{"id":"https://openalex.org/W2139419152","doi":"https://doi.org/10.1109/tifs.2011.2162062","title":"PEDA: Comprehensive Damage Assessment for Production Environment Server Systems","display_name":"PEDA: Comprehensive Damage Assessment for Production Environment Server Systems","publication_year":2011,"publication_date":"2011-07-20","ids":{"openalex":"https://openalex.org/W2139419152","doi":"https://doi.org/10.1109/tifs.2011.2162062","mag":"2139419152"},"language":"en","primary_location":{"id":"doi:10.1109/tifs.2011.2162062","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tifs.2011.2162062","pdf_url":null,"source":{"id":"https://openalex.org/S61310614","display_name":"IEEE Transactions on Information Forensics and Security","issn_l":"1556-6013","issn":["1556-6013","1556-6021"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Information Forensics and Security","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5027504758","display_name":"Shengzhi Zhang","orcid":"https://orcid.org/0000-0001-9432-9779"},"institutions":[{"id":"https://openalex.org/I130769515","display_name":"Pennsylvania State University","ror":"https://ror.org/04p491231","country_code":"US","type":"education","lineage":["https://openalex.org/I130769515"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Shengzhi Zhang","raw_affiliation_strings":["Department of Computer Science and Engineering, Pennsylvania State University, University Park, PA, USA","Department of Computer Science and Engineering Pennsylvania State University  University Park PA USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Computer Science and Engineering, Pennsylvania State University, University Park, PA, USA","institution_ids":["https://openalex.org/I130769515"]},{"raw_affiliation_string":"Department of Computer Science and Engineering Pennsylvania State University  University Park PA USA","institution_ids":["https://openalex.org/I130769515"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5015456692","display_name":"Xiaoqi Jia","orcid":"https://orcid.org/0000-0002-8376-3235"},"institutions":[{"id":"https://openalex.org/I19820366","display_name":"Chinese Academy of Sciences","ror":"https://ror.org/034t30j35","country_code":"CN","type":"government","lineage":["https://openalex.org/I19820366"]},{"id":"https://openalex.org/I4210128818","display_name":"Institute of Software","ror":"https://ror.org/033dfsn42","country_code":"CN","type":"facility","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210128818"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Xiaoqi Jia","raw_affiliation_strings":["State Key Laboratory of Information Security, Institute of Software, Chinese Academy of Sciences (CAS), Beijing, China","State Key Lab. of Inf. Security, Inst. of Software, Beijing, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"State Key Laboratory of Information Security, Institute of Software, Chinese Academy of Sciences (CAS), Beijing, China","institution_ids":["https://openalex.org/I19820366","https://openalex.org/I4210128818"]},{"raw_affiliation_string":"State Key Lab. of Inf. Security, Inst. of Software, Beijing, China","institution_ids":["https://openalex.org/I4210128818"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100346828","display_name":"Peng Liu","orcid":"https://orcid.org/0000-0002-5091-8464"},"institutions":[{"id":"https://openalex.org/I130769515","display_name":"Pennsylvania State University","ror":"https://ror.org/04p491231","country_code":"US","type":"education","lineage":["https://openalex.org/I130769515"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Peng Liu","raw_affiliation_strings":["College of Information Sciences and Technology, Pennsylvania State University, University Park, PA, USA","College of Information Science and Technology; Pennsylvania State University; University Park PA USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"College of Information Sciences and Technology, Pennsylvania State University, University Park, PA, USA","institution_ids":["https://openalex.org/I130769515"]},{"raw_affiliation_string":"College of Information Science and Technology; Pennsylvania State University; University Park PA USA","institution_ids":["https://openalex.org/I130769515"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5033745290","display_name":"Jiwu Jing","orcid":"https://orcid.org/0000-0002-3409-6149"},"institutions":[{"id":"https://openalex.org/I37448385","display_name":"China People's Public Security University","ror":"https://ror.org/05twya590","country_code":"CN","type":"education","lineage":["https://openalex.org/I37448385"]},{"id":"https://openalex.org/I4210165038","display_name":"University of Chinese Academy of Sciences","ror":"https://ror.org/05qbk4x57","country_code":"CN","type":"education","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210165038"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Jiwu Jing","raw_affiliation_strings":["State Key Laboratory of Information Security, Graduate University of Chinese Academy of Sciences, Beijing, China","State Key Lab. of Inf. Security, Grad. Univ. of Chinese Acad. of Sci., Beijing, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"State Key Laboratory of Information Security, Graduate University of Chinese Academy of Sciences, Beijing, China","institution_ids":["https://openalex.org/I4210165038"]},{"raw_affiliation_string":"State Key Lab. of Inf. Security, Grad. Univ. of Chinese Acad. of Sci., Beijing, China","institution_ids":["https://openalex.org/I37448385"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":5,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":4,"citation_normalized_percentile":{"value":0.11613763,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":90,"max":96},"biblio":{"volume":"6","issue":"4","first_page":"1323","last_page":"1334"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9994999766349792,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9988999962806702,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.9032498598098755},{"id":"https://openalex.org/keywords/workload","display_name":"Workload","score":0.6296082735061646},{"id":"https://openalex.org/keywords/server","display_name":"Server","score":0.6014454364776611},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.5847853422164917},{"id":"https://openalex.org/keywords/overhead","display_name":"Overhead (engineering)","score":0.561120867729187},{"id":"https://openalex.org/keywords/virtual-machine","display_name":"Virtual machine","score":0.5313439965248108},{"id":"https://openalex.org/keywords/embedded-system","display_name":"Embedded system","score":0.40889066457748413},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.39829057455062866},{"id":"https://openalex.org/keywords/real-time-computing","display_name":"Real-time computing","score":0.338003933429718},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.21408841013908386}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.9032498598098755},{"id":"https://openalex.org/C2778476105","wikidata":"https://www.wikidata.org/wiki/Q628539","display_name":"Workload","level":2,"score":0.6296082735061646},{"id":"https://openalex.org/C93996380","wikidata":"https://www.wikidata.org/wiki/Q44127","display_name":"Server","level":2,"score":0.6014454364776611},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.5847853422164917},{"id":"https://openalex.org/C2779960059","wikidata":"https://www.wikidata.org/wiki/Q7113681","display_name":"Overhead (engineering)","level":2,"score":0.561120867729187},{"id":"https://openalex.org/C25344961","wikidata":"https://www.wikidata.org/wiki/Q192726","display_name":"Virtual machine","level":2,"score":0.5313439965248108},{"id":"https://openalex.org/C149635348","wikidata":"https://www.wikidata.org/wiki/Q193040","display_name":"Embedded system","level":1,"score":0.40889066457748413},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.39829057455062866},{"id":"https://openalex.org/C79403827","wikidata":"https://www.wikidata.org/wiki/Q3988","display_name":"Real-time computing","level":1,"score":0.338003933429718},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.21408841013908386}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/tifs.2011.2162062","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tifs.2011.2162062","pdf_url":null,"source":{"id":"https://openalex.org/S61310614","display_name":"IEEE Transactions on Information Forensics and Security","issn_l":"1556-6013","issn":["1556-6013","1556-6021"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Information Forensics and Security","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":37,"referenced_works":["https://openalex.org/W145355838","https://openalex.org/W146660932","https://openalex.org/W598724317","https://openalex.org/W646727521","https://openalex.org/W1522342021","https://openalex.org/W1549813142","https://openalex.org/W1557252148","https://openalex.org/W1596606311","https://openalex.org/W1976146154","https://openalex.org/W2006419855","https://openalex.org/W2009853596","https://openalex.org/W2014589236","https://openalex.org/W2050765519","https://openalex.org/W2065566278","https://openalex.org/W2066137796","https://openalex.org/W2089560940","https://openalex.org/W2100666033","https://openalex.org/W2103499520","https://openalex.org/W2112731379","https://openalex.org/W2114488210","https://openalex.org/W2125518321","https://openalex.org/W2132465298","https://openalex.org/W2143546156","https://openalex.org/W2151135920","https://openalex.org/W2165100126","https://openalex.org/W2395593542","https://openalex.org/W2401617229","https://openalex.org/W2402789968","https://openalex.org/W4205777466","https://openalex.org/W4254762831","https://openalex.org/W4256483320","https://openalex.org/W6605980827","https://openalex.org/W6632693760","https://openalex.org/W6635689766","https://openalex.org/W6654358211","https://openalex.org/W6666973944","https://openalex.org/W6713079407"],"related_works":["https://openalex.org/W2000785801","https://openalex.org/W986318368","https://openalex.org/W2384410913","https://openalex.org/W2352878646","https://openalex.org/W2558538437","https://openalex.org/W2612791064","https://openalex.org/W2893967483","https://openalex.org/W2807937293","https://openalex.org/W2357605019","https://openalex.org/W2167514501"],"abstract_inverted_index":{"Analyzing":[0],"the":[1,70,84,89,94,103,109,121,124,140],"intrusion":[2,31,62,137,144],"to":[3,40,44,59,82,106,113],"production":[4,51,65],"servers":[5],"is":[6,37],"an":[7],"onerous":[8],"and":[9],"error-prone":[10],"work":[11],"for":[12,64],"system":[13,25,126],"security":[14],"technicians.":[15],"Existing":[16],"tools":[17],"or":[18],"techniques":[19],"are":[20],"quite":[21],"limited.":[22],"For":[23],"instance,":[24],"events":[26],"tracking":[27,36],"lacks":[28],"completeness":[29],"of":[30,123,142],"propagation,":[32],"while":[33],"dynamic":[34],"taint":[35],"not":[38],"feasible":[39],"be":[41],"deployed":[42],"due":[43],"significant":[45],"runtime":[46,116,129],"overhead.":[47,117],"Thus,":[48],"we":[49],"propose":[50],"environment":[52],"damage":[53],"assessment":[54],"(PEDA),":[55],"a":[56,77,128],"systematic":[57],"approach":[58],"do":[60],"postmortem":[61],"analysis":[63,145],"workload":[66,86],"servers.":[67],"PEDA":[68,101,125,143],"replays":[69],"\u201chas-been-infected\u201d":[71],"execution":[72,91,105],"with":[73,127],"high":[74],"fidelity":[75],"on":[76],"separate":[78],"analyzing":[79],"instrumentation":[80,95],"platform":[81,96],"conduct":[83],"heavy":[85],"analysis.":[87],"Though":[88],"replayed":[90],"runs":[92],"atop":[93,108],"(i.e.,":[97],"binary-translation-based":[98],"virtual":[99,111],"machine),":[100],"allows":[102],"first-run":[104],"run":[107],"hardware-assisted":[110],"machine":[112],"ensure":[114],"minimum":[115],"Our":[118],"evaluation":[119],"demonstrates":[120],"efficiency":[122],"overhead":[130],"as":[131,133],"low":[132],"5%.":[134],"The":[135],"real-life":[136],"studies":[138],"show":[139],"advantage":[141],"over":[146],"existing":[147],"techniques.":[148]},"counts_by_year":[{"year":2018,"cited_by_count":1},{"year":2016,"cited_by_count":2},{"year":2015,"cited_by_count":1}],"updated_date":"2026-07-22T07:51:19.307946","created_date":"2025-10-10T00:00:00"}