{"id":"https://openalex.org/W2963893085","doi":"https://doi.org/10.1109/tdsc.2019.2906161","title":"Checking is Believing: Event-Aware Program Anomaly Detection in Cyber-Physical Systems","display_name":"Checking is Believing: Event-Aware Program Anomaly Detection in Cyber-Physical Systems","publication_year":2019,"publication_date":"2019-03-19","ids":{"openalex":"https://openalex.org/W2963893085","doi":"https://doi.org/10.1109/tdsc.2019.2906161","mag":"2963893085"},"language":"en","primary_location":{"id":"doi:10.1109/tdsc.2019.2906161","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tdsc.2019.2906161","pdf_url":null,"source":{"id":"https://openalex.org/S133795288","display_name":"IEEE Transactions on Dependable and Secure Computing","issn_l":"1545-5971","issn":["1545-5971","1941-0018","2160-9209"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320439","host_organization_name":"IEEE Computer Society","host_organization_lineage":["https://openalex.org/P4310320439","https://openalex.org/P4310319808"],"host_organization_lineage_names":["IEEE Computer Society","Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Dependable and Secure Computing","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5101731002","display_name":"Long Cheng","orcid":"https://orcid.org/0000-0003-1736-0873"},"institutions":[{"id":"https://openalex.org/I8078737","display_name":"Clemson University","ror":"https://ror.org/037s24f05","country_code":"US","type":"education","lineage":["https://openalex.org/I8078737"]}],"countries":["US"],"is_corresponding":true,"raw_author_name":"Long Cheng","raw_affiliation_strings":["School of Computing, Clemson University, Clemson, SC, USA"],"affiliations":[{"raw_affiliation_string":"School of Computing, Clemson University, Clemson, SC, USA","institution_ids":["https://openalex.org/I8078737"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5047718767","display_name":"Ke Tian","orcid":"https://orcid.org/0000-0002-6784-5820"},"institutions":[{"id":"https://openalex.org/I1290206253","display_name":"Microsoft (United States)","ror":"https://ror.org/00d0nc645","country_code":"US","type":"company","lineage":["https://openalex.org/I1290206253"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Ke Tian","raw_affiliation_strings":["Microsoft, Redmond, Redmond, WA, USA"],"affiliations":[{"raw_affiliation_string":"Microsoft, Redmond, Redmond, WA, USA","institution_ids":["https://openalex.org/I1290206253"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5034366344","display_name":"Danfeng Yao","orcid":"https://orcid.org/0000-0001-8969-2792"},"institutions":[{"id":"https://openalex.org/I859038795","display_name":"Virginia Tech","ror":"https://ror.org/02smfhw86","country_code":"US","type":"education","lineage":["https://openalex.org/I859038795"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Danfeng Daphne Yao","raw_affiliation_strings":["Department of Computer Science, Virginia Tech, VA, USA"],"affiliations":[{"raw_affiliation_string":"Department of Computer Science, Virginia Tech, VA, USA","institution_ids":["https://openalex.org/I859038795"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5067032971","display_name":"Lui Sha","orcid":"https://orcid.org/0000-0002-5578-0791"},"institutions":[{"id":"https://openalex.org/I157725225","display_name":"University of Illinois Urbana-Champaign","ror":"https://ror.org/047426m28","country_code":"US","type":"education","lineage":["https://openalex.org/I157725225"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Lui Sha","raw_affiliation_strings":["Department of Computer Science, University of Illinois at Urbana Champaign, Champaign, IL, USA"],"affiliations":[{"raw_affiliation_string":"Department of Computer Science, University of Illinois at Urbana Champaign, Champaign, IL, USA","institution_ids":["https://openalex.org/I157725225"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5033073212","display_name":"Raheem Beyah","orcid":"https://orcid.org/0000-0002-9188-3464"},"institutions":[{"id":"https://openalex.org/I130701444","display_name":"Georgia Institute of Technology","ror":"https://ror.org/01zkghx44","country_code":"US","type":"education","lineage":["https://openalex.org/I130701444"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Raheem A. Beyah","raw_affiliation_strings":["School of Electrical and Computer Engineering, Georgia Tech, GA, USA"],"affiliations":[{"raw_affiliation_string":"School of Electrical and Computer Engineering, Georgia Tech, GA, USA","institution_ids":["https://openalex.org/I130701444"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":5,"corresponding_author_ids":["https://openalex.org/A5101731002"],"corresponding_institution_ids":["https://openalex.org/I8078737"],"apc_list":null,"apc_paid":null,"fwci":3.3237,"has_fulltext":false,"cited_by_count":44,"citation_normalized_percentile":{"value":0.93921606,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":95,"max":99},"biblio":{"volume":"18","issue":"2","first_page":"825","last_page":"842"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.9997000098228455,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.9997000098228455,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9986000061035156,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10917","display_name":"Smart Grid Security and Resilience","score":0.9979000091552734,"subfield":{"id":"https://openalex.org/subfields/2207","display_name":"Control and Systems Engineering"},"field":{"id":"https://openalex.org/fields/22","display_name":"Engineering"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8235895037651062},{"id":"https://openalex.org/keywords/cyber-physical-system","display_name":"Cyber-physical system","score":0.6915050745010376},{"id":"https://openalex.org/keywords/event","display_name":"Event (particle physics)","score":0.5594555139541626},{"id":"https://openalex.org/keywords/exploit","display_name":"Exploit","score":0.5488945245742798},{"id":"https://openalex.org/keywords/overhead","display_name":"Overhead (engineering)","score":0.5420213341712952},{"id":"https://openalex.org/keywords/context","display_name":"Context (archaeology)","score":0.525322437286377},{"id":"https://openalex.org/keywords/data-integrity","display_name":"Data integrity","score":0.5221298336982727},{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.5192860960960388},{"id":"https://openalex.org/keywords/consistency","display_name":"Consistency (knowledge bases)","score":0.49717476963996887},{"id":"https://openalex.org/keywords/runtime-verification","display_name":"Runtime verification","score":0.4949340224266052},{"id":"https://openalex.org/keywords/finite-state-machine","display_name":"Finite-state machine","score":0.4785202741622925},{"id":"https://openalex.org/keywords/semantics","display_name":"Semantics (computer science)","score":0.4342975318431854},{"id":"https://openalex.org/keywords/distributed-computing","display_name":"Distributed computing","score":0.36496829986572266},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.32644879817962646},{"id":"https://openalex.org/keywords/programming-language","display_name":"Programming language","score":0.2762880325317383},{"id":"https://openalex.org/keywords/formal-verification","display_name":"Formal verification","score":0.24127617478370667},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.15795046091079712},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.10885593295097351}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8235895037651062},{"id":"https://openalex.org/C179768478","wikidata":"https://www.wikidata.org/wiki/Q1120057","display_name":"Cyber-physical system","level":2,"score":0.6915050745010376},{"id":"https://openalex.org/C2779662365","wikidata":"https://www.wikidata.org/wiki/Q5416694","display_name":"Event (particle physics)","level":2,"score":0.5594555139541626},{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.5488945245742798},{"id":"https://openalex.org/C2779960059","wikidata":"https://www.wikidata.org/wiki/Q7113681","display_name":"Overhead (engineering)","level":2,"score":0.5420213341712952},{"id":"https://openalex.org/C2779343474","wikidata":"https://www.wikidata.org/wiki/Q3109175","display_name":"Context (archaeology)","level":2,"score":0.525322437286377},{"id":"https://openalex.org/C33762810","wikidata":"https://www.wikidata.org/wiki/Q461671","display_name":"Data integrity","level":2,"score":0.5221298336982727},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.5192860960960388},{"id":"https://openalex.org/C2776436953","wikidata":"https://www.wikidata.org/wiki/Q5163215","display_name":"Consistency (knowledge bases)","level":2,"score":0.49717476963996887},{"id":"https://openalex.org/C202973057","wikidata":"https://www.wikidata.org/wiki/Q7380130","display_name":"Runtime verification","level":3,"score":0.4949340224266052},{"id":"https://openalex.org/C167822520","wikidata":"https://www.wikidata.org/wiki/Q176452","display_name":"Finite-state machine","level":2,"score":0.4785202741622925},{"id":"https://openalex.org/C184337299","wikidata":"https://www.wikidata.org/wiki/Q1437428","display_name":"Semantics (computer science)","level":2,"score":0.4342975318431854},{"id":"https://openalex.org/C120314980","wikidata":"https://www.wikidata.org/wiki/Q180634","display_name":"Distributed computing","level":1,"score":0.36496829986572266},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.32644879817962646},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.2762880325317383},{"id":"https://openalex.org/C111498074","wikidata":"https://www.wikidata.org/wiki/Q173326","display_name":"Formal verification","level":2,"score":0.24127617478370667},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.15795046091079712},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.10885593295097351},{"id":"https://openalex.org/C151730666","wikidata":"https://www.wikidata.org/wiki/Q7205","display_name":"Paleontology","level":1,"score":0.0},{"id":"https://openalex.org/C121332964","wikidata":"https://www.wikidata.org/wiki/Q413","display_name":"Physics","level":0,"score":0.0},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.0},{"id":"https://openalex.org/C62520636","wikidata":"https://www.wikidata.org/wiki/Q944","display_name":"Quantum mechanics","level":1,"score":0.0},{"id":"https://openalex.org/C86803240","wikidata":"https://www.wikidata.org/wiki/Q420","display_name":"Biology","level":0,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/tdsc.2019.2906161","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tdsc.2019.2906161","pdf_url":null,"source":{"id":"https://openalex.org/S133795288","display_name":"IEEE Transactions on Dependable and Secure Computing","issn_l":"1545-5971","issn":["1545-5971","1941-0018","2160-9209"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320439","host_organization_name":"IEEE Computer Society","host_organization_lineage":["https://openalex.org/P4310320439","https://openalex.org/P4310319808"],"host_organization_lineage_names":["IEEE Computer Society","Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Dependable and Secure Computing","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[{"score":0.8199999928474426,"id":"https://metadata.un.org/sdg/16","display_name":"Peace, Justice and strong institutions"}],"awards":[{"id":"https://openalex.org/G5981245596","display_name":null,"funder_award_id":"OAC-1541105","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"},{"id":"https://openalex.org/G8855059253","display_name":null,"funder_award_id":"ONR-N00014-17-1-2498","funder_id":"https://openalex.org/F4320337345","funder_display_name":"Office of Naval Research"}],"funders":[{"id":"https://openalex.org/F4320306076","display_name":"National Science Foundation","ror":"https://ror.org/021nxhr62"},{"id":"https://openalex.org/F4320337345","display_name":"Office of Naval Research","ror":"https://ror.org/00rk2pe57"}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":83,"referenced_works":["https://openalex.org/W1112477","https://openalex.org/W27630839","https://openalex.org/W260232723","https://openalex.org/W790201181","https://openalex.org/W1429241971","https://openalex.org/W1479871422","https://openalex.org/W1534103258","https://openalex.org/W1547425928","https://openalex.org/W1586807939","https://openalex.org/W1896211881","https://openalex.org/W1947347140","https://openalex.org/W1965113125","https://openalex.org/W1967029962","https://openalex.org/W1982466846","https://openalex.org/W1984350393","https://openalex.org/W1987380082","https://openalex.org/W1992439546","https://openalex.org/W1995790716","https://openalex.org/W2005028112","https://openalex.org/W2008230196","https://openalex.org/W2008704879","https://openalex.org/W2014720601","https://openalex.org/W2021937151","https://openalex.org/W2044653231","https://openalex.org/W2051054517","https://openalex.org/W2056451850","https://openalex.org/W2068693276","https://openalex.org/W2070090222","https://openalex.org/W2085379628","https://openalex.org/W2086239403","https://openalex.org/W2096224818","https://openalex.org/W2106649514","https://openalex.org/W2109219878","https://openalex.org/W2111404412","https://openalex.org/W2117115928","https://openalex.org/W2123886726","https://openalex.org/W2129860818","https://openalex.org/W2135143063","https://openalex.org/W2138788987","https://openalex.org/W2141389113","https://openalex.org/W2143842190","https://openalex.org/W2153256720","https://openalex.org/W2160510992","https://openalex.org/W2161630727","https://openalex.org/W2295709271","https://openalex.org/W2406810199","https://openalex.org/W2512784977","https://openalex.org/W2535751405","https://openalex.org/W2537014044","https://openalex.org/W2539766308","https://openalex.org/W2562737615","https://openalex.org/W2576376563","https://openalex.org/W2594266659","https://openalex.org/W2606193874","https://openalex.org/W2613352518","https://openalex.org/W2613412685","https://openalex.org/W2618486284","https://openalex.org/W2664781091","https://openalex.org/W2752493903","https://openalex.org/W2752858240","https://openalex.org/W2753352458","https://openalex.org/W2755572540","https://openalex.org/W2774169481","https://openalex.org/W2787402405","https://openalex.org/W2805774329","https://openalex.org/W2807864928","https://openalex.org/W2809074708","https://openalex.org/W3158541704","https://openalex.org/W4235261014","https://openalex.org/W4237248368","https://openalex.org/W4299295885","https://openalex.org/W6600040955","https://openalex.org/W6601139416","https://openalex.org/W6628351959","https://openalex.org/W6635038715","https://openalex.org/W6639634581","https://openalex.org/W6640877134","https://openalex.org/W6668129199","https://openalex.org/W6677520968","https://openalex.org/W6731087150","https://openalex.org/W6738581211","https://openalex.org/W6744280195","https://openalex.org/W6748309930"],"related_works":["https://openalex.org/W3004173571","https://openalex.org/W2546638913","https://openalex.org/W2209816623","https://openalex.org/W2968885840","https://openalex.org/W3135700974","https://openalex.org/W4313307484","https://openalex.org/W2791379413","https://openalex.org/W2086962923","https://openalex.org/W3094048663","https://openalex.org/W4289219861"],"abstract_inverted_index":{"Securing":[0],"cyber-physical":[1,86,97,221],"systems":[2],"(CPS)":[3],"against":[4,81],"malicious":[5],"attacks":[6,13,36,44,83],"is":[7,168],"of":[8,64,100,125,144,148],"paramount":[9],"importance":[10],"because":[11],"these":[12],"may":[14],"cause":[15],"irreparable":[16],"damages":[17],"to":[18,55,61],"physical":[19,109,166],"systems.":[20],"Recent":[21],"studies":[22,186],"have":[23],"revealed":[24],"that":[25,192],"control":[26,102,113,150],"programs":[27,151],"running":[28],"on":[29,202],"CPS":[30,149],"devices":[31],"suffer":[32],"from":[33],"both":[34],"control-oriented":[35],"(e.g.,":[37,45],"code-injection":[38],"or":[39],"code-reuse":[40],"attacks)":[41],"and":[42,111,119,152,217],"data-oriented":[43,58,82,161,188],"non-control":[46],"data":[47],"attacks).":[48],"Unfortunately,":[49],"existing":[50],"detection":[51],"mechanisms":[52],"are":[53],"insufficient":[54],"detect":[56,196],"runtime":[57,65,198],"exploits,":[59],"due":[60],"the":[62,108,116,136,145,172,220],"lack":[63],"execution":[66,87,98],"semantics":[67,99],"checking.":[68,224],"In":[69],"this":[70],"work,":[71],"we":[72,127],"propose":[73],"Orpheus,":[74,126],"a":[75,92,101,130,164,206],"new":[76,131],"security":[77],"methodology":[78],"for":[79,95,211,219],"defending":[80],"by":[84,183],"enforcing":[85],"semantics.":[88],"We":[89,178],"first":[90],"present":[91,129],"general":[93],"method":[94],"reasoning":[96],"program":[103,112,132],"(i.e.,":[104],"causal":[105],"dependencies":[106],"between":[107],"context/event":[110],"flows),":[114],"including":[115],"event":[117,154,167,174],"identification":[118],"dependence":[120],"analysis.":[121],"As":[122],"an":[123],"instantiation":[124],"then":[128],"behavior":[133],"model,":[134],"i.e.,":[135],"event-aware":[137],"finite-state":[138],"automaton":[139],"(eFSA).":[140],"eFSA":[141,193],"takes":[142],"advantage":[143],"event-driven":[146],"nature":[147],"incorporates":[153],"checking":[155],"in":[156],"anomaly":[157],"detection.":[158],"It":[159],"detects":[160],"exploits":[162],"if":[163],"specific":[165],"missing":[169],"along":[170],"with":[171],"corresponding":[173],"dependent":[175],"state":[176,213],"transition.":[177],"evaluate":[179],"our":[180],"prototype's":[181],"performance":[182],"conducting":[184],"case":[185],"under":[187],"attacks.":[189,199],"Results":[190],"show":[191],"can":[194],"successfully":[195],"different":[197],"Our":[200],"prototype":[201],"Raspberry":[203],"Pi":[204],"incurs":[205],"low":[207],"overhead,":[208],"taking":[209],"0.0001s":[210],"each":[212],"transition":[214],"integrity":[215],"checking,":[216],"0.063s~0.211s":[218],"contextual":[222],"consistency":[223]},"counts_by_year":[{"year":2026,"cited_by_count":1},{"year":2025,"cited_by_count":8},{"year":2024,"cited_by_count":6},{"year":2023,"cited_by_count":6},{"year":2022,"cited_by_count":9},{"year":2021,"cited_by_count":3},{"year":2020,"cited_by_count":7},{"year":2019,"cited_by_count":4}],"updated_date":"2026-04-10T15:06:20.359241","created_date":"2025-10-10T00:00:00"}