{"id":"https://openalex.org/W4288057708","doi":"https://doi.org/10.1109/sp46214.2022.9833745","title":"HARDLOG: Practical Tamper-Proof System Auditing Using a Novel Audit Device","display_name":"HARDLOG: Practical Tamper-Proof System Auditing Using a Novel Audit Device","publication_year":2022,"publication_date":"2022-05-01","ids":{"openalex":"https://openalex.org/W4288057708","doi":"https://doi.org/10.1109/sp46214.2022.9833745"},"language":"en","primary_location":{"id":"doi:10.1109/sp46214.2022.9833745","is_oa":false,"landing_page_url":"https://doi.org/10.1109/sp46214.2022.9833745","pdf_url":null,"source":{"id":"https://openalex.org/S4363606603","display_name":"2022 IEEE Symposium on Security and Privacy (SP)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2022 IEEE Symposium on Security and Privacy (SP)","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5050354630","display_name":"Adil M. Ahmad","orcid":"https://orcid.org/0000-0003-3583-4518"},"institutions":[{"id":"https://openalex.org/I219193219","display_name":"Purdue University West Lafayette","ror":"https://ror.org/02dqehb95","country_code":"US","type":"education","lineage":["https://openalex.org/I219193219"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Adil Ahmad","raw_affiliation_strings":["Purdue University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Purdue University","institution_ids":["https://openalex.org/I219193219"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100330701","display_name":"Sangho Lee","orcid":"https://orcid.org/0000-0002-0412-7768"},"institutions":[{"id":"https://openalex.org/I4210164937","display_name":"Microsoft Research (United Kingdom)","ror":"https://ror.org/05k87vq12","country_code":"GB","type":"company","lineage":["https://openalex.org/I1290206253","https://openalex.org/I4210164937"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Sangho Lee","raw_affiliation_strings":["Microsoft Research"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Microsoft Research","institution_ids":["https://openalex.org/I4210164937"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5085380425","display_name":"Marcus Peinado","orcid":"https://orcid.org/0009-0001-4711-0675"},"institutions":[{"id":"https://openalex.org/I4210164937","display_name":"Microsoft Research (United Kingdom)","ror":"https://ror.org/05k87vq12","country_code":"GB","type":"company","lineage":["https://openalex.org/I1290206253","https://openalex.org/I4210164937"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Marcus Peinado","raw_affiliation_strings":["Microsoft Research"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Microsoft Research","institution_ids":["https://openalex.org/I4210164937"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":3.8799,"has_fulltext":false,"cited_by_count":29,"citation_normalized_percentile":{"value":0.94877394,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":97,"max":99},"biblio":{"volume":null,"issue":null,"first_page":"1791","last_page":"1807"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9994999766349792,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":0.9973999857902527,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/audit","display_name":"Audit","score":0.7753067016601562},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.6511562466621399},{"id":"https://openalex.org/keywords/proof-of-concept","display_name":"Proof of concept","score":0.4925328195095062},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.4716795086860657},{"id":"https://openalex.org/keywords/tamper-resistance","display_name":"Tamper resistance","score":0.4466601610183716},{"id":"https://openalex.org/keywords/business","display_name":"Business","score":0.13490018248558044},{"id":"https://openalex.org/keywords/accounting","display_name":"Accounting","score":0.11616653203964233},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.0698900818824768}],"concepts":[{"id":"https://openalex.org/C199521495","wikidata":"https://www.wikidata.org/wiki/Q181487","display_name":"Audit","level":2,"score":0.7753067016601562},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6511562466621399},{"id":"https://openalex.org/C124978682","wikidata":"https://www.wikidata.org/wiki/Q1201019","display_name":"Proof of concept","level":2,"score":0.4925328195095062},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.4716795086860657},{"id":"https://openalex.org/C19163912","wikidata":"https://www.wikidata.org/wiki/Q7681779","display_name":"Tamper resistance","level":2,"score":0.4466601610183716},{"id":"https://openalex.org/C144133560","wikidata":"https://www.wikidata.org/wiki/Q4830453","display_name":"Business","level":0,"score":0.13490018248558044},{"id":"https://openalex.org/C121955636","wikidata":"https://www.wikidata.org/wiki/Q4116214","display_name":"Accounting","level":1,"score":0.11616653203964233},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.0698900818824768}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/sp46214.2022.9833745","is_oa":false,"landing_page_url":"https://doi.org/10.1109/sp46214.2022.9833745","pdf_url":null,"source":{"id":"https://openalex.org/S4363606603","display_name":"2022 IEEE Symposium on Security and Privacy (SP)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2022 IEEE Symposium on Security and Privacy (SP)","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/16","display_name":"Peace, Justice and strong institutions","score":0.46000000834465027}],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":97,"referenced_works":["https://openalex.org/W141761747","https://openalex.org/W168132470","https://openalex.org/W187572568","https://openalex.org/W1534092936","https://openalex.org/W1965159911","https://openalex.org/W1983949504","https://openalex.org/W2014517322","https://openalex.org/W2018045700","https://openalex.org/W2022185456","https://openalex.org/W2036548030","https://openalex.org/W2045231167","https://openalex.org/W2057743816","https://openalex.org/W2061643296","https://openalex.org/W2069291604","https://openalex.org/W2087499441","https://openalex.org/W2096347345","https://openalex.org/W2098721736","https://openalex.org/W2105321788","https://openalex.org/W2136310957","https://openalex.org/W2141859544","https://openalex.org/W2167804035","https://openalex.org/W2181368052","https://openalex.org/W2183816381","https://openalex.org/W2244905785","https://openalex.org/W2252980215","https://openalex.org/W2255548496","https://openalex.org/W2493858325","https://openalex.org/W2532844970","https://openalex.org/W2559892799","https://openalex.org/W2579106964","https://openalex.org/W2579121572","https://openalex.org/W2601206855","https://openalex.org/W2605883969","https://openalex.org/W2747669027","https://openalex.org/W2766852928","https://openalex.org/W2777203589","https://openalex.org/W2790557990","https://openalex.org/W2885157095","https://openalex.org/W2886539179","https://openalex.org/W2888974175","https://openalex.org/W2889245788","https://openalex.org/W2889467723","https://openalex.org/W2889727957","https://openalex.org/W2914526992","https://openalex.org/W2920921666","https://openalex.org/W2934166125","https://openalex.org/W2944900776","https://openalex.org/W2947745012","https://openalex.org/W2949034369","https://openalex.org/W2962903267","https://openalex.org/W2963034244","https://openalex.org/W2964540713","https://openalex.org/W2974742226","https://openalex.org/W2999600391","https://openalex.org/W3008991042","https://openalex.org/W3015650867","https://openalex.org/W3046761684","https://openalex.org/W3081770884","https://openalex.org/W3091936459","https://openalex.org/W3094213939","https://openalex.org/W3096346199","https://openalex.org/W3109160943","https://openalex.org/W3135539582","https://openalex.org/W3157604780","https://openalex.org/W3160527021","https://openalex.org/W3163863206","https://openalex.org/W3175109846","https://openalex.org/W3196221007","https://openalex.org/W4205777466","https://openalex.org/W4244320837","https://openalex.org/W4287394342","https://openalex.org/W6605793882","https://openalex.org/W6606869816","https://openalex.org/W6638906098","https://openalex.org/W6675248781","https://openalex.org/W6675903601","https://openalex.org/W6720060846","https://openalex.org/W6722970870","https://openalex.org/W6732338751","https://openalex.org/W6753967410","https://openalex.org/W6754375631","https://openalex.org/W6754481008","https://openalex.org/W6754707075","https://openalex.org/W6758681461","https://openalex.org/W6758979328","https://openalex.org/W6763411181","https://openalex.org/W6781503496","https://openalex.org/W6782203875","https://openalex.org/W6790748001","https://openalex.org/W6791395217","https://openalex.org/W6794723050","https://openalex.org/W6794740203","https://openalex.org/W6795455577","https://openalex.org/W6797143213","https://openalex.org/W6801247658","https://openalex.org/W7044205949","https://openalex.org/W7074579249"],"related_works":["https://openalex.org/W4391375266","https://openalex.org/W2899084033","https://openalex.org/W2748952813","https://openalex.org/W2390279801","https://openalex.org/W4391913857","https://openalex.org/W2358668433","https://openalex.org/W2113607124","https://openalex.org/W4312976758","https://openalex.org/W3109160943","https://openalex.org/W2041743403"],"abstract_inverted_index":{"Audit":[0],"systems":[1,49],"maintain":[2],"detailed":[3],"logs":[4,19,52,99,117],"of":[5,57,185,212],"security-related":[6],"events":[7,124,190],"on":[8,121,131],"enterprise":[9],"machines":[10],"to":[11,42,63,82,114,125,142],"forensically":[12],"analyze":[13],"potential":[14],"incidents.":[15],"In":[16],"principle,":[17],"these":[18],"should":[20],"be":[21],"safely":[22],"stored":[23],"in":[24,103],"a":[25,43,71,78,147,172,181,207],"secure":[26],"location":[27],"(e.g.,":[28,54],"network":[29],"storage)":[30],"as":[31,33],"soon":[32],"they":[34],"are":[35,100,118],"produced,":[36],"but":[37,59,116],"this":[38,60],"incurs":[39,206],"prohibitive":[40],"slowdown":[41,211],"monitored":[44],"machine.":[45],"Hence,":[46],"existing":[47],"audit":[48,80,105,144,165,174],"protect":[50],"batched":[51],"asynchronously":[53,119],"after":[55],"tens":[56],"seconds),":[58],"allows":[61],"attackers":[62],"tamper":[64],"with":[65,87],"unprotected":[66],"logs.This":[67],"paper":[68],"presents":[69],"HARDLOG,":[70],"practical":[72],"and":[73,170],"effective":[74],"system":[75,175],"that":[76,98],"employs":[77],"novel":[79],"device":[81,106,145,166],"provide":[83],"fine-grained":[84],"log":[85,94,140],"protection":[86,183,193],"minimal":[88],"performance":[89,127,210],"slowdown.":[90],"HARDLOG":[91,134,205],"implements":[92],"criticality-aware":[93],"protection:":[95,137],"it":[96,138,216],"ensures":[97,135],"synchronously":[101],"protected":[102,120],"the":[104,143],"before":[107],"an":[108,164],"infrequent":[109],"security-critical":[110],"event":[111],"is":[112,217],"allowed":[113],"execute,":[115],"frequent":[122],"non-critical":[123,132,189],"minimize":[126],"overhead.":[128],"Importantly,":[129],"even":[130],"events,":[133],"bounded-asynchronous":[136],"sends":[139],"entries":[141],"within":[146],"tiny,":[148],"bounded":[149,182],"delay":[150,184],"from":[151],"their":[152],"creation":[153],"using":[154,167],"well-known":[155],"real-time":[156],"techniques.":[157],"To":[158],"demonstrate":[159],"HARDLOG\u2019S":[160],"effectiveness,":[161],"we":[162],"prototyped":[163],"commodity":[168],"components":[169],"implemented":[171],"reference":[173],"for":[176,201,219],"Linux.":[177],"Our":[178],"prototype":[179],"achieves":[180],"15":[186],"milliseconds":[187],"at":[188,194],"alongside":[191],"undelayed":[192],"critical":[195],"events.":[196],"We":[197],"also":[198],"show":[199],"that,":[200],"diverse":[202],"real-world":[203,221],"programs,":[204],"geometric":[208],"mean":[209],"only":[213],"6.3%,":[214],"hence":[215],"suitable":[218],"many":[220],"deployment":[222],"scenarios.":[223]},"counts_by_year":[{"year":2026,"cited_by_count":6},{"year":2025,"cited_by_count":9},{"year":2024,"cited_by_count":10},{"year":2023,"cited_by_count":4}],"updated_date":"2026-07-29T14:22:42.915294","created_date":"2025-10-10T00:00:00"}