{"id":"https://openalex.org/W4285194732","doi":"https://doi.org/10.1109/tifs.2022.3183409","title":"Retrofitting LBR Profiling to Enhance Virtual Machine Introspection","display_name":"Retrofitting LBR Profiling to Enhance Virtual Machine Introspection","publication_year":2022,"publication_date":"2022-01-01","ids":{"openalex":"https://openalex.org/W4285194732","doi":"https://doi.org/10.1109/tifs.2022.3183409"},"language":"en","primary_location":{"id":"doi:10.1109/tifs.2022.3183409","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tifs.2022.3183409","pdf_url":null,"source":{"id":"https://openalex.org/S61310614","display_name":"IEEE Transactions on Information Forensics and Security","issn_l":"1556-6013","issn":["1556-6013","1556-6021"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Information Forensics and Security","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5100668780","display_name":"Weijie Liu","orcid":"https://orcid.org/0000-0002-3054-766X"},"institutions":[{"id":"https://openalex.org/I4210119109","display_name":"Indiana University Bloomington","ror":"https://ror.org/02k40bc56","country_code":"US","type":"education","lineage":["https://openalex.org/I4210119109","https://openalex.org/I592451"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Weijie Liu","raw_affiliation_strings":["Luddy School of Informatics, Computing, and Engineering, Indiana University, Bloomington, IN, USA"],"raw_orcid":"https://orcid.org/0000-0002-3054-766X","affiliations":[{"raw_affiliation_string":"Luddy School of Informatics, Computing, and Engineering, Indiana University, Bloomington, IN, USA","institution_ids":["https://openalex.org/I4210119109"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5058120371","display_name":"Ximeng Liu","orcid":"https://orcid.org/0000-0002-4238-3295"},"institutions":[{"id":"https://openalex.org/I80947539","display_name":"Fuzhou University","ror":"https://ror.org/011xvna82","country_code":"CN","type":"education","lineage":["https://openalex.org/I80947539"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Ximeng Liu","raw_affiliation_strings":["College of Computer and Data Science, Fuzhou University, Fuzhou, China"],"raw_orcid":"https://orcid.org/0000-0002-4238-3295","affiliations":[{"raw_affiliation_string":"College of Computer and Data Science, Fuzhou University, Fuzhou, China","institution_ids":["https://openalex.org/I80947539"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100382323","display_name":"Zhi Li","orcid":"https://orcid.org/0000-0002-9510-1888"},"institutions":[{"id":"https://openalex.org/I47720641","display_name":"Huazhong University of Science and Technology","ror":"https://ror.org/00p991c53","country_code":"CN","type":"education","lineage":["https://openalex.org/I47720641"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Zhi Li","raw_affiliation_strings":["School of Cyber Science and Engineering, Huazhong University of Science and Technology, Wuhan, China"],"raw_orcid":"https://orcid.org/0000-0002-9510-1888","affiliations":[{"raw_affiliation_string":"School of Cyber Science and Engineering, Huazhong University of Science and Technology, Wuhan, China","institution_ids":["https://openalex.org/I47720641"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100395432","display_name":"Bin Liu","orcid":"https://orcid.org/0000-0001-7394-7236"},"institutions":[{"id":"https://openalex.org/I75900474","display_name":"Hubei University","ror":"https://ror.org/03a60m280","country_code":"CN","type":"education","lineage":["https://openalex.org/I75900474"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Bin Liu","raw_affiliation_strings":["School of Computer and Information Engineering, Hubei University, Wuhan, China"],"raw_orcid":"https://orcid.org/0000-0001-7394-7236","affiliations":[{"raw_affiliation_string":"School of Computer and Information Engineering, Hubei University, Wuhan, China","institution_ids":["https://openalex.org/I75900474"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5040960594","display_name":"Rongwei Yu","orcid":"https://orcid.org/0000-0002-1376-2720"},"institutions":[{"id":"https://openalex.org/I37461747","display_name":"Wuhan University","ror":"https://ror.org/033vjfk17","country_code":"CN","type":"education","lineage":["https://openalex.org/I37461747"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Rongwei Yu","raw_affiliation_strings":["School of Cyber Science and Engineering, Wuhan University, Wuhan, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Cyber Science and Engineering, Wuhan University, Wuhan, China","institution_ids":["https://openalex.org/I37461747"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5056155495","display_name":"Lina Wang","orcid":"https://orcid.org/0000-0001-8085-1312"},"institutions":[{"id":"https://openalex.org/I37461747","display_name":"Wuhan University","ror":"https://ror.org/033vjfk17","country_code":"CN","type":"education","lineage":["https://openalex.org/I37461747"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Lina Wang","raw_affiliation_strings":["School of Cyber Science and Engineering, Wuhan University, Wuhan, China"],"raw_orcid":"https://orcid.org/0000-0001-8085-1312","affiliations":[{"raw_affiliation_string":"School of Cyber Science and Engineering, Wuhan University, Wuhan, China","institution_ids":["https://openalex.org/I37461747"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":5,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.697,"has_fulltext":false,"cited_by_count":8,"citation_normalized_percentile":{"value":0.64429781,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":89,"max":98},"biblio":{"volume":"17","issue":null,"first_page":"2311","last_page":"2323"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9979000091552734,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9979000091552734,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":0.9979000091552734,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.9970999956130981,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8484975099563599},{"id":"https://openalex.org/keywords/cloud-computing","display_name":"Cloud computing","score":0.7413886785507202},{"id":"https://openalex.org/keywords/profiling","display_name":"Profiling (computer programming)","score":0.7188199758529663},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.6052707433700562},{"id":"https://openalex.org/keywords/virtualization","display_name":"Virtualization","score":0.4987773895263672},{"id":"https://openalex.org/keywords/digital-forensics","display_name":"Digital forensics","score":0.49358808994293213},{"id":"https://openalex.org/keywords/tracing","display_name":"Tracing","score":0.4519597291946411},{"id":"https://openalex.org/keywords/fidelity","display_name":"Fidelity","score":0.4301370680332184},{"id":"https://openalex.org/keywords/authentication","display_name":"Authentication (law)","score":0.4295574426651001},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.24592766165733337}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8484975099563599},{"id":"https://openalex.org/C79974875","wikidata":"https://www.wikidata.org/wiki/Q483639","display_name":"Cloud computing","level":2,"score":0.7413886785507202},{"id":"https://openalex.org/C187191949","wikidata":"https://www.wikidata.org/wiki/Q1138496","display_name":"Profiling (computer programming)","level":2,"score":0.7188199758529663},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.6052707433700562},{"id":"https://openalex.org/C513985346","wikidata":"https://www.wikidata.org/wiki/Q270471","display_name":"Virtualization","level":3,"score":0.4987773895263672},{"id":"https://openalex.org/C84418412","wikidata":"https://www.wikidata.org/wiki/Q3246940","display_name":"Digital forensics","level":2,"score":0.49358808994293213},{"id":"https://openalex.org/C138673069","wikidata":"https://www.wikidata.org/wiki/Q322229","display_name":"Tracing","level":2,"score":0.4519597291946411},{"id":"https://openalex.org/C2776459999","wikidata":"https://www.wikidata.org/wiki/Q2119376","display_name":"Fidelity","level":2,"score":0.4301370680332184},{"id":"https://openalex.org/C148417208","wikidata":"https://www.wikidata.org/wiki/Q4825882","display_name":"Authentication (law)","level":2,"score":0.4295574426651001},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.24592766165733337},{"id":"https://openalex.org/C76155785","wikidata":"https://www.wikidata.org/wiki/Q418","display_name":"Telecommunications","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/tifs.2022.3183409","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tifs.2022.3183409","pdf_url":null,"source":{"id":"https://openalex.org/S61310614","display_name":"IEEE Transactions on Information Forensics and Security","issn_l":"1556-6013","issn":["1556-6013","1556-6021"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Information Forensics and Security","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/16","score":0.6299999952316284,"display_name":"Peace, Justice and strong institutions"}],"awards":[{"id":"https://openalex.org/G3291271152","display_name":null,"funder_award_id":"U1804263","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G4910714274","display_name":null,"funder_award_id":"2021J06013","funder_id":"https://openalex.org/F4320321878","funder_display_name":"Natural Science Foundation of Fujian Province"},{"id":"https://openalex.org/G8914308280","display_name":null,"funder_award_id":"U1836112","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G979158640","display_name":"\u9762\u5411\u5927\u6570\u636e\u5b89\u5168\u7684\u5bc6\u6001\u6570\u636e\u5904\u7406\u5173\u952e\u6280\u672f\u7814\u7a76","funder_award_id":"62072109","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"}],"funders":[{"id":"https://openalex.org/F4320321001","display_name":"National Natural Science Foundation of China","ror":"https://ror.org/01h0zpd94"},{"id":"https://openalex.org/F4320321878","display_name":"Natural Science Foundation of Fujian Province","ror":null}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":53,"referenced_works":["https://openalex.org/W1534092936","https://openalex.org/W1903860135","https://openalex.org/W1975177131","https://openalex.org/W1993682390","https://openalex.org/W2002627919","https://openalex.org/W2019731328","https://openalex.org/W2025529089","https://openalex.org/W2036853599","https://openalex.org/W2042856445","https://openalex.org/W2054472680","https://openalex.org/W2068778705","https://openalex.org/W2087740020","https://openalex.org/W2104182023","https://openalex.org/W2135162105","https://openalex.org/W2138580357","https://openalex.org/W2144006591","https://openalex.org/W2150620897","https://openalex.org/W2161958410","https://openalex.org/W2168760272","https://openalex.org/W2170467352","https://openalex.org/W2171929398","https://openalex.org/W2296563811","https://openalex.org/W2405980203","https://openalex.org/W2477180990","https://openalex.org/W2481266035","https://openalex.org/W2494899919","https://openalex.org/W2507765405","https://openalex.org/W2519327604","https://openalex.org/W2592023122","https://openalex.org/W2594266659","https://openalex.org/W2762263463","https://openalex.org/W2889959453","https://openalex.org/W2900822740","https://openalex.org/W2904814233","https://openalex.org/W2932551155","https://openalex.org/W2950774332","https://openalex.org/W2984101843","https://openalex.org/W3005298591","https://openalex.org/W3036557299","https://openalex.org/W3086419562","https://openalex.org/W3213572793","https://openalex.org/W4236454837","https://openalex.org/W4251377746","https://openalex.org/W6602906054","https://openalex.org/W6603043977","https://openalex.org/W6636574085","https://openalex.org/W6637110787","https://openalex.org/W6638218497","https://openalex.org/W6683671222","https://openalex.org/W6723039778","https://openalex.org/W6726948512","https://openalex.org/W6729667700","https://openalex.org/W6782383553"],"related_works":["https://openalex.org/W2381850946","https://openalex.org/W4380449851","https://openalex.org/W3125091513","https://openalex.org/W4318832338","https://openalex.org/W2888673113","https://openalex.org/W2212288070","https://openalex.org/W2056065966","https://openalex.org/W1919390113","https://openalex.org/W246478187","https://openalex.org/W1980925977"],"abstract_inverted_index":{"Cloud":[0],"attack":[1,50,70,109,160],"provenance":[2,51,71,161],"is":[3,45],"a":[4,14,31,46,158],"well-established":[5],"industrial":[6],"practice":[7],"for":[8,13,49,92],"assuring":[9],"transparency":[10],"and":[11,22,62,106,118,137],"accountability":[12],"service":[15],"provider":[16],"to":[17,37,53,74,127,151],"tenants.":[18],"However,":[19],"the":[20,27,54,57,63,94,108,113,129,134,144],"multi-tenancy":[21],"self-service":[23],"nature":[24],"coupled":[25],"with":[26,162],"sheer":[28],"size":[29],"of":[30,59,65,96,115],"cloud":[32,38],"implies":[33],"many":[34],"unique":[35],"challenges":[36,114],"forensics.":[39],"Although":[40],"Virtual":[41],"Machine":[42],"Introspection":[43],"(VMI)":[44],"powerful":[47],"tool":[48],"due":[52],"privilege":[55],"isolation,":[56],"stealthiness":[58],"state-of-the-art":[60],"attacks":[61,97],"lack":[64],"precise":[66],"information":[67],"make":[68],"existing":[69],"solutions":[72],"difficult":[73],"fulfill":[75],"real-time":[76,116],"forensics":[77],"when":[78],"tracking":[79,100],"enormous":[80],"suspicious":[81,130],"behaviors.":[82],"To":[83,111],"this":[84],"end,":[85],"we":[86,120,141],"propose":[87],"an":[88,148],"instruction-level":[89],"tracing":[90],"framework":[91,145],"inspecting":[93],"presence":[95],"by":[98],"dynamically":[99],"shared":[101],"processor":[102],"hardware":[103,135],"event":[104],"patterns":[105],"analyzing":[107],"traces.":[110],"overcome":[112],"detection":[117],"provenance,":[119],"advocate":[121],"Last":[122],"Branch":[123],"Record":[124],"(LBR)":[125],"profiling,":[126],"extract":[128],"execution":[131],"flows.":[132],"With":[133],"assistance":[136],"software-based":[138],"virtualization":[139],"introspection,":[140],"show":[142],"that":[143,168],"can":[146],"provide":[147],"effective":[149],"response":[150],"threats":[152],"in":[153],"different":[154],"cases,":[155],"thereby":[156],"enabling":[157],"quick":[159],"high":[163],"fidelity.":[164],"The":[165],"evaluation":[166],"shows":[167],"our":[169],"prototype":[170],"introduces":[171],"negligible":[172],"performance":[173],"penalties.":[174]},"counts_by_year":[{"year":2026,"cited_by_count":2},{"year":2025,"cited_by_count":2},{"year":2024,"cited_by_count":1},{"year":2023,"cited_by_count":2},{"year":2022,"cited_by_count":1}],"updated_date":"2026-07-15T18:14:33.161393","created_date":"2025-10-10T00:00:00"}