{"id":"https://openalex.org/W2742249911","doi":"https://doi.org/10.1145/3098954.3098995","title":"VMAttack","display_name":"VMAttack","publication_year":2017,"publication_date":"2017-08-10","ids":{"openalex":"https://openalex.org/W2742249911","doi":"https://doi.org/10.1145/3098954.3098995","mag":"2742249911"},"language":"en","primary_location":{"id":"doi:10.1145/3098954.3098995","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3098954.3098995","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 12th International Conference on Availability, Reliability and Security","raw_type":"proceedings-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5023542606","display_name":"Anatoli Kalysch","orcid":null},"institutions":[{"id":"https://openalex.org/I181369854","display_name":"Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg","ror":"https://ror.org/00f7hpc57","country_code":"DE","type":"education","lineage":["https://openalex.org/I181369854"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Anatoli Kalysch","raw_affiliation_strings":["FAU Erlangen-Nuremberg"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"FAU Erlangen-Nuremberg","institution_ids":["https://openalex.org/I181369854"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5086747807","display_name":"Johannes G\u00f6tzfried","orcid":null},"institutions":[{"id":"https://openalex.org/I181369854","display_name":"Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg","ror":"https://ror.org/00f7hpc57","country_code":"DE","type":"education","lineage":["https://openalex.org/I181369854"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Johannes G\u00f6tzfried","raw_affiliation_strings":["FAU Erlangen-Nuremberg"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"FAU Erlangen-Nuremberg","institution_ids":["https://openalex.org/I181369854"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5013627385","display_name":"Tilo M\u00fcller","orcid":"https://orcid.org/0009-0007-0430-1467"},"institutions":[{"id":"https://openalex.org/I181369854","display_name":"Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg","ror":"https://ror.org/00f7hpc57","country_code":"DE","type":"education","lineage":["https://openalex.org/I181369854"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Tilo M\u00fcller","raw_affiliation_strings":["FAU Erlangen-Nuremberg"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"FAU Erlangen-Nuremberg","institution_ids":["https://openalex.org/I181369854"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I181369854"],"apc_list":null,"apc_paid":null,"fwci":2.592,"has_fulltext":false,"cited_by_count":25,"citation_normalized_percentile":{"value":0.92054445,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":89,"max":98},"biblio":{"volume":null,"issue":null,"first_page":"1","last_page":"10"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9980000257492065,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10743","display_name":"Software Testing and Debugging Techniques","score":0.9962999820709229,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8834564685821533},{"id":"https://openalex.org/keywords/bytecode","display_name":"Bytecode","score":0.8044911026954651},{"id":"https://openalex.org/keywords/static-analysis","display_name":"Static analysis","score":0.7951921224594116},{"id":"https://openalex.org/keywords/trace","display_name":"TRACE (psycholinguistics)","score":0.6341679096221924},{"id":"https://openalex.org/keywords/virtual-machine","display_name":"Virtual machine","score":0.5419976711273193},{"id":"https://openalex.org/keywords/virtualization","display_name":"Virtualization","score":0.47219762206077576},{"id":"https://openalex.org/keywords/reverse-engineering","display_name":"Reverse engineering","score":0.45488241314888},{"id":"https://openalex.org/keywords/executable","display_name":"Executable","score":0.45073404908180237},{"id":"https://openalex.org/keywords/stack","display_name":"Stack (abstract data type)","score":0.43942806124687195},{"id":"https://openalex.org/keywords/programming-language","display_name":"Programming language","score":0.42624345421791077},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.39638006687164307},{"id":"https://openalex.org/keywords/cloud-computing","display_name":"Cloud computing","score":0.12670892477035522}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8834564685821533},{"id":"https://openalex.org/C2779818221","wikidata":"https://www.wikidata.org/wiki/Q837330","display_name":"Bytecode","level":3,"score":0.8044911026954651},{"id":"https://openalex.org/C97686452","wikidata":"https://www.wikidata.org/wiki/Q7604153","display_name":"Static analysis","level":2,"score":0.7951921224594116},{"id":"https://openalex.org/C75291252","wikidata":"https://www.wikidata.org/wiki/Q1315756","display_name":"TRACE (psycholinguistics)","level":2,"score":0.6341679096221924},{"id":"https://openalex.org/C25344961","wikidata":"https://www.wikidata.org/wiki/Q192726","display_name":"Virtual machine","level":2,"score":0.5419976711273193},{"id":"https://openalex.org/C513985346","wikidata":"https://www.wikidata.org/wiki/Q270471","display_name":"Virtualization","level":3,"score":0.47219762206077576},{"id":"https://openalex.org/C207850805","wikidata":"https://www.wikidata.org/wiki/Q269608","display_name":"Reverse engineering","level":2,"score":0.45488241314888},{"id":"https://openalex.org/C160145156","wikidata":"https://www.wikidata.org/wiki/Q778586","display_name":"Executable","level":2,"score":0.45073404908180237},{"id":"https://openalex.org/C9395851","wikidata":"https://www.wikidata.org/wiki/Q177929","display_name":"Stack (abstract data type)","level":2,"score":0.43942806124687195},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.42624345421791077},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.39638006687164307},{"id":"https://openalex.org/C79974875","wikidata":"https://www.wikidata.org/wiki/Q483639","display_name":"Cloud computing","level":2,"score":0.12670892477035522},{"id":"https://openalex.org/C138885662","wikidata":"https://www.wikidata.org/wiki/Q5891","display_name":"Philosophy","level":0,"score":0.0},{"id":"https://openalex.org/C41895202","wikidata":"https://www.wikidata.org/wiki/Q8162","display_name":"Linguistics","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3098954.3098995","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3098954.3098995","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 12th International Conference on Availability, Reliability and Security","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[{"id":"https://openalex.org/F4320320879","display_name":"Deutsche Forschungsgemeinschaft","ror":"https://ror.org/018mejw64"}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":24,"referenced_works":["https://openalex.org/W9193867","https://openalex.org/W116627068","https://openalex.org/W345398754","https://openalex.org/W956474006","https://openalex.org/W959975051","https://openalex.org/W1480157704","https://openalex.org/W1514023947","https://openalex.org/W1538186256","https://openalex.org/W1595979964","https://openalex.org/W1905217560","https://openalex.org/W1984248430","https://openalex.org/W2025025782","https://openalex.org/W2049629426","https://openalex.org/W2064435654","https://openalex.org/W2128389850","https://openalex.org/W2131266495","https://openalex.org/W2154871153","https://openalex.org/W2159702664","https://openalex.org/W2514974017","https://openalex.org/W2561675875","https://openalex.org/W2574017551","https://openalex.org/W2614344471","https://openalex.org/W4229700753","https://openalex.org/W4231040899"],"related_works":["https://openalex.org/W2969365378","https://openalex.org/W2963856074","https://openalex.org/W2791844455","https://openalex.org/W2112192942","https://openalex.org/W3042371867","https://openalex.org/W4200453963","https://openalex.org/W2113714600","https://openalex.org/W2899569243","https://openalex.org/W1480767630","https://openalex.org/W825544607"],"abstract_inverted_index":{"We":[0,152],"present":[1],"VMAttack,":[2],"a":[3,18,28,131,138],"deobfuscation":[4],"tool":[5],"for":[6,30,86,169,174],"virtualization-packed":[7],"binaries":[8,156],"based":[9,79],"on":[10,80],"automated":[11],"static":[12,65,121,177],"and":[13,33,101,122,160,172,178],"dynamic":[14,91,123,171,179],"analysis,":[15,66,92],"which":[16,118],"offers":[17],"simplified":[19],"view":[20,47],"of":[21,44,57,61,70,111,137,167],"the":[22,45,53,58,71,98,112,127,170,175],"disassembly.":[23],"VMAttack":[24,142,154],"is":[25,48,143],"implemented":[26],"as":[27,34],"plug-in":[29],"IDA":[31],"Pro":[32],"such,":[35],"integrates":[36],"seamlessly":[37],"with":[38,130,158],"manual":[39],"reverse":[40,128],"engineering.":[41],"The":[42,115],"complexity":[43],"disassembly":[46,133],"notably":[49],"reduced":[50],"by":[51,105],"analyzing":[52],"inner":[54],"working":[55],"principles":[56],"VM":[59,72],"layer":[60],"protected":[62],"binaries.":[63],"Using":[64,90],"complex":[67],"bytecode":[68],"sequences":[69,104],"are":[73],"mapped":[74],"to":[75,146],"easy-to-read":[76],"pseudo-code":[77],"instructions,":[78],"an":[81,162],"intermediate":[82],"representation":[83],"specifically":[84],"designed":[85],"stack-based":[87,147],"virtual":[88,148],"machines.":[89],"we":[93],"identify":[94],"structural":[95],"components":[96],"like":[97,150],"interpreter":[99],"loop":[100],"compress":[102],"instruction":[103],"filtering":[106],"out":[107],"semantically":[108],"redundant":[109],"instructions":[110],"execution":[113,164],"trace.":[114],"integrated":[116],"result,":[117],"rates":[119],"both":[120],"analysis's":[124],"results,":[125],"provides":[126],"engineer":[129],"deobfuscated":[132],"that":[134],"tolerates":[135],"weaknesses":[136],"single":[139],"analysis":[140],"technique.":[141],"currently":[144],"limited":[145],"machines":[149],"VMProtect.":[151],"evaluated":[153],"using":[155],"obfuscated":[157],"VMProtect":[159],"achieved":[161],"average":[163],"trace":[165],"reduction":[166],"89.86%":[168],"96.67%":[173],"combined":[176],"analysis.":[180]},"counts_by_year":[{"year":2025,"cited_by_count":3},{"year":2024,"cited_by_count":1},{"year":2023,"cited_by_count":4},{"year":2022,"cited_by_count":1},{"year":2021,"cited_by_count":3},{"year":2020,"cited_by_count":5},{"year":2019,"cited_by_count":4},{"year":2018,"cited_by_count":4}],"updated_date":"2025-11-06T03:46:38.306776","created_date":"2017-08-17T00:00:00"}