressive Sensing"],"prefix":"10.1145","volume":"13","author":[{"given":"Xueyang","family":"Wang","sequence":"first","affiliation":[{"name":"New York University, Brooklyn, NY"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Sek","family":"Chai","sequence":"additional","affiliation":[{"name":"SRI International, Princeton, NJ"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Michael","family":"Isnardi","sequence":"additional","affiliation":[{"name":"SRI International, Princeton, NJ"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Sehoon","family":"Lim","sequence":"additional","affiliation":[{"name":"SRI International, Princeton, NJ"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Ramesh","family":"Karri","sequence":"additional","affiliation":[{"name":"New York University, Brooklyn, NY"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"320","published-online":{"date-parts":[[2016,3,28]]},"reference":[{"key":"e_1_2_1_1_1","doi-asserted-by":"publisher","DOI":"10.1145\/1102120.1102165"},{"key":"e_1_2_1_2_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.asoc.2004.12.002"},{"key":"e_1_2_1_3_1","first-page":"143","article-title":"Building machine learning algorithms on Hadoop for bigdata","volume":"3","author":"Asha T.","year":"2013","unstructured":"T. Asha , U. M. Shravanthi , N. Nagashree , and M. Monika . 2013 . Building machine learning algorithms on Hadoop for bigdata . Int. J. Eng. Technol. 3 , 2 (2013), 143 -- 147 . T. Asha, U. M. Shravanthi, N. Nagashree, and M. Monika. 2013. Building machine learning algorithms on Hadoop for bigdata. Int. J. Eng. Technol. 3, 2 (2013), 143--147.","journal-title":"Int. J. Eng. Technol."},{"key":"e_1_2_1_4_1","doi-asserted-by":"publisher","DOI":"10.1109\/2.869371"},{"key":"e_1_2_1_5_1","doi-asserted-by":"publisher","DOI":"10.1109\/MSP.2007.4286571"},{"key":"e_1_2_1_6_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.crma.2008.03.014"},{"key":"e_1_2_1_7_1","unstructured":"cBench. 2010. Collective Benchmark (cBench). Retrieved from http:\/\/ctuning.org\/wiki\/index.php\/CTools:CBench.  cBench. 2010. Collective Benchmark (cBench). Retrieved from http:\/\/ctuning.org\/wiki\/index.php\/CTools:CBench."},{"key":"e_1_2_1_8_1","doi-asserted-by":"publisher","DOI":"10.1145\/2485922.2485970"},{"key":"e_1_2_1_9_1","doi-asserted-by":"publisher","DOI":"10.1145\/2007477.1952686"},{"key":"e_1_2_1_10_1","unstructured":"EEI-AEIC-UTC. 2011. Smart meters and smart meter systems: A metering industry perspective. Retrieved from http:\/\/www.eei.org\/issuesandpolicy\/grid-enhancements\/Documents\/smartmeters.pdf.  EEI-AEIC-UTC. 2011. Smart meters and smart meter systems: A metering industry perspective. Retrieved from http:\/\/www.eei.org\/issuesandpolicy\/grid-enhancements\/Documents\/smartmeters.pdf."},{"key":"e_1_2_1_11_1","volume-title":"Eldar and Gitta Kutyniok","author":"Yonina","year":"2012","unstructured":"Yonina C. Eldar and Gitta Kutyniok . 2012 . Compressed Sensing : Theory and Applications. Cambridge University Press , Cambridge. Yonina C. Eldar and Gitta Kutyniok. 2012. Compressed Sensing: Theory and Applications. Cambridge University Press, Cambridge."},{"volume-title":"Proceedings of the 22nd International Conference on Computer Design. 452--457","author":"Murat Fiskiran A.","key":"e_1_2_1_12_1","unstructured":"A. Murat Fiskiran and Ruby B. Lee . 2004. Runtime execution monitoring (REM) to detect and prevent malicious code execution . In Proceedings of the 22nd International Conference on Computer Design. 452--457 . A. Murat Fiskiran and Ruby B. Lee. 2004. Runtime execution monitoring (REM) to detect and prevent malicious code execution. In Proceedings of the 22nd International Conference on Computer Design. 452--457."},{"key":"e_1_2_1_13_1","doi-asserted-by":"publisher","DOI":"10.1109\/78.558475"},{"key":"e_1_2_1_14_1","volume-title":"Proceedings of 6th USENIX Workshop on Hot Topics in Security.","author":"Gwon Youngjune L.","year":"2011","unstructured":"Youngjune L. Gwon , H. T. Kung , and Dario Vlah . 2011 . DISTROY: Detecting integrated circuit Trojans with compressive measurements . In Proceedings of 6th USENIX Workshop on Hot Topics in Security. Youngjune L. Gwon, H. T. Kung, and Dario Vlah. 2011. DISTROY: Detecting integrated circuit Trojans with compressive measurements. In Proceedings of 6th USENIX Workshop on Hot Topics in Security."},{"key":"e_1_2_1_15_1","unstructured":"Intel Inc. 2010. Intel VTune Performance Analyzer. Retrieved from http:\/\/software.intel.con\/en-us\/intel-vtune.  Intel Inc. 2010. Intel VTune Performance Analyzer. Retrieved from http:\/\/software.intel.con\/en-us\/intel-vtune."},{"key":"e_1_2_1_16_1","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2002.1017616"},{"key":"e_1_2_1_17_1","volume-title":"Oprofile: A system profiler for Linux.","author":"Levon John","year":"2010","unstructured":"John Levon and Philippe Elie . 2010 . Oprofile: A system profiler for Linux. Retrieved from http:\/\/oprofile.sourceforge.net. John Levon and Philippe Elie. 2010. Oprofile: A system profiler for Linux. Retrieved from http:\/\/oprofile.sourceforge.net."},{"key":"e_1_2_1_18_1","unstructured":"Chengbo Li Wotao Yin and Yin Zhang. 2009. TVAL3: TV Minimization by Augmented Lagrangian and Alternating Direction Algorithm. Retrieved from http:\/\/www.caam.rice.edu\/&sim;optimization\/L1\/TVAL3\/.  Chengbo Li Wotao Yin and Yin Zhang. 2009. TVAL3: TV Minimization by Augmented Lagrangian and Alternating Direction Algorithm. Retrieved from http:\/\/www.caam.rice.edu\/&sim;optimization\/L1\/TVAL3\/."},{"key":"e_1_2_1_19_1","volume-title":"Proceedings of 9th International Conference on Architectural Support for Programming Languages and Operating Systems. 168--177","author":"Lie David","year":"2000","unstructured":"David Lie , Chandramohan Thekkath , Mark Mitchell , Patrick Lincoln , Dan Boneh , John Mitchell , and Mark Horowitz . 2000 . Architecturual support for copy and tamper resistant software . In Proceedings of 9th International Conference on Architectural Support for Programming Languages and Operating Systems. 168--177 . David Lie, Chandramohan Thekkath, Mark Mitchell, Patrick Lincoln, Dan Boneh, John Mitchell, and Mark Horowitz. 2000. Architecturual support for copy and tamper resistant software. In Proceedings of 9th International Conference on Architectural Support for Programming Languages and Operating Systems. 168--177."},{"key":"e_1_2_1_20_1","unstructured":"Hsuan-Tien Lin. 2008. Introduction to Adaptive Boosting. Retrieved from http:\/\/www.csie.ntu.edu.tw\/&sim;htlin\/course\/ml08fall\/doc\/adaboost.pdf.  Hsuan-Tien Lin. 2008. Introduction to Adaptive Boosting. Retrieved from http:\/\/www.csie.ntu.edu.tw\/&sim;htlin\/course\/ml08fall\/doc\/adaboost.pdf."},{"key":"e_1_2_1_21_1","unstructured":"Linux. 2010. Performance Counters for Linux. Retrieved from http:\/\/lwn.net\/Articles\/310176.  Linux. 2010. Performance Counters for Linux. Retrieved from http:\/\/lwn.net\/Articles\/310176."},{"volume-title":"Proceedings of 18th IEEE Signal Processing and Communications Applications Conference. 840--843","author":"Berker Lo\u011fo\u011flu K.","key":"e_1_2_1_22_1","unstructured":"K. Berker Lo\u011fo\u011flu and Tu\u011frul K. Ate\u015f . 2010. Speeding-up Pearson correlation coefficient calculation on graphical processing units . In Proceedings of 18th IEEE Signal Processing and Communications Applications Conference. 840--843 . K. Berker Lo\u011fo\u011flu and Tu\u011frul K. Ate\u015f. 2010. Speeding-up Pearson correlation coefficient calculation on graphical processing units. In Proceedings of 18th IEEE Signal Processing and Communications Applications Conference. 840--843."},{"key":"e_1_2_1_23_1","doi-asserted-by":"publisher","DOI":"10.1145\/2046582.2046596"},{"key":"e_1_2_1_24_1","doi-asserted-by":"publisher","DOI":"10.1109\/HPCA.2015.7056070"},{"key":"e_1_2_1_25_1","doi-asserted-by":"publisher","DOI":"10.1109\/ITA.2008.4601068"},{"key":"e_1_2_1_26_1","doi-asserted-by":"publisher","DOI":"10.1109\/MM.2003.1261391"},{"key":"e_1_2_1_27_1","unstructured":"Stress. 2010. Stress project. Retrieved from http:\/\/people.seas.harvard.edu\/&sim;apw\/stress\/.  Stress. 2010. Stress project. Retrieved from http:\/\/people.seas.harvard.edu\/&sim;apw\/stress\/."},{"key":"e_1_2_1_28_1","doi-asserted-by":"publisher","DOI":"10.1109\/ISCA.2005.22"},{"key":"e_1_2_1_29_1","volume-title":"Smart-grid technologies in housing. Cityscape 15, 2","author":"Matt Syal M. G.","year":"2013","unstructured":"M. G. Matt Syal and Kweku Ofei-Amoh . 2013. Smart-grid technologies in housing. Cityscape 15, 2 ( 2013 ). M. G. Matt Syal and Kweku Ofei-Amoh. 2013. Smart-grid technologies in housing. Cityscape 15, 2 (2013)."},{"key":"e_1_2_1_30_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-11379-1_6"},{"key":"e_1_2_1_31_1","doi-asserted-by":"publisher","DOI":"10.1109\/TIT.2007.909108"},{"key":"e_1_2_1_32_1","doi-asserted-by":"publisher","DOI":"10.1145\/2463209.2488831"},{"key":"e_1_2_1_33_1","doi-asserted-by":"publisher","DOI":"10.1109\/TCAD.2015.2474374"},{"key":"e_1_2_1_34_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICCAD.2015.7372617"},{"volume-title":"Proceedings of the 17th IEEE International Conference on Image Processing. 4177--4180","author":"Willett Rebecca M.","key":"e_1_2_1_35_1","unstructured":"Rebecca M. Willett , Zachary T. Harmany , and Roummel F. Marcia . 2010. Poisson image reconstruction with total variation regularization . In Proceedings of the 17th IEEE International Conference on Image Processing. 4177--4180 . Rebecca M. Willett, Zachary T. Harmany, and Roummel F. Marcia. 2010. Poisson image reconstruction with total variation regularization. In Proceedings of the 17th IEEE International Conference on Image Processing. 4177--4180."},{"key":"e_1_2_1_36_1","volume-title":"Proceedings of the 42nd Annual International Conference on Dependable Systems and Networks. 1--12","author":"Xia Yubin","year":"2012","unstructured":"Yubin Xia , Yutao Liu , Haibo Chen , and Binyu Zang . 2012 . CFIMon: Detecting violation of control flow integrity using performance counters . In Proceedings of the 42nd Annual International Conference on Dependable Systems and Networks. 1--12 . Yubin Xia, Yutao Liu, Haibo Chen, and Binyu Zang. 2012. CFIMon: Detecting violation of control flow integrity using performance counters. In Proceedings of the 42nd Annual International Conference on Dependable Systems and Networks. 1--12."},{"key":"e_1_2_1_37_1","unstructured":"Feng Xue. 2008. Attacking the Antivirus. Retrieved from www.blackhat.com\/presentations\/bh-europe...\/bh-eu-08-xue-WP.pdf.  Feng Xue. 2008. Attacking the Antivirus. Retrieved from www.blackhat.com\/presentations\/bh-europe...\/bh-eu-08-xue-WP.pdf."}],"container-title":["ACM Transactions on Architecture and Code Optimization"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/2857055","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/2857055","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,18]],"date-time":"2025-06-18T04:39:08Z","timestamp":1750221548000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/2857055"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2016,3,28]]},"references-count":37,"journal-issue":{"issue":"1","published-print":{"date-parts":[[2016,4,5]]}},"alternative-id":["10.1145\/2857055"],"URL":"https:\/\/doi.org\/10.1145\/2857055","relation":{},"ISSN":["1544-3566","1544-3973"],"issn-type":[{"type":"print","value":"1544-3566"},{"type":"electronic","value":"1544-3973"}],"subject":[],"published":{"date-parts":[[2016,3,28]]},"assertion":[{"value":"2015-02-01","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2015-12-01","order":1,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2016-03-28","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}