{"id":"https://openalex.org/W2774602685","doi":"https://doi.org/10.1145/3134600.3134622","title":"Co-processor-based Behavior Monitoring","display_name":"Co-processor-based Behavior Monitoring","publication_year":2017,"publication_date":"2017-12-04","ids":{"openalex":"https://openalex.org/W2774602685","doi":"https://doi.org/10.1145/3134600.3134622","mag":"2774602685"},"language":"en","primary_location":{"id":"doi:10.1145/3134600.3134622","doi":"https://doi.org/10.1145/3134600.3134622","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3134600.3134622","pdf_url":null,"source":{"id":"https://openalex.org/S4306417673","display_name":"Annual Computer Security Applications Conference","issn_l":"1063-9527","issn":["1063-9527","2576-9103"],"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 33rd Annual Computer Security Applications Conference","raw_type":"proceedings-article"},"volume":null,"type":"conference-paper","indexed_in":["arxiv","crossref","datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://arxiv.org/pdf/1803.02700","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5051495407","display_name":"Ronny Chevalier","orcid":"https://orcid.org/0000-0002-7479-4988","observed_orcids":["https://orcid.org/0000-0002-7479-4988"]},"institutions":[{"id":"https://openalex.org/I1324840837","display_name":"Hewlett-Packard (United States)","ror":"https://ror.org/059rn9488","country_code":"US","type":"company","lineage":["https://openalex.org/I1324840837"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Ronny Chevalier","raw_affiliation_strings":["HP Labs"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"HP Labs","institution_ids":["https://openalex.org/I1324840837"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5056367729","display_name":"Maugan Villatel","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I1324840837","display_name":"Hewlett-Packard (United States)","ror":"https://ror.org/059rn9488","country_code":"US","type":"company","lineage":["https://openalex.org/I1324840837"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Maugan Villatel","raw_affiliation_strings":["HP Labs"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"HP Labs","institution_ids":["https://openalex.org/I1324840837"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5078241470","display_name":"David Plaquin","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I1324840837","display_name":"Hewlett-Packard (United States)","ror":"https://ror.org/059rn9488","country_code":"US","type":"company","lineage":["https://openalex.org/I1324840837"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"David Plaquin","raw_affiliation_strings":["HP Labs"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"HP Labs","institution_ids":["https://openalex.org/I1324840837"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5026667916","display_name":"Guillaume Hiet","orcid":"https://orcid.org/0000-0002-7176-9760","observed_orcids":["https://orcid.org/0000-0002-7176-9760"]},"institutions":[{"id":"https://openalex.org/I4210107720","display_name":"CentraleSup\u00e9lec","ror":"https://ror.org/019tcpt25","country_code":"FR","type":"facility","lineage":["https://openalex.org/I277688954","https://openalex.org/I4210107720"]}],"countries":["FR"],"is_corresponding":false,"raw_author_name":"Guillaume Hiet","raw_affiliation_strings":["CentraleSup\u00e9lec"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"CentraleSup\u00e9lec","institution_ids":["https://openalex.org/I4210107720"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.8614,"has_fulltext":false,"cited_by_count":12,"citation_normalized_percentile":{"value":0.79243285,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":88,"max":97},"biblio":{"volume":null,"issue":null,"first_page":"399","last_page":"411"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12122","display_name":"Physical Unclonable Functions (PUFs) and Hardware Security","score":0.0,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/behavior-monitoring","display_name":"behavioral monitoring","score":0.7350000143051147},{"id":"https://openalex.org/keywords/coprocessor","display_name":"coprocessor","score":0.8069999814033508},{"id":"https://openalex.org/keywords/firmware-security","display_name":"firmware security","score":0.718999981880188},{"id":"https://openalex.org/keywords/system-management-mode","display_name":"System Management Mode","score":0.9300000071525574},{"id":"https://openalex.org/keywords/runtime-attack-detection","display_name":"runtime attack detection","score":0.6869999766349792},{"id":"https://openalex.org/keywords/event-based-monitoring","display_name":"event-based monitoring","score":0.6909999847412109},{"id":"https://openalex.org/keywords/code-instrumentation","display_name":"code instrumentation","score":0.6290000081062317},{"id":"https://openalex.org/keywords/semantic-gap","display_name":"semantic gap","score":0.5950000286102295},{"id":"https://openalex.org/keywords/x86","display_name":"x86","score":0.5699999928474426},{"id":"https://openalex.org/keywords/runtime-overhead","display_name":"runtime overhead","score":0.31299999356269836}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8342837691307068},{"id":"https://openalex.org/C67212190","wikidata":"https://www.wikidata.org/wiki/Q104851","display_name":"Firmware","level":2,"score":0.7533438205718994},{"id":"https://openalex.org/C170723468","wikidata":"https://www.wikidata.org/wiki/Q182933","display_name":"x86","level":3,"score":0.7195454835891724},{"id":"https://openalex.org/C149635348","wikidata":"https://www.wikidata.org/wiki/Q193040","display_name":"Embedded system","level":1,"score":0.5560283660888672},{"id":"https://openalex.org/C2779960059","wikidata":"https://www.wikidata.org/wiki/Q7113681","display_name":"Overhead (engineering)","level":2,"score":0.5410195589065552},{"id":"https://openalex.org/C2779343474","wikidata":"https://www.wikidata.org/wiki/Q3109175","display_name":"Context (archaeology)","level":2,"score":0.5228676795959473},{"id":"https://openalex.org/C26771161","wikidata":"https://www.wikidata.org/wiki/Q16980","display_name":"ARM architecture","level":2,"score":0.47314512729644775},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.434776246547699},{"id":"https://openalex.org/C48103436","wikidata":"https://www.wikidata.org/wiki/Q599031","display_name":"State (computer science)","level":2,"score":0.42398643493652344},{"id":"https://openalex.org/C2776760102","wikidata":"https://www.wikidata.org/wiki/Q5139990","display_name":"Code (set theory)","level":3,"score":0.4153573215007782},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.40130144357681274},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.11523240804672241},{"id":"https://openalex.org/C177264268","wikidata":"https://www.wikidata.org/wiki/Q1514741","display_name":"Set (abstract data type)","level":2,"score":0.09448283910751343},{"id":"https://openalex.org/C151730666","wikidata":"https://www.wikidata.org/wiki/Q7205","display_name":"Paleontology","level":1,"score":0.0},{"id":"https://openalex.org/C86803240","wikidata":"https://www.wikidata.org/wiki/Q420","display_name":"Biology","level":0,"score":0.0}],"mesh":[],"locations_count":4,"locations":[{"id":"doi:10.1145/3134600.3134622","doi":"https://doi.org/10.1145/3134600.3134622","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3134600.3134622","pdf_url":null,"source":{"id":"https://openalex.org/S4306417673","display_name":"Annual Computer Security Applications Conference","issn_l":"1063-9527","issn":["1063-9527","2576-9103"],"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 33rd Annual Computer Security Applications Conference","raw_type":"proceedings-article"},{"id":"pmh:oai:arXiv.org:1803.02700","doi":null,"is_oa":true,"landing_page_url":"http://arxiv.org/abs/1803.02700","pdf_url":"https://arxiv.org/pdf/1803.02700","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":null,"raw_type":"text"},{"id":"pmh:oai:HAL:hal-01634566v1","doi":null,"is_oa":true,"landing_page_url":"https://inria.hal.science/hal-01634566","pdf_url":null,"source":{"id":"https://openalex.org/S4306402512","display_name":"HAL (Le Centre pour la Communication Scientifique Directe)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I1294671590","host_organization_name":"Centre National de la Recherche Scientifique","host_organization_lineage":["https://openalex.org/I1294671590"],"host_organization_lineage_names":[],"type":"repository"},"license":"other-oa","license_id":"https://openalex.org/licenses/other-oa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"https://www.acsac.org/","raw_type":"info:eu-repo/semantics/conferenceObject"},{"id":"doi:10.48550/arxiv.1803.02700","doi":"https://doi.org/10.48550/arxiv.1803.02700","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.1803.02700","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"article-journal"}],"best_oa_location":{"id":"pmh:oai:arXiv.org:1803.02700","doi":null,"is_oa":true,"landing_page_url":"http://arxiv.org/abs/1803.02700","pdf_url":"https://arxiv.org/pdf/1803.02700","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":null,"raw_type":"text"},"sustainable_development_goals":[],"sustainable_development_goals_aurora":[{"display_name":"Peace, justice, and strong institutions","id":"https://metadata.un.org/sdg/16","score":0.7799999713897705}],"study_designs":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":41,"referenced_works":["https://openalex.org/W94181602","https://openalex.org/W161166442","https://openalex.org/W1429241971","https://openalex.org/W1522250664","https://openalex.org/W1598700299","https://openalex.org/W1631846088","https://openalex.org/W1816718056","https://openalex.org/W1823377586","https://openalex.org/W1877037860","https://openalex.org/W1969501726","https://openalex.org/W1992891694","https://openalex.org/W1993736952","https://openalex.org/W1996931407","https://openalex.org/W2004456327","https://openalex.org/W2013892605","https://openalex.org/W2019776007","https://openalex.org/W2030660170","https://openalex.org/W2048229966","https://openalex.org/W2054840305","https://openalex.org/W2072102701","https://openalex.org/W2088272026","https://openalex.org/W2089448621","https://openalex.org/W2101889913","https://openalex.org/W2109219878","https://openalex.org/W2129355354","https://openalex.org/W2133592286","https://openalex.org/W2140697712","https://openalex.org/W2144642151","https://openalex.org/W2147657366","https://openalex.org/W2151849720","https://openalex.org/W2153185479","https://openalex.org/W2156182786","https://openalex.org/W2165779143","https://openalex.org/W2171929398","https://openalex.org/W2258876169","https://openalex.org/W2294454994","https://openalex.org/W2405102949","https://openalex.org/W2560221416","https://openalex.org/W2626912599","https://openalex.org/W3023860284","https://openalex.org/W6739611706"],"related_works":["https://openalex.org/W2369102298","https://openalex.org/W2021362805","https://openalex.org/W3175617817","https://openalex.org/W2090939166","https://openalex.org/W2544369712","https://openalex.org/W2121788702","https://openalex.org/W2278496197","https://openalex.org/W2356741398","https://openalex.org/W2008450998","https://openalex.org/W2357231070"],"abstract_inverted_index":{"Highly":[0],"privileged":[1,114],"software,":[2],"such":[3,26,40],"as":[4],"firmware,":[5],"is":[6],"an":[7,31,44,52,168,173],"attractive":[8],"target":[9],"for":[10],"attackers.":[11],"Thus,":[12],"BIOS":[13],"vendors":[14],"use":[15],"cryptographic":[16],"signatures":[17],"to":[18,64,70,76,103,157],"ensure":[19],"firmware":[20,119,145],"integrity":[21],"at":[22,36,121],"boot":[23],"time.":[24],"Nevertheless,":[25],"protection":[27],"does":[28,84],"not":[29,85],"prevent":[30],"attacker":[32],"from":[33,186],"exploiting":[34],"vulnerabilities":[35],"runtime.":[37,122],"To":[38],"detect":[39,104,158],"attacks,":[41],"we":[42],"propose":[43],"event-based":[45],"behavior":[46,69,93,126],"monitoring":[47],"approach":[48,83,102,156],"that":[49,181],"relies":[50],"on":[51,60,87,95],"isolated":[53],"co-processor.":[54,177],"We":[55,99,123,141,150],"instrument":[56,142],"the":[57,61,71,78,92,107,125,152,187,190,205,208,213],"code":[58,120],"executed":[59],"main":[62],"CPU":[63,136],"send":[65],"information":[66,74],"about":[67],"its":[68,132,162],"monitor.":[72],"This":[73],"helps":[75],"resolve":[77],"semantic":[79],"gap":[80],"issue.":[81],"Our":[82],"depend":[86],"a":[88,96,112],"specific":[89,97],"model":[90,124],"of":[91,127,131,154,189,201,207],"nor":[94],"target.":[98],"apply":[100],"this":[101],"attacks":[105,160],"targeting":[106],"System":[108],"Management":[109],"Mode":[110],"(SMM),":[111],"highly":[113],"x86":[115,169],"execution":[116,164],"mode":[117],"executing":[118],"SMM":[128,209],"using":[129],"invariants":[130],"control-flow":[133],"and":[134,139,148,161],"relevant":[135],"registers":[137],"(CR3":[138],"SMBASE).":[140],"two":[143],"open-source":[144],"implementations:":[146],"EDKII":[147],"coreboot.":[149],"evaluate":[151],"ability":[153],"our":[155,182],"state-of-the-art":[159],"runtime":[163],"overhead":[165,203],"by":[166,218],"simulating":[167],"system":[170],"coupled":[171],"with":[172],"ARM":[174],"Cortex":[175],"A5":[176],"The":[178],"results":[179],"show":[180],"solution":[183],"detects":[184],"intrusions":[185],"state":[188],"art,":[191],"without":[192],"any":[193],"false":[194],"positives,":[195],"while":[196],"remaining":[197],"acceptable":[198],"in":[199,204],"terms":[200],"performance":[202],"context":[206],"(i.e.,":[210],"less":[211],"than":[212],"150":[214],"us":[215],"threshold":[216],"defined":[217],"Intel).":[219]},"counts_by_year":[{"year":2024,"cited_by_count":1},{"year":2023,"cited_by_count":1},{"year":2022,"cited_by_count":1},{"year":2021,"cited_by_count":2},{"year":2020,"cited_by_count":3},{"year":2019,"cited_by_count":3},{"year":2018,"cited_by_count":1}],"updated_date":"2026-10-06T10:28:23.643775","created_date":"2017-12-22T00:00:00"}