{"id":"https://openalex.org/W2766613627","doi":"https://doi.org/10.1145/3123939.3123972","title":"RHMD","display_name":"RHMD","publication_year":2017,"publication_date":"2017-10-14","ids":{"openalex":"https://openalex.org/W2766613627","doi":"https://doi.org/10.1145/3123939.3123972","mag":"2766613627"},"language":"en","primary_location":{"id":"doi:10.1145/3123939.3123972","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3123939.3123972","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 50th Annual IEEE/ACM International Symposium on Microarchitecture","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5037831461","display_name":"Khaled N. Khasawneh","orcid":"https://orcid.org/0000-0002-2116-2223"},"institutions":[{"id":"https://openalex.org/I2803209242","display_name":"University of California System","ror":"https://ror.org/00pjdza24","country_code":"US","type":"education","lineage":["https://openalex.org/I2803209242"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Khaled N. Khasawneh","raw_affiliation_strings":["University of California"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of California","institution_ids":["https://openalex.org/I2803209242"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5059614371","display_name":"Nael Abu\u2010Ghazaleh","orcid":"https://orcid.org/0000-0002-9485-5370"},"institutions":[{"id":"https://openalex.org/I2803209242","display_name":"University of California System","ror":"https://ror.org/00pjdza24","country_code":"US","type":"education","lineage":["https://openalex.org/I2803209242"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Nael Abu-Ghazaleh","raw_affiliation_strings":["University of California"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of California","institution_ids":["https://openalex.org/I2803209242"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5066100959","display_name":"Dmitry Ponomarev","orcid":"https://orcid.org/0009-0006-5656-2258"},"institutions":[{"id":"https://openalex.org/I123946342","display_name":"Binghamton University","ror":"https://ror.org/008rmbt77","country_code":"US","type":"education","lineage":["https://openalex.org/I123946342"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Dmitry Ponomarev","raw_affiliation_strings":["Binghamton University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Binghamton University","institution_ids":["https://openalex.org/I123946342"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5100445935","display_name":"Lei Yu","orcid":"https://orcid.org/0000-0002-9188-6112"},"institutions":[{"id":"https://openalex.org/I123946342","display_name":"Binghamton University","ror":"https://ror.org/008rmbt77","country_code":"US","type":"education","lineage":["https://openalex.org/I123946342"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Lei Yu","raw_affiliation_strings":["Binghamton University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Binghamton University","institution_ids":["https://openalex.org/I123946342"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":60,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"315","last_page":"327"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.9980999827384949,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9940999746322632,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.8948169946670532},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8122856616973877},{"id":"https://openalex.org/keywords/detector","display_name":"Detector","score":0.7905445098876953},{"id":"https://openalex.org/keywords/reverse-engineering","display_name":"Reverse engineering","score":0.6101778745651245},{"id":"https://openalex.org/keywords/mobile-malware","display_name":"Mobile malware","score":0.45428749918937683},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.43257737159729004},{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.41889050602912903},{"id":"https://openalex.org/keywords/machine-learning","display_name":"Machine learning","score":0.3421962261199951},{"id":"https://openalex.org/keywords/embedded-system","display_name":"Embedded system","score":0.3338579535484314},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.28570759296417236},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.15086829662322998}],"concepts":[{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.8948169946670532},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8122856616973877},{"id":"https://openalex.org/C94915269","wikidata":"https://www.wikidata.org/wiki/Q1834857","display_name":"Detector","level":2,"score":0.7905445098876953},{"id":"https://openalex.org/C207850805","wikidata":"https://www.wikidata.org/wiki/Q269608","display_name":"Reverse engineering","level":2,"score":0.6101778745651245},{"id":"https://openalex.org/C2780967490","wikidata":"https://www.wikidata.org/wiki/Q1291200","display_name":"Mobile malware","level":3,"score":0.45428749918937683},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.43257737159729004},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.41889050602912903},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.3421962261199951},{"id":"https://openalex.org/C149635348","wikidata":"https://www.wikidata.org/wiki/Q193040","display_name":"Embedded system","level":1,"score":0.3338579535484314},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.28570759296417236},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.15086829662322998},{"id":"https://openalex.org/C76155785","wikidata":"https://www.wikidata.org/wiki/Q418","display_name":"Telecommunications","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3123939.3123972","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3123939.3123972","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 50th Annual IEEE/ACM International Symposium on Microarchitecture","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G7038923710","display_name":null,"funder_award_id":"1617915, 1619322","funder_id":"https://openalex.org/F4320337388","funder_display_name":"Division of Computer and Network Systems"}],"funders":[{"id":"https://openalex.org/F4320337388","display_name":"Division of Computer and Network Systems","ror":"https://ror.org/02rdzmk74"}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":60,"referenced_works":["https://openalex.org/W9657784","https://openalex.org/W36091977","https://openalex.org/W191098608","https://openalex.org/W200681053","https://openalex.org/W1513231349","https://openalex.org/W1516960038","https://openalex.org/W1594536929","https://openalex.org/W1650881334","https://openalex.org/W1887482550","https://openalex.org/W1967694157","https://openalex.org/W1968519345","https://openalex.org/W1973211701","https://openalex.org/W1973614149","https://openalex.org/W1973697585","https://openalex.org/W2014182302","https://openalex.org/W2017371166","https://openalex.org/W2024170198","https://openalex.org/W2034053858","https://openalex.org/W2034938003","https://openalex.org/W2036853599","https://openalex.org/W2038296020","https://openalex.org/W2066220442","https://openalex.org/W2096921767","https://openalex.org/W2112507308","https://openalex.org/W2113261561","https://openalex.org/W2125908420","https://openalex.org/W2132504937","https://openalex.org/W2132874238","https://openalex.org/W2133141510","https://openalex.org/W2134633067","https://openalex.org/W2140807364","https://openalex.org/W2141577524","https://openalex.org/W2151135920","https://openalex.org/W2161470437","https://openalex.org/W2162800072","https://openalex.org/W2166004296","https://openalex.org/W2166844173","https://openalex.org/W2169384781","https://openalex.org/W2274565976","https://openalex.org/W2285181575","https://openalex.org/W2292977173","https://openalex.org/W2295290223","https://openalex.org/W2299561166","https://openalex.org/W2344380211","https://openalex.org/W2350778671","https://openalex.org/W2404948481","https://openalex.org/W2466724905","https://openalex.org/W2535690855","https://openalex.org/W2566616266","https://openalex.org/W2573650634","https://openalex.org/W2574797807","https://openalex.org/W2603766943","https://openalex.org/W2913950235","https://openalex.org/W2914280573","https://openalex.org/W2950774332","https://openalex.org/W2963207607","https://openalex.org/W2964318098","https://openalex.org/W3007346474","https://openalex.org/W3103836116","https://openalex.org/W4247833239"],"related_works":["https://openalex.org/W2538622067","https://openalex.org/W4210907385","https://openalex.org/W2181494682","https://openalex.org/W4245250093","https://openalex.org/W3114159050","https://openalex.org/W2484248966","https://openalex.org/W4244354662","https://openalex.org/W2609233367","https://openalex.org/W4200054778","https://openalex.org/W2777464647"],"abstract_inverted_index":{"Hardware":[0],"Malware":[1],"Detectors":[2],"(HMDs)":[3],"have":[4,47],"recently":[5],"been":[6,48],"proposed":[7],"as":[8,37,145],"a":[9,38,125,182],"defense":[10,255],"against":[11,256],"the":[12,26,44,61,108,150,167,235,239,244],"proliferation":[13],"of":[14,43,63,102,111,185,243],"malware.":[15,119],"These":[16,195],"detectors":[17,52,158,169,196,224],"use":[18],"low-level":[19],"features,":[20],"that":[21,75,107,141,189,221,234,250],"can":[22,68,78,113,127,159,170,197],"be":[23,79,114,160,171,198,201],"collected":[24],"by":[25,71,117],"hardware":[27],"performance":[28],"monitoring":[29],"units":[30],"on":[31,209],"modern":[32],"CPUs":[33],"to":[34,51,87,133,162,200,205,227],"detect":[35,149,163],"malware":[36,67,86,136,152,258],"computational":[39],"anomaly.":[40],"Several":[41],"aspects":[42],"detector":[45,126],"construction":[46],"explored,":[49],"leading":[50],"with":[53,154,238],"high":[54],"accuracy.":[55],"In":[56],"this":[57,134],"paper,":[58],"we":[59,121,180],"explore":[60,122],"question":[62],"how":[64,123],"well":[65,124],"evasive":[66,118,135,151,164,257],"avoid":[69],"detection":[70,90],"HMDs.":[72],"We":[73,139,219],"show":[74,140,220],"existing":[76],"HMDs":[77,112,187,252],"effectively":[80],"reverse-engineered":[81,172],"and":[82,173,231,233,241],"subsequently":[83],"evaded,":[84],"allowing":[85],"hide":[88],"from":[89],"without":[91],"substantially":[92],"slowing":[93],"it":[94,130],"down":[95],"(which":[96],"is":[97,131],"important":[98],"for":[99],"certain":[100],"types":[101],"malware).":[103],"This":[104],"result":[105],"demonstrates":[106],"current":[109],"generation":[110],"easily":[115],"defeated":[116],"Next,":[120],"evolve":[128],"if":[129],"exposed":[132],"during":[137],"training.":[138],"simple":[142],"detectors,":[143],"such":[144,223],"logistic":[146],"regression,":[147],"cannot":[148],"even":[153],"retraining.":[155],"More":[156],"sophisticated":[157],"retrained":[161,168],"malware,":[165],"but":[166],"evaded":[174],"again.":[175],"To":[176],"address":[177],"these":[178,251],"limitations,":[179],"propose":[181],"new":[183],"type":[184],"Resilient":[186],"(RHMDs)":[188],"stochastically":[190],"switch":[191],"between":[192],"different":[193],"detectors.":[194,246],"shown":[199],"provably":[202],"more":[203],"difficult":[204],"reverse":[206,229],"engineer":[207],"based":[208],"resent":[210],"results":[211,248],"in":[212],"probably":[213],"approximately":[214],"correct":[215],"(PAC)":[216],"learnability":[217],"theory.":[218],"indeed":[222],"are":[225],"resilient":[226],"both":[228],"engineering":[230],"evasion,":[232],"resilience":[236],"increases":[237],"number":[240],"diversity":[242],"individual":[245],"Our":[247],"demonstrate":[249],"offer":[253],"effective":[254],"at":[259],"low":[260],"additional":[261],"complexity.":[262]},"counts_by_year":[{"year":2026,"cited_by_count":1},{"year":2025,"cited_by_count":3},{"year":2024,"cited_by_count":7},{"year":2023,"cited_by_count":6},{"year":2022,"cited_by_count":7},{"year":2021,"cited_by_count":13},{"year":2020,"cited_by_count":12},{"year":2019,"cited_by_count":8},{"year":2018,"cited_by_count":3}],"updated_date":"2026-07-14T23:27:15.235271","created_date":"2017-11-10T00:00:00"}