{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,13]],"date-time":"2026-07-13T21:11:10Z","timestamp":1783977070430,"version":"3.55.0"},"publisher-location":"New York, NY, USA","reference-count":32,"publisher":"ACM","license":[{"start":{"date-parts":[[2017,4,2]],"date-time":"2017-04-02T00:00:00Z","timestamp":1491091200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"DOI":"10.13039\/100008982","name":"Qatar National Research Fund","doi-asserted-by":"publisher","award":["8-1474-2-626"],"award-info":[{"award-number":["8-1474-2-626"]}],"id":[{"id":"10.13039\/100008982","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2017,4,2]]},"DOI":"10.1145\/3052973.3052999","type":"proceedings-article","created":{"date-parts":[[2017,3,31]],"date-time":"2017-03-31T12:22:54Z","timestamp":1490962974000},"page":"483-493","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":91,"title":["On the Detection of Kernel-Level Rootkits Using Hardware Performance Counters"],"prefix":"10.1145","author":[{"given":"Baljit","family":"Singh","sequence":"first","affiliation":[{"name":"Qatar University, Doha, Qatar"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Dmitry","family":"Evtyushkin","sequence":"additional","affiliation":[{"name":"State University of New York at Binghamton, Binghamton, NY, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Jesse","family":"Elwell","sequence":"additional","affiliation":[{"name":"Vencore Labs, Basking Ridge, NJ, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Ryan","family":"Riley","sequence":"additional","affiliation":[{"name":"Qatar University, Doha, Qatar"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Iliano","family":"Cervesato","sequence":"additional","affiliation":[{"name":"Carnegie Mellon University, Pittsburgh, PA, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2017,4,2]]},"reference":[{"key":"e_1_3_2_1_1_1","unstructured":"Intel\u00ae Software Guard Extensions Programming Reference 2014. Accessed Apr. 2016 at https:\/\/software.intel.com\/sites\/default\/files\/managed\/48\/88\/329298-002.pdf.  Intel\u00ae Software Guard Extensions Programming Reference 2014. Accessed Apr. 2016 at https:\/\/software.intel.com\/sites\/default\/files\/managed\/48\/88\/329298-002.pdf."},{"key":"e_1_3_2_1_2_1","volume-title":"A Study on Performance Monitoring Counters in x86-Architecture","author":"Bandyopadhyay S.","year":"2004","unstructured":"S. Bandyopadhyay . A Study on Performance Monitoring Counters in x86-Architecture . Indian Statistical Institute , 2004 . S. Bandyopadhyay. A Study on Performance Monitoring Counters in x86-Architecture. Indian Statistical Institute, 2004."},{"key":"e_1_3_2_1_3_1","volume-title":"Version 1.3","author":"Berrendorf R.","year":"1998","unstructured":"R. Berrendorf and H. Ziegler . PCL--the Performance Counter Library: A Common Interface to Access Hardware Performance Counters on Microprocessors , Version 1.3 , 1998 . R. Berrendorf and H. Ziegler. PCL--the Performance Counter Library: A Common Interface to Access Hardware Performance Counters on Microprocessors, Version 1.3, 1998."},{"key":"e_1_3_2_1_4_1","doi-asserted-by":"publisher","DOI":"10.1504\/IJESDF.2007.016865"},{"key":"e_1_3_2_1_5_1","doi-asserted-by":"publisher","DOI":"10.1177\/109434200001400303"},{"key":"e_1_3_2_1_6_1","doi-asserted-by":"publisher","DOI":"10.1145\/2485922.2485970"},{"key":"e_1_3_2_1_7_1","doi-asserted-by":"publisher","DOI":"10.1109\/MICRO.2014.25"},{"key":"e_1_3_2_1_8_1","doi-asserted-by":"publisher","DOI":"10.1145\/1656274.1656278"},{"key":"e_1_3_2_1_9_1","volume-title":"Rootkits: Subverting the Windows kernel","author":"Hoglund G.","year":"2006","unstructured":"G. Hoglund and J. Butler . Rootkits: Subverting the Windows kernel . Addison-Wesley Professional , 2006 . G. Hoglund and J. Butler. Rootkits: Subverting the Windows kernel. Addison-Wesley Professional, 2006."},{"key":"e_1_3_2_1_10_1","first-page":"383","volume-title":"Return-Oriented Rootkits: Bypassing Kernel Code Integrity Protection Mechanisms. In USENIX Security Symposium","author":"Hund R.","year":"2009","unstructured":"R. Hund , T. Holz , and F. C. Freiling . Return-Oriented Rootkits: Bypassing Kernel Code Integrity Protection Mechanisms. In USENIX Security Symposium , pages 383 -- 398 , 2009 . R. Hund, T. Holz, and F. C. Freiling. Return-Oriented Rootkits: Bypassing Kernel Code Integrity Protection Mechanisms. In USENIX Security Symposium, pages 383--398, 2009."},{"key":"e_1_3_2_1_11_1","volume-title":"Intel VTune Amplifier","author":"Intel Corporation","year":"2015","unstructured":"Intel Corporation . Intel VTune Amplifier 2015 . https:\/\/software.intel.com\/en-us\/intel-vtune-amplifier-xe. Last accessed January 2016. Intel Corporation. Intel VTune Amplifier 2015. https:\/\/software.intel.com\/en-us\/intel-vtune-amplifier-xe. Last accessed January 2016."},{"key":"e_1_3_2_1_12_1","doi-asserted-by":"publisher","DOI":"10.1109\/IPDPS.2005.448"},{"key":"e_1_3_2_1_13_1","first-page":"18","volume-title":"Department of Defense Users' Group Conference Proceedings","author":"London K.","year":"2001","unstructured":"K. London , S. Moore , P. Mucci , K. Seymour , and R. Luczak . The PAPI Cross-Platform Interface to Hardware Performance Counters . In Department of Defense Users' Group Conference Proceedings , pages 18 -- 21 , 2001 . K. London, S. Moore, P. Mucci, K. Seymour, and R. Luczak. The PAPI Cross-Platform Interface to Hardware Performance Counters. In Department of Defense Users' Group Conference Proceedings, pages 18--21, 2001."},{"key":"e_1_3_2_1_14_1","doi-asserted-by":"publisher","DOI":"10.1145\/2046582.2046596"},{"key":"e_1_3_2_1_15_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-26362-5_3"},{"key":"e_1_3_2_1_16_1","volume-title":"MPX: Software for Multiplexing Hardware Performance Counters in Multithreaded Programs. In Proceedings of the 15th International Parallel and Distributed Processing Symposium. IEEE","author":"May J. M.","year":"2001","unstructured":"J. M. May . MPX: Software for Multiplexing Hardware Performance Counters in Multithreaded Programs. In Proceedings of the 15th International Parallel and Distributed Processing Symposium. IEEE , 2001 . J. M. May. MPX: Software for Multiplexing Hardware Performance Counters in Multithreaded Programs. In Proceedings of the 15th International Parallel and Distributed Processing Symposium. IEEE, 2001."},{"key":"e_1_3_2_1_17_1","volume-title":"Introduction to File System Filter Drivers. https:\/\/msdn.microsoft.com\/en-us\/windows\/hardware\/drivers\/ifs\/introduction-to-file-system-filter-drivers. Last Accessed","author":"Microsoft Corporation","year":"2017","unstructured":"Microsoft Corporation . Introduction to File System Filter Drivers. https:\/\/msdn.microsoft.com\/en-us\/windows\/hardware\/drivers\/ifs\/introduction-to-file-system-filter-drivers. Last Accessed February 2017 . Microsoft Corporation. Introduction to File System Filter Drivers. https:\/\/msdn.microsoft.com\/en-us\/windows\/hardware\/drivers\/ifs\/introduction-to-file-system-filter-drivers. Last Accessed February 2017."},{"key":"e_1_3_2_1_18_1","first-page":"651","volume-title":"Malware-Aware Processors: A Framework for Efficient Online Malware Detection. In IEEE 21st International Symposium on High Performance Computer Architecture (HPCA 2015","author":"Ozsoy M.","year":"2015","unstructured":"M. Ozsoy , C. Donovick , I. Gorelik , N. Abu-Ghazaleh , and D. Ponomarev . Malware-Aware Processors: A Framework for Efficient Online Malware Detection. In IEEE 21st International Symposium on High Performance Computer Architecture (HPCA 2015 ), pages 651 -- 661 , 2015 . M. Ozsoy, C. Donovick, I. Gorelik, N. Abu-Ghazaleh, and D. Ponomarev. Malware-Aware Processors: A Framework for Efficient Online Malware Detection. In IEEE 21st International Symposium on High Performance Computer Architecture (HPCA 2015), pages 651--661, 2015."},{"key":"e_1_3_2_1_19_1","first-page":"447","volume-title":"USENIX Security","author":"Pappas V.","year":"2013","unstructured":"V. Pappas , M. Polychronakis , and A. D. Keromytis . Transparent ROP Exploit Mitigation Using Indirect Branch Tracing . In USENIX Security , pages 447 -- 462 , 2013 . V. Pappas, M. Polychronakis, and A. D. Keromytis. Transparent ROP Exploit Mitigation Using Indirect Branch Tracing. In USENIX Security, pages 447--462, 2013."},{"key":"e_1_3_2_1_20_1","doi-asserted-by":"publisher","DOI":"10.5555\/1953048.2078195"},{"key":"e_1_3_2_1_21_1","doi-asserted-by":"publisher","DOI":"10.1109\/ARES.2009.116"},{"key":"e_1_3_2_1_22_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2013.04.006"},{"key":"e_1_3_2_1_23_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-11747-3_3"},{"key":"e_1_3_2_1_24_1","doi-asserted-by":"publisher","DOI":"10.1145\/1315245.1315313"},{"key":"e_1_3_2_1_25_1","doi-asserted-by":"publisher","DOI":"10.1145\/1577129.1577137"},{"key":"e_1_3_2_1_26_1","doi-asserted-by":"publisher","DOI":"10.1109\/MM.2002.1028477"},{"key":"e_1_3_2_1_27_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-11379-1_6"},{"key":"e_1_3_2_1_28_1","volume-title":"VirusTotal-Free Online Virus, Malware and URL Scanner. https:\/\/www.virustotal.com\/. Last accessed","year":"2016","unstructured":"VirusTotal. VirusTotal-Free Online Virus, Malware and URL Scanner. https:\/\/www.virustotal.com\/. Last accessed February 2016 . VirusTotal. VirusTotal-Free Online Virus, Malware and URL Scanner. https:\/\/www.virustotal.com\/. Last accessed February 2016."},{"key":"e_1_3_2_1_29_1","doi-asserted-by":"publisher","DOI":"10.1145\/2463209.2488831"},{"key":"e_1_3_2_1_30_1","doi-asserted-by":"publisher","DOI":"10.1145\/1653662.1653728"},{"key":"e_1_3_2_1_31_1","doi-asserted-by":"publisher","DOI":"10.1109\/IISWC.2008.4636099"},{"key":"e_1_3_2_1_32_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-39235-1_3"}],"event":{"name":"ASIA CCS '17: ACM Asia Conference on Computer and Communications Security","location":"Abu Dhabi United Arab Emirates","acronym":"ASIA CCS '17","sponsor":["SIGSAC ACM Special Interest Group on Security, Audit, and Control"]},"container-title":["Proceedings of the 2017 ACM on Asia Conference on Computer and Communications Security"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3052973.3052999","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3052973.3052999","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,18]],"date-time":"2025-06-18T03:36:57Z","timestamp":1750217817000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3052973.3052999"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2017,4,2]]},"references-count":32,"alternative-id":["10.1145\/3052973.3052999","10.1145\/3052973"],"URL":"https:\/\/doi.org\/10.1145\/3052973.3052999","relation":{},"subject":[],"published":{"date-parts":[[2017,4,2]]},"assertion":[{"value":"2017-04-02","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}