{"id":"https://openalex.org/W4387010952","doi":"https://doi.org/10.1109/tifs.2023.3318969","title":"XMD: An Expansive Hardware-Telemetry-Based Mobile Malware Detector for Endpoint Detection","display_name":"XMD: An Expansive Hardware-Telemetry-Based Mobile Malware Detector for Endpoint Detection","publication_year":2023,"publication_date":"2023-01-01","ids":{"openalex":"https://openalex.org/W4387010952","doi":"https://doi.org/10.1109/tifs.2023.3318969"},"language":"en","primary_location":{"id":"doi:10.1109/tifs.2023.3318969","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tifs.2023.3318969","pdf_url":null,"source":{"id":"https://openalex.org/S61310614","display_name":"IEEE Transactions on Information Forensics and Security","issn_l":"1556-6013","issn":["1556-6013","1556-6021"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Information Forensics and Security","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5011592504","display_name":"Harshit Kumar","orcid":"https://orcid.org/0000-0002-4865-7795"},"institutions":[{"id":"https://openalex.org/I130701444","display_name":"Georgia Institute of Technology","ror":"https://ror.org/01zkghx44","country_code":"US","type":"education","lineage":["https://openalex.org/I130701444"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Harshit Kumar","raw_affiliation_strings":["Department of Electrical and Computer Engineering, Georgia Institute of Technology, Atlanta, GA, USA"],"raw_orcid":"https://orcid.org/0000-0002-4865-7795","affiliations":[{"raw_affiliation_string":"Department of Electrical and Computer Engineering, Georgia Institute of Technology, Atlanta, GA, USA","institution_ids":["https://openalex.org/I130701444"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5084263822","display_name":"Biswadeep Chakraborty","orcid":"https://orcid.org/0000-0002-6984-6907"},"institutions":[{"id":"https://openalex.org/I130701444","display_name":"Georgia Institute of Technology","ror":"https://ror.org/01zkghx44","country_code":"US","type":"education","lineage":["https://openalex.org/I130701444"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Biswadeep Chakraborty","raw_affiliation_strings":["Department of Electrical and Computer Engineering, Georgia Institute of Technology, Atlanta, GA, USA"],"raw_orcid":"https://orcid.org/0000-0002-6984-6907","affiliations":[{"raw_affiliation_string":"Department of Electrical and Computer Engineering, Georgia Institute of Technology, Atlanta, GA, USA","institution_ids":["https://openalex.org/I130701444"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5024010303","display_name":"Sudarshan Sharma","orcid":"https://orcid.org/0009-0004-0949-4577"},"institutions":[{"id":"https://openalex.org/I130701444","display_name":"Georgia Institute of Technology","ror":"https://ror.org/01zkghx44","country_code":"US","type":"education","lineage":["https://openalex.org/I130701444"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Sudarshan Sharma","raw_affiliation_strings":["Department of Electrical and Computer Engineering, Georgia Institute of Technology, Atlanta, GA, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Electrical and Computer Engineering, Georgia Institute of Technology, Atlanta, GA, USA","institution_ids":["https://openalex.org/I130701444"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5009591041","display_name":"Saibal Mukhopadhyay","orcid":"https://orcid.org/0000-0002-8894-3390"},"institutions":[{"id":"https://openalex.org/I130701444","display_name":"Georgia Institute of Technology","ror":"https://ror.org/01zkghx44","country_code":"US","type":"education","lineage":["https://openalex.org/I130701444"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Saibal Mukhopadhyay","raw_affiliation_strings":["Department of Electrical and Computer Engineering, Georgia Institute of Technology, Atlanta, GA, USA"],"raw_orcid":"https://orcid.org/0000-0002-8894-3390","affiliations":[{"raw_affiliation_string":"Department of Electrical and Computer Engineering, Georgia Institute of Technology, Atlanta, GA, USA","institution_ids":["https://openalex.org/I130701444"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I130701444"],"apc_list":null,"apc_paid":null,"fwci":0.5318,"has_fulltext":false,"cited_by_count":4,"citation_normalized_percentile":{"value":0.61306163,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":90,"max":97},"biblio":{"volume":"18","issue":null,"first_page":"5906","last_page":"5919"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9889000058174133,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10743","display_name":"Software Testing and Debugging Techniques","score":0.9646000266075134,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.83604896068573},{"id":"https://openalex.org/keywords/exploit","display_name":"Exploit","score":0.6219602823257446},{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.6143006682395935},{"id":"https://openalex.org/keywords/computer-hardware","display_name":"Computer hardware","score":0.5985280871391296},{"id":"https://openalex.org/keywords/embedded-system","display_name":"Embedded system","score":0.5935508608818054},{"id":"https://openalex.org/keywords/telemetry","display_name":"Telemetry","score":0.5595624446868896},{"id":"https://openalex.org/keywords/detector","display_name":"Detector","score":0.5169321894645691},{"id":"https://openalex.org/keywords/field-programmable-gate-array","display_name":"Field-programmable gate array","score":0.48227956891059875},{"id":"https://openalex.org/keywords/multi-core-processor","display_name":"Multi-core processor","score":0.4781564176082611},{"id":"https://openalex.org/keywords/expansive","display_name":"Expansive","score":0.46938344836235046},{"id":"https://openalex.org/keywords/android","display_name":"Android (operating system)","score":0.46322014927864075},{"id":"https://openalex.org/keywords/profiling","display_name":"Profiling (computer programming)","score":0.43271875381469727},{"id":"https://openalex.org/keywords/mobile-device","display_name":"Mobile device","score":0.4280291199684143},{"id":"https://openalex.org/keywords/real-time-computing","display_name":"Real-time computing","score":0.4057563841342926},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.30964821577072144},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.09477409720420837},{"id":"https://openalex.org/keywords/telecommunications","display_name":"Telecommunications","score":0.07926744222640991}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.83604896068573},{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.6219602823257446},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.6143006682395935},{"id":"https://openalex.org/C9390403","wikidata":"https://www.wikidata.org/wiki/Q3966","display_name":"Computer hardware","level":1,"score":0.5985280871391296},{"id":"https://openalex.org/C149635348","wikidata":"https://www.wikidata.org/wiki/Q193040","display_name":"Embedded system","level":1,"score":0.5935508608818054},{"id":"https://openalex.org/C183121708","wikidata":"https://www.wikidata.org/wiki/Q209867","display_name":"Telemetry","level":2,"score":0.5595624446868896},{"id":"https://openalex.org/C94915269","wikidata":"https://www.wikidata.org/wiki/Q1834857","display_name":"Detector","level":2,"score":0.5169321894645691},{"id":"https://openalex.org/C42935608","wikidata":"https://www.wikidata.org/wiki/Q190411","display_name":"Field-programmable gate array","level":2,"score":0.48227956891059875},{"id":"https://openalex.org/C78766204","wikidata":"https://www.wikidata.org/wiki/Q555032","display_name":"Multi-core processor","level":2,"score":0.4781564176082611},{"id":"https://openalex.org/C2780502288","wikidata":"https://www.wikidata.org/wiki/Q28838156","display_name":"Expansive","level":3,"score":0.46938344836235046},{"id":"https://openalex.org/C557433098","wikidata":"https://www.wikidata.org/wiki/Q94","display_name":"Android (operating system)","level":2,"score":0.46322014927864075},{"id":"https://openalex.org/C187191949","wikidata":"https://www.wikidata.org/wiki/Q1138496","display_name":"Profiling (computer programming)","level":2,"score":0.43271875381469727},{"id":"https://openalex.org/C186967261","wikidata":"https://www.wikidata.org/wiki/Q5082128","display_name":"Mobile device","level":2,"score":0.4280291199684143},{"id":"https://openalex.org/C79403827","wikidata":"https://www.wikidata.org/wiki/Q3988","display_name":"Real-time computing","level":1,"score":0.4057563841342926},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.30964821577072144},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.09477409720420837},{"id":"https://openalex.org/C76155785","wikidata":"https://www.wikidata.org/wiki/Q418","display_name":"Telecommunications","level":1,"score":0.07926744222640991},{"id":"https://openalex.org/C192562407","wikidata":"https://www.wikidata.org/wiki/Q228736","display_name":"Materials science","level":0,"score":0.0},{"id":"https://openalex.org/C159985019","wikidata":"https://www.wikidata.org/wiki/Q181790","display_name":"Composite material","level":1,"score":0.0},{"id":"https://openalex.org/C30407753","wikidata":"https://www.wikidata.org/wiki/Q186191","display_name":"Compressive strength","level":2,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/tifs.2023.3318969","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tifs.2023.3318969","pdf_url":null,"source":{"id":"https://openalex.org/S61310614","display_name":"IEEE Transactions on Information Forensics and Security","issn_l":"1556-6013","issn":["1556-6013","1556-6021"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Information Forensics and Security","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G435569363","display_name":null,"funder_award_id":"2810.002","funder_id":"https://openalex.org/F4320306087","funder_display_name":"Semiconductor Research Corporation"}],"funders":[{"id":"https://openalex.org/F4320306087","display_name":"Semiconductor Research Corporation","ror":"https://ror.org/047z4n946"}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":56,"referenced_works":["https://openalex.org/W434012021","https://openalex.org/W1943233084","https://openalex.org/W1971017968","https://openalex.org/W2030450972","https://openalex.org/W2034053858","https://openalex.org/W2122672392","https://openalex.org/W2124631616","https://openalex.org/W2125011234","https://openalex.org/W2324464293","https://openalex.org/W2572070369","https://openalex.org/W2621123093","https://openalex.org/W2625408821","https://openalex.org/W2750990141","https://openalex.org/W2766572821","https://openalex.org/W2793420030","https://openalex.org/W2807415350","https://openalex.org/W2808384766","https://openalex.org/W2890478469","https://openalex.org/W2931858311","https://openalex.org/W2932551155","https://openalex.org/W2944942867","https://openalex.org/W2951172748","https://openalex.org/W2977790487","https://openalex.org/W2978001019","https://openalex.org/W3004639598","https://openalex.org/W3007346474","https://openalex.org/W3009168442","https://openalex.org/W3011884707","https://openalex.org/W3015806656","https://openalex.org/W3034513977","https://openalex.org/W3047417042","https://openalex.org/W3047915113","https://openalex.org/W3083094226","https://openalex.org/W3087990352","https://openalex.org/W3091876964","https://openalex.org/W3100492156","https://openalex.org/W3111533025","https://openalex.org/W3138173041","https://openalex.org/W3169411391","https://openalex.org/W3183032573","https://openalex.org/W3184516261","https://openalex.org/W3213928261","https://openalex.org/W4210937029","https://openalex.org/W4211026630","https://openalex.org/W4247833239","https://openalex.org/W4249476571","https://openalex.org/W4298098758","https://openalex.org/W4312818044","https://openalex.org/W6678601690","https://openalex.org/W6739289765","https://openalex.org/W6743496458","https://openalex.org/W6745798105","https://openalex.org/W6767531468","https://openalex.org/W6777671560","https://openalex.org/W6788510126","https://openalex.org/W6831397456"],"related_works":["https://openalex.org/W2070863773","https://openalex.org/W2056771637","https://openalex.org/W748047311","https://openalex.org/W2359918844","https://openalex.org/W4298110012","https://openalex.org/W4212896802","https://openalex.org/W1646292588","https://openalex.org/W2139075651","https://openalex.org/W2134920996","https://openalex.org/W2963830067"],"abstract_inverted_index":{"Hardware-based":[0],"Malware":[1],"Detectors":[2],"(HMDs)":[3],"have":[4],"shown":[5],"promise":[6],"in":[7,119],"detecting":[8],"malicious":[9],"workloads.":[10],"However,":[11],"the":[12,18,30,34,55,62,67,71,96,110,113,158,164,179,186,194],"current":[13],"HMDs":[14],"focus":[15],"solely":[16],"on":[17,139,191,193],"CPU":[19],"core":[20],"of":[21,33,50,58,66,75,98,112,168,175,182,197],"a":[22,140,171],"System-on-Chip":[23],"(SoC)":[24],"and,":[25],"therefore,":[26],"do":[27],"not":[28],"exploit":[29],"full":[31],"potential":[32],"hardware":[35,128],"telemetry.":[36],"In":[37],"this":[38],"paper,":[39],"we":[40],"propose":[41],"XMD,":[42],"an":[43,47],"HMD":[44],"that":[45,104],"uses":[46],"expansive":[48],"set":[49,196],"telemetry":[51,77,107],"channels":[52,108],"extracted":[53],"from":[54,131],"different":[56],"subsystems":[57],"SoC.":[59],"XMD":[60,126,148,162],"exploits":[61],"thread-level":[63],"profiling":[64,73],"power":[65,74],"CPU-core":[68],"telemetry,":[69],"and":[70,115,124,135],"global":[72],"non-core":[76,106],"channels,":[78],"to":[79,101,178],"achieve":[80],"significantly":[81],"better":[82],"detection":[83,166,180],"performance":[84,120,167],"than":[85],"currently":[86,151],"used":[87,152],"Hardware":[88],"Performance":[89],"Counter":[90],"(HPC)":[91],"based":[92],"detectors.":[93],"We":[94,122],"leverage":[95],"concept":[97],"manifold":[99],"hypothesis":[100],"analytically":[102],"prove":[103],"adding":[105],"improves":[109,149],"separability":[111],"benign":[114,133],"malware":[116,137,198],"classes,":[117],"resulting":[118],"gains.":[121],"train":[123],"evaluate":[125],"using":[127],"telemetries":[129],"collected":[130],"723":[132],"applications":[134],"1033":[136],"samples":[138],"commodity":[141],"Android":[142],"Operating":[143],"System":[144],"(OS)-based":[145],"mobile":[146],"device.":[147],"over":[150],"HPC-based":[153],"detectors":[154],"by":[155,185],"32.91%":[156],"for":[157],"in-distribution":[159],"test":[160],"data.":[161],"achieves":[163],"best":[165,187],"86.54%":[169],"with":[170],"false":[172],"positive":[173],"rate":[174,181],"2.9%,":[176],"compared":[177],"80%,":[183],"offered":[184],"performing":[188],"signature-based":[189],"Anti-Virus(AV)":[190],"VirusTotal,":[192],"same":[195],"samples.":[199]},"counts_by_year":[{"year":2026,"cited_by_count":1},{"year":2025,"cited_by_count":2},{"year":2024,"cited_by_count":1}],"updated_date":"2026-08-01T09:00:35.917206","created_date":"2023-09-26T00:00:00"}