{"id":"https://openalex.org/W3184036958","doi":"https://doi.org/10.1109/iolts52814.2021.9486701","title":"Adaptive-HMD: Accurate and Cost-Efficient Machine Learning-Driven Malware Detection using Microarchitectural Events","display_name":"Adaptive-HMD: Accurate and Cost-Efficient Machine Learning-Driven Malware Detection using Microarchitectural Events","publication_year":2021,"publication_date":"2021-06-28","ids":{"openalex":"https://openalex.org/W3184036958","doi":"https://doi.org/10.1109/iolts52814.2021.9486701","mag":"3184036958"},"language":"en","primary_location":{"id":"doi:10.1109/iolts52814.2021.9486701","is_oa":false,"landing_page_url":"https://doi.org/10.1109/iolts52814.2021.9486701","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2021 IEEE 27th International Symposium on On-Line Testing and Robust System Design (IOLTS)","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5025224867","display_name":"Yifeng Gao","orcid":"https://orcid.org/0000-0002-0629-050X"},"institutions":[{"id":"https://openalex.org/I162714631","display_name":"George Mason University","ror":"https://ror.org/02jqj7156","country_code":"US","type":"education","lineage":["https://openalex.org/I162714631"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Yifeng Gao","raw_affiliation_strings":["George Mason University, VA, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"George Mason University, VA, USA","institution_ids":["https://openalex.org/I162714631"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5044003457","display_name":"Hosein Mohammadi Makrani","orcid":"https://orcid.org/0000-0002-5088-8728"},"institutions":[{"id":"https://openalex.org/I84218800","display_name":"University of California, Davis","ror":"https://ror.org/05rrcem69","country_code":"US","type":"education","lineage":["https://openalex.org/I84218800"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Hosein Mohammadi Makrani","raw_affiliation_strings":["University of California, Davis, CA, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of California, Davis, CA, USA","institution_ids":["https://openalex.org/I84218800"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5074064662","display_name":"Mehrdad Aliasgari","orcid":"https://orcid.org/0000-0002-9019-6857"},"institutions":[{"id":"https://openalex.org/I59897056","display_name":"California State University, Long Beach","ror":"https://ror.org/0080fxk18","country_code":"US","type":"education","lineage":["https://openalex.org/I59897056"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Mehrdad Aliasgari","raw_affiliation_strings":["California State University, Long Beach, CA, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"California State University, Long Beach, CA, USA","institution_ids":["https://openalex.org/I59897056"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5013526466","display_name":"Amin Rezaei","orcid":"https://orcid.org/0000-0002-7469-3642"},"institutions":[{"id":"https://openalex.org/I59897056","display_name":"California State University, Long Beach","ror":"https://ror.org/0080fxk18","country_code":"US","type":"education","lineage":["https://openalex.org/I59897056"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Amin Rezaei","raw_affiliation_strings":["California State University, Long Beach, CA, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"California State University, Long Beach, CA, USA","institution_ids":["https://openalex.org/I59897056"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101558875","display_name":"Jessica Lin","orcid":"https://orcid.org/0000-0002-4887-0692"},"institutions":[{"id":"https://openalex.org/I162714631","display_name":"George Mason University","ror":"https://ror.org/02jqj7156","country_code":"US","type":"education","lineage":["https://openalex.org/I162714631"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Jessica Lin","raw_affiliation_strings":["George Mason University, VA, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"George Mason University, VA, USA","institution_ids":["https://openalex.org/I162714631"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5047382437","display_name":"Houman Homayoun","orcid":"https://orcid.org/0000-0001-8904-4699"},"institutions":[{"id":"https://openalex.org/I84218800","display_name":"University of California, Davis","ror":"https://ror.org/05rrcem69","country_code":"US","type":"education","lineage":["https://openalex.org/I84218800"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Houman Homayoun","raw_affiliation_strings":["University of California, Davis, CA, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of California, Davis, CA, USA","institution_ids":["https://openalex.org/I84218800"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5080844858","display_name":"Hossein Sayadi","orcid":"https://orcid.org/0000-0001-6423-0145"},"institutions":[{"id":"https://openalex.org/I59897056","display_name":"California State University, Long Beach","ror":"https://ror.org/0080fxk18","country_code":"US","type":"education","lineage":["https://openalex.org/I59897056"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Hossein Sayadi","raw_affiliation_strings":["California State University, Long Beach, CA, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"California State University, Long Beach, CA, USA","institution_ids":["https://openalex.org/I59897056"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":2.9007,"has_fulltext":false,"cited_by_count":22,"citation_normalized_percentile":{"value":0.93442849,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":94,"max":99},"biblio":{"volume":null,"issue":null,"first_page":"1","last_page":"7"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.9968000054359436,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9919999837875366,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8554974794387817},{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.8299256563186646},{"id":"https://openalex.org/keywords/machine-learning","display_name":"Machine learning","score":0.5463701486587524},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.5107791423797607},{"id":"https://openalex.org/keywords/false-positive-rate","display_name":"False positive rate","score":0.45184776186943054},{"id":"https://openalex.org/keywords/latency","display_name":"Latency (audio)","score":0.4447597861289978},{"id":"https://openalex.org/keywords/overhead","display_name":"Overhead (engineering)","score":0.4249430298805237},{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.421853244304657},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.1884625256061554}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8554974794387817},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.8299256563186646},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.5463701486587524},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.5107791423797607},{"id":"https://openalex.org/C95922358","wikidata":"https://www.wikidata.org/wiki/Q5432725","display_name":"False positive rate","level":2,"score":0.45184776186943054},{"id":"https://openalex.org/C82876162","wikidata":"https://www.wikidata.org/wiki/Q17096504","display_name":"Latency (audio)","level":2,"score":0.4447597861289978},{"id":"https://openalex.org/C2779960059","wikidata":"https://www.wikidata.org/wiki/Q7113681","display_name":"Overhead (engineering)","level":2,"score":0.4249430298805237},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.421853244304657},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.1884625256061554},{"id":"https://openalex.org/C76155785","wikidata":"https://www.wikidata.org/wiki/Q418","display_name":"Telecommunications","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/iolts52814.2021.9486701","is_oa":false,"landing_page_url":"https://doi.org/10.1109/iolts52814.2021.9486701","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2021 IEEE 27th International Symposium on On-Line Testing and Robust System Design (IOLTS)","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":32,"referenced_works":["https://openalex.org/W1534477342","https://openalex.org/W1570713908","https://openalex.org/W1686420892","https://openalex.org/W2023294425","https://openalex.org/W2036853599","https://openalex.org/W2089468765","https://openalex.org/W2105809105","https://openalex.org/W2113261561","https://openalex.org/W2133990480","https://openalex.org/W2138471478","https://openalex.org/W2141577524","https://openalex.org/W2166844173","https://openalex.org/W2292977173","https://openalex.org/W2508317201","https://openalex.org/W2594364040","https://openalex.org/W2602229646","https://openalex.org/W2606101940","https://openalex.org/W2784097977","https://openalex.org/W2809457377","https://openalex.org/W2890774642","https://openalex.org/W2893549539","https://openalex.org/W2893959673","https://openalex.org/W2950774332","https://openalex.org/W3036243698","https://openalex.org/W3046195620","https://openalex.org/W3083161653","https://openalex.org/W3083702481","https://openalex.org/W3161833296","https://openalex.org/W4232751114","https://openalex.org/W4256383029","https://openalex.org/W6632075054","https://openalex.org/W6795002036"],"related_works":["https://openalex.org/W2097492617","https://openalex.org/W2753240997","https://openalex.org/W1764168690","https://openalex.org/W2537959205","https://openalex.org/W2740895074","https://openalex.org/W2772446090","https://openalex.org/W2388600609","https://openalex.org/W4283736679","https://openalex.org/W4283582846","https://openalex.org/W2997814891"],"abstract_inverted_index":{"To":[0],"address":[1],"the":[2,51,75,110,121,127,130,134,147,154,198,207,215,243],"high":[3],"complexity":[4],"and":[5,83,101,133,169,218,225],"computational":[6],"overheads":[7],"of":[8,53,57,77,97,104,112,129,245],"conventional":[9],"software-based":[10],"detection":[11,25,63,142,177,212,238,248,259],"techniques,":[12],"Hardware":[13,40],"Malware":[14],"Detection":[15],"(HMD)":[16],"has":[17],"shown":[18],"promising":[19],"results":[20,230],"as":[21,253],"an":[22,81,167],"alternative":[23],"anomaly":[24],"solution.":[26],"HMD":[27],"methods":[28],"apply":[29],"Machine":[30],"Learning":[31],"(ML)":[32],"classifiers":[33],"on":[34,68],"microarchitectural":[35,180],"events":[36,181],"monitored":[37],"by":[38,249],"built-in":[39],"Performance":[41],"Counter":[42],"(HPC)":[43],"registers":[44],"available":[45],"in":[46,161,209],"modern":[47],"microprocessors":[48],"to":[49,73,116,145,203,214,236,255],"recognize":[50],"patterns":[52],"anomalies":[54],"(e.g.,":[55],"signatures":[56],"malicious":[58,98,118],"applications).":[59],"Existing":[60],"hardware":[61,122],"malware":[62,78,88,156,176,211,247,258],"solutions":[64],"have":[65],"mainly":[66],"focused":[67],"utilizing":[69],"standard":[70],"ML":[71,114,150,201],"algorithms":[72,107],"detect":[74,117],"existence":[76],"without":[79],"considering":[80],"adaptive":[82],"cost-efficient":[84,170],"approach":[85],"for":[86,152,174,206],"online":[87,175,210],"detection.":[89],"Our":[90],"comprehensive":[91],"analysis":[92],"across":[93],"a":[94,190],"wide":[95],"range":[96],"software":[99],"applications":[100,119],"different":[102],"branches":[103],"machine":[105,171],"learning":[106],"indicates":[108],"that":[109,195,232],"type":[111,128],"adopted":[113],"algorithm":[115,194],"at":[120],"level":[123],"highly":[124],"correlates":[125],"with":[126,189],"examined":[131],"malware,":[132],"ultimate":[135],"performance":[136,220],"evaluation":[137],"metric":[138],"(F-measure,":[139],"robustness,":[140],"latency,":[141],"rate/cost,":[143],"etc.)":[144],"select":[146],"most":[148,199],"efficient":[149,200],"model":[151,202],"distinguishing":[153],"target":[155],"from":[157,183],"benign":[158],"program.":[159],"Therefore,":[160],"this":[162],"work":[163],"we":[164],"propose":[165],"Adaptive-HMD,":[166],"accurate":[168],"learning-driven":[172],"framework":[173],"using":[178],"low-level":[179],"collected":[182],"HPC":[184],"registers.":[185],"Adaptive-HMD":[186,233],"is":[187],"equipped":[188],"lightweight":[191],"tree-based":[192],"decision-making":[193],"accurately":[196],"selects":[197],"be":[204],"used":[205],"inference":[208],"according":[213],"users'":[216],"preference":[217],"optimal":[219],"vs.":[221],"cost":[222],"(hardware":[223],"overhead":[224],"latency)":[226],"criteria.":[227],"The":[228],"experimental":[229],"demonstrate":[231],"achieves":[234],"up":[235],"94%":[237],"rate":[239],"(F-measure)":[240],"while":[241],"improving":[242],"cost-efficiency":[244],"ML-based":[246],"more":[250],"than":[251],"5X":[252],"compared":[254],"existing":[256],"ensemble-based":[257],"methods.":[260]},"counts_by_year":[{"year":2026,"cited_by_count":1},{"year":2025,"cited_by_count":5},{"year":2024,"cited_by_count":7},{"year":2023,"cited_by_count":7},{"year":2022,"cited_by_count":2}],"updated_date":"2026-07-29T14:22:42.915294","created_date":"2025-10-10T00:00:00"}