{"id":"https://openalex.org/W3107521695","doi":"https://doi.org/10.1109/access.2020.3041302","title":"SBGen: A Framework to Efficiently Supply Runtime Information for a Learning-Based HIDS for Multiple Virtual Machines","display_name":"SBGen: A Framework to Efficiently Supply Runtime Information for a Learning-Based HIDS for Multiple Virtual Machines","publication_year":2020,"publication_date":"2020-01-01","ids":{"openalex":"https://openalex.org/W3107521695","doi":"https://doi.org/10.1109/access.2020.3041302","mag":"3107521695"},"language":"en","primary_location":{"id":"doi:10.1109/access.2020.3041302","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2020.3041302","pdf_url":"https://ieeexplore.ieee.org/ielx7/6287639/6514899/09272991.pdf","source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"},"type":"article","indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://ieeexplore.ieee.org/ielx7/6287639/6514899/09272991.pdf","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5080529361","display_name":"Jiwon Seo","orcid":"https://orcid.org/0000-0003-1848-750X"},"institutions":[{"id":"https://openalex.org/I139264467","display_name":"Seoul National University","ror":"https://ror.org/04h9pn542","country_code":"KR","type":"education","lineage":["https://openalex.org/I139264467"]}],"countries":["KR"],"is_corresponding":false,"raw_author_name":"Jiwon Seo","raw_affiliation_strings":["Department of Electrical and Computer Engineering and ISRC, Seoul National University, Seoul, South Korea"],"raw_orcid":"https://orcid.org/0000-0003-1848-750X","affiliations":[{"raw_affiliation_string":"Department of Electrical and Computer Engineering and ISRC, Seoul National University, Seoul, South Korea","institution_ids":["https://openalex.org/I139264467"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5060154251","display_name":"Inyoung Bang","orcid":"https://orcid.org/0000-0003-3042-3023"},"institutions":[{"id":"https://openalex.org/I139264467","display_name":"Seoul National University","ror":"https://ror.org/04h9pn542","country_code":"KR","type":"education","lineage":["https://openalex.org/I139264467"]}],"countries":["KR"],"is_corresponding":false,"raw_author_name":"Inyoung Bang","raw_affiliation_strings":["Department of Electrical and Computer Engineering and ISRC, Seoul National University, Seoul, South Korea"],"raw_orcid":"https://orcid.org/0000-0003-3042-3023","affiliations":[{"raw_affiliation_string":"Department of Electrical and Computer Engineering and ISRC, Seoul National University, Seoul, South Korea","institution_ids":["https://openalex.org/I139264467"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5030661220","display_name":"Junseung You","orcid":"https://orcid.org/0000-0003-1539-229X"},"institutions":[{"id":"https://openalex.org/I139264467","display_name":"Seoul National University","ror":"https://ror.org/04h9pn542","country_code":"KR","type":"education","lineage":["https://openalex.org/I139264467"]}],"countries":["KR"],"is_corresponding":false,"raw_author_name":"Junseung You","raw_affiliation_strings":["Department of Electrical and Computer Engineering and ISRC, Seoul National University, Seoul, South Korea"],"raw_orcid":"https://orcid.org/0000-0003-1539-229X","affiliations":[{"raw_affiliation_string":"Department of Electrical and Computer Engineering and ISRC, Seoul National University, Seoul, South Korea","institution_ids":["https://openalex.org/I139264467"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5001298234","display_name":"Yeongpil Cho","orcid":"https://orcid.org/0000-0001-7842-1719"},"institutions":[{"id":"https://openalex.org/I4575257","display_name":"Hanyang University","ror":"https://ror.org/046865y68","country_code":"KR","type":"education","lineage":["https://openalex.org/I4575257"]}],"countries":["KR"],"is_corresponding":false,"raw_author_name":"Yeongpil Cho","raw_affiliation_strings":["Department of Computer Science, Hanyang University, Seoul, South Korea"],"raw_orcid":"https://orcid.org/0000-0001-7842-1719","affiliations":[{"raw_affiliation_string":"Department of Computer Science, Hanyang University, Seoul, South Korea","institution_ids":["https://openalex.org/I4575257"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5082524666","display_name":"Yunheung Paek","orcid":"https://orcid.org/0000-0002-6412-2926"},"institutions":[{"id":"https://openalex.org/I139264467","display_name":"Seoul National University","ror":"https://ror.org/04h9pn542","country_code":"KR","type":"education","lineage":["https://openalex.org/I139264467"]}],"countries":["KR"],"is_corresponding":false,"raw_author_name":"Yunheung Paek","raw_affiliation_strings":["Department of Electrical and Computer Engineering and ISRC, Seoul National University, Seoul, South Korea"],"raw_orcid":"https://orcid.org/0000-0002-6412-2926","affiliations":[{"raw_affiliation_string":"Department of Electrical and Computer Engineering and ISRC, Seoul National University, Seoul, South Korea","institution_ids":["https://openalex.org/I139264467"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":{"value":1850,"currency":"USD","value_usd":1850},"apc_paid":{"value":1850,"currency":"USD","value_usd":1850},"fwci":0.2608,"has_fulltext":true,"cited_by_count":3,"citation_normalized_percentile":{"value":0.64759895,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":94,"max":97},"biblio":{"volume":"8","issue":null,"first_page":"225356","last_page":"225369"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.9997000098228455,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.9997000098228455,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9984999895095825,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9970999956130981,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8730465173721313},{"id":"https://openalex.org/keywords/trace","display_name":"TRACE (psycholinguistics)","score":0.6114016771316528},{"id":"https://openalex.org/keywords/kernel","display_name":"Kernel (algebra)","score":0.5988467931747437},{"id":"https://openalex.org/keywords/hypervisor","display_name":"Hypervisor","score":0.5607589483261108},{"id":"https://openalex.org/keywords/virtual-machine","display_name":"Virtual machine","score":0.5197650790214539},{"id":"https://openalex.org/keywords/virtualization","display_name":"Virtualization","score":0.5164570808410645},{"id":"https://openalex.org/keywords/isolation","display_name":"Isolation (microbiology)","score":0.4925721287727356},{"id":"https://openalex.org/keywords/system-call","display_name":"System call","score":0.4279555678367615},{"id":"https://openalex.org/keywords/distributed-computing","display_name":"Distributed computing","score":0.4117533564567566},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.3937913179397583},{"id":"https://openalex.org/keywords/cloud-computing","display_name":"Cloud computing","score":0.08810552954673767}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8730465173721313},{"id":"https://openalex.org/C75291252","wikidata":"https://www.wikidata.org/wiki/Q1315756","display_name":"TRACE (psycholinguistics)","level":2,"score":0.6114016771316528},{"id":"https://openalex.org/C74193536","wikidata":"https://www.wikidata.org/wiki/Q574844","display_name":"Kernel (algebra)","level":2,"score":0.5988467931747437},{"id":"https://openalex.org/C112904061","wikidata":"https://www.wikidata.org/wiki/Q1077480","display_name":"Hypervisor","level":4,"score":0.5607589483261108},{"id":"https://openalex.org/C25344961","wikidata":"https://www.wikidata.org/wiki/Q192726","display_name":"Virtual machine","level":2,"score":0.5197650790214539},{"id":"https://openalex.org/C513985346","wikidata":"https://www.wikidata.org/wiki/Q270471","display_name":"Virtualization","level":3,"score":0.5164570808410645},{"id":"https://openalex.org/C2775941552","wikidata":"https://www.wikidata.org/wiki/Q25212305","display_name":"Isolation (microbiology)","level":2,"score":0.4925721287727356},{"id":"https://openalex.org/C2778579508","wikidata":"https://www.wikidata.org/wiki/Q722192","display_name":"System call","level":2,"score":0.4279555678367615},{"id":"https://openalex.org/C120314980","wikidata":"https://www.wikidata.org/wiki/Q180634","display_name":"Distributed computing","level":1,"score":0.4117533564567566},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.3937913179397583},{"id":"https://openalex.org/C79974875","wikidata":"https://www.wikidata.org/wiki/Q483639","display_name":"Cloud computing","level":2,"score":0.08810552954673767},{"id":"https://openalex.org/C86803240","wikidata":"https://www.wikidata.org/wiki/Q420","display_name":"Biology","level":0,"score":0.0},{"id":"https://openalex.org/C89423630","wikidata":"https://www.wikidata.org/wiki/Q7193","display_name":"Microbiology","level":1,"score":0.0},{"id":"https://openalex.org/C114614502","wikidata":"https://www.wikidata.org/wiki/Q76592","display_name":"Combinatorics","level":1,"score":0.0},{"id":"https://openalex.org/C138885662","wikidata":"https://www.wikidata.org/wiki/Q5891","display_name":"Philosophy","level":0,"score":0.0},{"id":"https://openalex.org/C41895202","wikidata":"https://www.wikidata.org/wiki/Q8162","display_name":"Linguistics","level":1,"score":0.0},{"id":"https://openalex.org/C33923547","wikidata":"https://www.wikidata.org/wiki/Q395","display_name":"Mathematics","level":0,"score":0.0}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1109/access.2020.3041302","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2020.3041302","pdf_url":"https://ieeexplore.ieee.org/ielx7/6287639/6514899/09272991.pdf","source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"},{"id":"pmh:oai:doaj.org/article:c03d341f1cf3482d93c7524558f599b5","is_oa":true,"landing_page_url":"https://doaj.org/article/c03d341f1cf3482d93c7524558f599b5","pdf_url":null,"source":{"id":"https://openalex.org/S4306401280","display_name":"DOAJ (DOAJ: Directory of Open Access Journals)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-sa","license_id":"https://openalex.org/licenses/cc-by-sa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"IEEE Access, Vol 8, Pp 225356-225369 (2020)","raw_type":"article"}],"best_oa_location":{"id":"doi:10.1109/access.2020.3041302","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2020.3041302","pdf_url":"https://ieeexplore.ieee.org/ielx7/6287639/6514899/09272991.pdf","source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"},"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G1001899930","display_name":null,"funder_award_id":"NRF-2020R1A2B5B03095204","funder_id":"https://openalex.org/F4320322120","funder_display_name":"National Research Foundation of Korea"},{"id":"https://openalex.org/G1577721561","display_name":null,"funder_award_id":"IITP-2020-2020-0-01602","funder_id":"https://openalex.org/F4320328359","funder_display_name":"Ministry of Science and ICT, South Korea"},{"id":"https://openalex.org/G3692524881","display_name":null,"funder_award_id":"2018-0-00230","funder_id":"https://openalex.org/F4320328359","funder_display_name":"Ministry of Science and ICT, South Korea"},{"id":"https://openalex.org/G4086612289","display_name":null,"funder_award_id":"No.2017-0-00213","funder_id":"https://openalex.org/F4320335489","funder_display_name":"Institute for Information and Communications Technology Promotion"},{"id":"https://openalex.org/G4979779621","display_name":null,"funder_award_id":"2017-0-00213","funder_id":"https://openalex.org/F4320335489","funder_display_name":"Institute for Information and Communications Technology Promotion"},{"id":"https://openalex.org/G6804443773","display_name":null,"funder_award_id":"IITP-2020-2020-0-01602","funder_id":"https://openalex.org/F4320335489","funder_display_name":"Institute for Information and Communications Technology Promotion"}],"funders":[{"id":"https://openalex.org/F4320320671","display_name":"National Research Foundation","ror":"https://ror.org/05s0g1g46"},{"id":"https://openalex.org/F4320321292","display_name":"Seoul National University","ror":"https://ror.org/04h9pn542"},{"id":"https://openalex.org/F4320322120","display_name":"National Research Foundation of Korea","ror":"https://ror.org/013aysd81"},{"id":"https://openalex.org/F4320324891","display_name":"Iran Telecommunication Research Center","ror":"https://ror.org/01a3g2z22"},{"id":"https://openalex.org/F4320328359","display_name":"Ministry of Science and ICT, South Korea","ror":"https://ror.org/01wpjm123"},{"id":"https://openalex.org/F4320335489","display_name":"Institute for Information and Communications Technology Promotion","ror":"https://ror.org/01g0hqq23"}],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W3107521695.pdf","grobid_xml":"https://content.openalex.org/works/W3107521695.grobid-xml"},"referenced_works_count":40,"referenced_works":["https://openalex.org/W6385438","https://openalex.org/W1482036107","https://openalex.org/W1829003931","https://openalex.org/W1832277845","https://openalex.org/W1973841765","https://openalex.org/W1983927629","https://openalex.org/W1984350393","https://openalex.org/W1996575854","https://openalex.org/W2002627919","https://openalex.org/W2023446630","https://openalex.org/W2025475662","https://openalex.org/W2041700825","https://openalex.org/W2064675550","https://openalex.org/W2118372007","https://openalex.org/W2128217000","https://openalex.org/W2135143063","https://openalex.org/W2135162105","https://openalex.org/W2153497135","https://openalex.org/W2161085373","https://openalex.org/W2167240430","https://openalex.org/W2167332015","https://openalex.org/W2527840540","https://openalex.org/W2551087083","https://openalex.org/W2584029330","https://openalex.org/W2602748134","https://openalex.org/W2612529343","https://openalex.org/W2751862727","https://openalex.org/W2752985907","https://openalex.org/W2795214959","https://openalex.org/W2810936651","https://openalex.org/W2891432086","https://openalex.org/W2945361958","https://openalex.org/W3100503250","https://openalex.org/W3136767761","https://openalex.org/W4250392047","https://openalex.org/W6600256889","https://openalex.org/W6682684344","https://openalex.org/W6729739840","https://openalex.org/W6744121465","https://openalex.org/W6750514344"],"related_works":["https://openalex.org/W2148749405","https://openalex.org/W2104105430","https://openalex.org/W1515917392","https://openalex.org/W1973516247","https://openalex.org/W2613320081","https://openalex.org/W2179519055","https://openalex.org/W2743348030","https://openalex.org/W2747005099","https://openalex.org/W2145292010","https://openalex.org/W2086039693"],"abstract_inverted_index":{"Much":[0],"compelling":[1],"evidence":[2],"urges":[3],"that":[4,229],"the":[5,9,32,40,55,76,79,94,149,154,158,169,184,187,203,252],"isolation":[6],"provided":[7],"by":[8,26,64,88],"hypervisor":[10],"in":[11,21,83,130,245,257],"a":[12,136,174,246,258,263],"virtualized":[13,259],"system":[14,150,163,207],"is":[15,106,216],"not":[16],"complete":[17],"at":[18],"all,":[19],"and":[20,153,195,233],"practice":[22],"can":[23,85,231],"be":[24,86],"neutralized":[25],"elaborated":[27],"adversaries,":[28],"which":[29,53,82],"consequently":[30],"emphasizes":[31],"need":[33],"of":[34,57,71,78,97,110,141,146,157,168,186,202,214,266],"techniques":[35],"to":[36,119,161,198,221,243],"detect":[37,244],"attacks":[38,250],"on":[39,75,108,251],"guest":[41,253],"VM":[42,59,254],"kernels.":[43],"In":[44],"this":[45,128,131],"regard,":[46],"learning-based":[47,72,115,219,241],"HIDSs":[48,73,116,220,242],"have":[49,117],"received":[50],"much":[51],"attention,":[52],"inspect":[54],"internals":[56],"each":[58],"through":[60],"monitoring":[61,80],"models":[62],"built":[63],"machine":[65],"learning":[66],"techniques.":[67],"The":[68,209],"inspection":[69],"capability":[70],"depends":[74],"quality":[77],"models,":[81],"turn":[84],"improved":[87],"using":[89,120],"rich":[90,142],"runtime":[91,103,123,143,211,235],"information":[92,105,145,213,237],"reflecting":[93],"exact":[95],"behavior":[96,104,124,144,212,236],"VMs.":[98],"However,":[99],"as":[100],"extracting":[101],"such":[102],"onerous":[107],"account":[109],"its":[111],"vast":[112],"quantity,":[113],"many":[114],"resorted":[118],"only":[121],"fragmentary":[122],"information.":[125],"To":[126,165],"address":[127],"problem,":[129],"paper,":[132],"we":[133],"present":[134],"SBGen,":[135],"framework":[137],"for":[138,240],"efficient":[139],"extraction":[140],"VMs,":[147],"namely":[148],"call":[151],"traces":[152,189],"execution":[155,167,185,200],"paths":[156,201],"kernel":[159,170,188,204],"taken":[160],"serve":[162],"calls.":[164,208],"trace":[166],"efficiently,":[171],"SBGen":[172,192,230],"leverages":[173],"salient":[175],"hardware":[176],"feature,":[177],"Intel":[178],"Processor":[179],"Trace":[180],"(PT).":[181],"Once":[182],"receiving":[183],"from":[190],"PT,":[191],"elaborately":[193],"decodes":[194],"purifies":[196],"them":[197],"extract":[199,232],"associated":[205],"with":[206],"extracted":[210],"VMs":[215],"fed":[217],"into":[218],"improve":[222],"their":[223],"detection":[224],"accuracy.":[225],"Our":[226],"experiments":[227],"show":[228],"supply":[234],"efficiently":[238],"enough":[239],"timely":[247],"fashion":[248],"real-world":[249],"kernels":[255],"running":[256],"system,":[260],"while":[261],"incurring":[262],"reasonable":[264],"amount":[265],"performance":[267],"overhead.":[268]},"counts_by_year":[{"year":2026,"cited_by_count":1},{"year":2022,"cited_by_count":2}],"updated_date":"2026-03-27T05:58:40.876381","created_date":"2025-10-10T00:00:00"}