{"id":"https://openalex.org/W4411725008","doi":"https://doi.org/10.1109/tdsc.2025.3583792","title":"InstPro: Provenance-Based Transient Execution Attack Detection and Investigation on Instruction Execution Traces","display_name":"InstPro: Provenance-Based Transient Execution Attack Detection and Investigation on Instruction Execution Traces","publication_year":2025,"publication_date":"2025-06-27","ids":{"openalex":"https://openalex.org/W4411725008","doi":"https://doi.org/10.1109/tdsc.2025.3583792"},"language":"en","primary_location":{"id":"doi:10.1109/tdsc.2025.3583792","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tdsc.2025.3583792","pdf_url":null,"source":{"id":"https://openalex.org/S133795288","display_name":"IEEE Transactions on Dependable and Secure Computing","issn_l":"1545-5971","issn":["1545-5971","1941-0018","2160-9209"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320439","host_organization_name":"IEEE Computer Society","host_organization_lineage":["https://openalex.org/P4310320439","https://openalex.org/P4310319808"],"host_organization_lineage_names":["IEEE Computer Society","Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Dependable and Secure Computing","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":null,"display_name":"Yang Zheng","orcid":"https://orcid.org/0009-0006-2424-6410"},"institutions":[{"id":"https://openalex.org/I19820366","display_name":"Chinese Academy of Sciences","ror":"https://ror.org/034t30j35","country_code":"CN","type":"government","lineage":["https://openalex.org/I19820366"]},{"id":"https://openalex.org/I4210156404","display_name":"Institute of Information Engineering","ror":"https://ror.org/04r53se39","country_code":"CN","type":"facility","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yang Zheng","raw_affiliation_strings":["State Key Laboratory of Cyberspace Security Defense, Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China"],"raw_orcid":"https://orcid.org/0009-0006-2424-6410","affiliations":[{"raw_affiliation_string":"State Key Laboratory of Cyberspace Security Defense, Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China","institution_ids":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Yu Wen","orcid":"https://orcid.org/0000-0002-0658-0742"},"institutions":[{"id":"https://openalex.org/I19820366","display_name":"Chinese Academy of Sciences","ror":"https://ror.org/034t30j35","country_code":"CN","type":"government","lineage":["https://openalex.org/I19820366"]},{"id":"https://openalex.org/I4210156404","display_name":"Institute of Information Engineering","ror":"https://ror.org/04r53se39","country_code":"CN","type":"facility","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yu Wen","raw_affiliation_strings":["State Key Laboratory of Cyberspace Security Defense, Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China"],"raw_orcid":"https://orcid.org/0000-0002-0658-0742","affiliations":[{"raw_affiliation_string":"State Key Laboratory of Cyberspace Security Defense, Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China","institution_ids":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Ruoyu Wang","orcid":"https://orcid.org/0009-0000-6749-0305"},"institutions":[{"id":"https://openalex.org/I172675005","display_name":"Nanyang Technological University","ror":"https://ror.org/02e7b5302","country_code":"SG","type":"education","lineage":["https://openalex.org/I172675005"]}],"countries":["SG"],"is_corresponding":false,"raw_author_name":"Ruoyu Wang","raw_affiliation_strings":["School of Electrical and Electronics Engineering, Nanyang Technology University, Singapore"],"raw_orcid":"https://orcid.org/0009-0000-6749-0305","affiliations":[{"raw_affiliation_string":"School of Electrical and Electronics Engineering, Nanyang Technology University, Singapore","institution_ids":["https://openalex.org/I172675005"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5051756388","display_name":"Yanna Wu","orcid":null},"institutions":[{"id":"https://openalex.org/I19820366","display_name":"Chinese Academy of Sciences","ror":"https://ror.org/034t30j35","country_code":"CN","type":"government","lineage":["https://openalex.org/I19820366"]},{"id":"https://openalex.org/I4210156404","display_name":"Institute of Information Engineering","ror":"https://ror.org/04r53se39","country_code":"CN","type":"facility","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yanna Wu","raw_affiliation_strings":["State Key Laboratory of Cyberspace Security Defense, Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"State Key Laboratory of Cyberspace Security Defense, Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China","institution_ids":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100677430","display_name":"Boyang Zhang","orcid":null},"institutions":[{"id":"https://openalex.org/I19820366","display_name":"Chinese Academy of Sciences","ror":"https://ror.org/034t30j35","country_code":"CN","type":"government","lineage":["https://openalex.org/I19820366"]},{"id":"https://openalex.org/I4210156404","display_name":"Institute of Information Engineering","ror":"https://ror.org/04r53se39","country_code":"CN","type":"facility","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Boyang Zhang","raw_affiliation_strings":["State Key Laboratory of Cyberspace Security Defense, Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"State Key Laboratory of Cyberspace Security Defense, Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China","institution_ids":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]}]},{"author_position":"last","author":{"id":null,"display_name":"Dan Meng","orcid":"https://orcid.org/0009-0006-1521-3967"},"institutions":[{"id":"https://openalex.org/I19820366","display_name":"Chinese Academy of Sciences","ror":"https://ror.org/034t30j35","country_code":"CN","type":"government","lineage":["https://openalex.org/I19820366"]},{"id":"https://openalex.org/I4210156404","display_name":"Institute of Information Engineering","ror":"https://ror.org/04r53se39","country_code":"CN","type":"facility","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Dan Meng","raw_affiliation_strings":["State Key Laboratory of Cyberspace Security Defense, Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China"],"raw_orcid":"https://orcid.org/0009-0006-1521-3967","affiliations":[{"raw_affiliation_string":"State Key Laboratory of Cyberspace Security Defense, Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China","institution_ids":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.16409723,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"22","issue":"6","first_page":"6327","last_page":"6344"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9977999925613403,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9977999925613403,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":0.993399977684021,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.9919999837875366,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7975815534591675},{"id":"https://openalex.org/keywords/transient","display_name":"Transient (computer programming)","score":0.6020538210868835},{"id":"https://openalex.org/keywords/provenance","display_name":"Provenance","score":0.5452637076377869},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.4339957535266876},{"id":"https://openalex.org/keywords/transient-analysis","display_name":"Transient analysis","score":0.4195847809314728},{"id":"https://openalex.org/keywords/embedded-system","display_name":"Embedded system","score":0.34388551115989685},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.27833110094070435},{"id":"https://openalex.org/keywords/engineering","display_name":"Engineering","score":0.09450092911720276},{"id":"https://openalex.org/keywords/transient-response","display_name":"Transient response","score":0.09198567271232605}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7975815534591675},{"id":"https://openalex.org/C2780799671","wikidata":"https://www.wikidata.org/wiki/Q17087362","display_name":"Transient (computer programming)","level":2,"score":0.6020538210868835},{"id":"https://openalex.org/C2780049196","wikidata":"https://www.wikidata.org/wiki/Q23582628","display_name":"Provenance","level":2,"score":0.5452637076377869},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.4339957535266876},{"id":"https://openalex.org/C2989121073","wikidata":"https://www.wikidata.org/wiki/Q1309019","display_name":"Transient analysis","level":3,"score":0.4195847809314728},{"id":"https://openalex.org/C149635348","wikidata":"https://www.wikidata.org/wiki/Q193040","display_name":"Embedded system","level":1,"score":0.34388551115989685},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.27833110094070435},{"id":"https://openalex.org/C127413603","wikidata":"https://www.wikidata.org/wiki/Q11023","display_name":"Engineering","level":0,"score":0.09450092911720276},{"id":"https://openalex.org/C85761212","wikidata":"https://www.wikidata.org/wiki/Q1974593","display_name":"Transient response","level":2,"score":0.09198567271232605},{"id":"https://openalex.org/C5900021","wikidata":"https://www.wikidata.org/wiki/Q163082","display_name":"Petrology","level":1,"score":0.0},{"id":"https://openalex.org/C127313418","wikidata":"https://www.wikidata.org/wiki/Q1069","display_name":"Geology","level":0,"score":0.0},{"id":"https://openalex.org/C119599485","wikidata":"https://www.wikidata.org/wiki/Q43035","display_name":"Electrical engineering","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/tdsc.2025.3583792","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tdsc.2025.3583792","pdf_url":null,"source":{"id":"https://openalex.org/S133795288","display_name":"IEEE Transactions on Dependable and Secure Computing","issn_l":"1545-5971","issn":["1545-5971","1941-0018","2160-9209"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320439","host_organization_name":"IEEE Computer Society","host_organization_lineage":["https://openalex.org/P4310320439","https://openalex.org/P4310319808"],"host_organization_lineage_names":["IEEE Computer Society","Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Dependable and Secure Computing","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":55,"referenced_works":["https://openalex.org/W1551973822","https://openalex.org/W1878305339","https://openalex.org/W2005662348","https://openalex.org/W2054103475","https://openalex.org/W2098771792","https://openalex.org/W2099986681","https://openalex.org/W2130182357","https://openalex.org/W2146280225","https://openalex.org/W2147657366","https://openalex.org/W2166958407","https://openalex.org/W2194609298","https://openalex.org/W2337480911","https://openalex.org/W2514361410","https://openalex.org/W2584029330","https://openalex.org/W2612611921","https://openalex.org/W2798604098","https://openalex.org/W2898017895","https://openalex.org/W2900880976","https://openalex.org/W2905418916","https://openalex.org/W2914724518","https://openalex.org/W2931030580","https://openalex.org/W2962703433","https://openalex.org/W2962832406","https://openalex.org/W2962986039","https://openalex.org/W2963311060","https://openalex.org/W2979328258","https://openalex.org/W2985509521","https://openalex.org/W2986944522","https://openalex.org/W3015465581","https://openalex.org/W3045670632","https://openalex.org/W3083271878","https://openalex.org/W3098569199","https://openalex.org/W3111712354","https://openalex.org/W3117158982","https://openalex.org/W3137220996","https://openalex.org/W3151142909","https://openalex.org/W3160448675","https://openalex.org/W3165348418","https://openalex.org/W3167891275","https://openalex.org/W3183296364","https://openalex.org/W3195954353","https://openalex.org/W3214883374","https://openalex.org/W4210937029","https://openalex.org/W4285308893","https://openalex.org/W4291713045","https://openalex.org/W4308643131","https://openalex.org/W4311703141","https://openalex.org/W4368232772","https://openalex.org/W4379113633","https://openalex.org/W4379116144","https://openalex.org/W4380153987","https://openalex.org/W4385187318","https://openalex.org/W4386765089","https://openalex.org/W4390280345","https://openalex.org/W4391604029"],"related_works":["https://openalex.org/W2758798772","https://openalex.org/W2081338125","https://openalex.org/W4406350055","https://openalex.org/W4239924455","https://openalex.org/W2001630809","https://openalex.org/W4244925124","https://openalex.org/W2377879397","https://openalex.org/W1577327694","https://openalex.org/W2887517211","https://openalex.org/W1909312109"],"abstract_inverted_index":{"Transient":[0],"execution":[1,98],"attacks":[2],"(TEAs)":[3],"are":[4,177],"a":[5,76,84,135,149,158,182],"serious":[6],"threat":[7],"to":[8,19,35,116,180,191],"modern":[9],"computing":[10],"systems.":[11],"While":[12],"software/hardware":[13],"hardening":[14],"techniques":[15,25,48],"have":[16],"been":[17],"proposed":[18],"mitigate":[20],"the":[21,50,69,92,132,163,169,193],"threat,":[22],"developing":[23],"detection":[24,47,78,210],"remains":[26],"imperative,":[27],"as":[28],"they":[29],"hold":[30],"promise":[31],"for":[32,60],"flexible":[33],"extension":[34],"address":[36,68],"new":[37],"variants,":[38],"ease":[39],"of":[40,58,91,124,184],"deployment,":[41],"and":[42,63,211],"minimal":[43],"system":[44,79],"impact.":[45],"Existing":[46],"face":[49],"following":[51],"three":[52],"limitations:":[53],"unstable":[54],"information":[55,170],"sources,":[56],"lack":[57],"explanation":[59,90],"attack":[61,93,117,194],"scenarios,":[62],"limited":[64],"training":[65],"data.":[66],"To":[67],"limitations,":[70],"we":[71],"propose":[72],"<sc":[73,101,128,154,204],"xmlns:mml=\"http://www.w3.org/1998/Math/MathML\"":[74,82,102,107,129,137,155,165,205],"xmlns:xlink=\"http://www.w3.org/1999/xlink\">InstPro</small>,":[75],"TEA":[77,85,125,209],"that":[80,110,167,188,203],"<italic":[81,106,136,164],"xmlns:xlink=\"http://www.w3.org/1999/xlink\">identifies":[83],"program":[86],"while":[87],"providing":[88],"an":[89],"scenario,":[94],"based":[95,198],"on":[96,199],"instruction":[97,112],"traces</i>.":[99],"Specifically,":[100],"xmlns:xlink=\"http://www.w3.org/1999/xlink\">InstPro</small>":[103,130,156,206],"first":[104],"extracts":[105],"xmlns:xlink=\"http://www.w3.org/1999/xlink\">principled":[108],"clues</i>":[109],"represent":[111,168,192],"sequences":[113],"semantically":[114],"close":[115],"abstraction.":[118],"These":[119,175],"clues":[120,133,187],"provide":[121],"high-level":[122],"visualizations":[123],"steps.":[126],"Then,":[127],"correlates":[131],"into":[134],"xmlns:xlink=\"http://www.w3.org/1999/xlink\">clue":[138],"provenance":[139,151],"graph</i>":[140],"by":[141,161],"reasoning":[142],"about":[143],"their":[144],"causal":[145],"dependencies,":[146],"which":[147],"provides":[148],"concise":[150],"representation.":[152],"Finally,":[153],"reconstructs":[157],"scenario":[159],"graph":[160],"using":[162],"xmlns:xlink=\"http://www.w3.org/1999/xlink\">InfoSubgraphs</i>":[166],"flows":[171],"among":[172],"principled":[173,186],"clues.":[174],"InfoSubgraphs":[176],"more":[178],"likely":[179],"capture":[181],"set":[183],"crucial":[185],"work":[189],"together":[190],"scenario.":[195],"Our":[196],"evaluations":[197],"5":[200],"datasets":[201],"show":[202],"effectively":[207],"performs":[208],"investigation.":[212]},"counts_by_year":[],"updated_date":"2026-07-22T07:51:19.307946","created_date":"2025-10-10T00:00:00"}