{"id":"https://openalex.org/W2891539454","doi":"https://doi.org/10.1145/3243734.3243827","title":"VMHunt","display_name":"VMHunt","publication_year":2018,"publication_date":"2018-10-15","ids":{"openalex":"https://openalex.org/W2891539454","doi":"https://doi.org/10.1145/3243734.3243827","mag":"2891539454"},"language":"en","primary_location":{"id":"doi:10.1145/3243734.3243827","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3243734.3243827","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3243734.3243827","source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://dl.acm.org/doi/pdf/10.1145/3243734.3243827","any_repository_has_fulltext":null},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5087023767","display_name":"Dongpeng Xu","orcid":"https://orcid.org/0000-0001-6596-9101"},"institutions":[{"id":"https://openalex.org/I130769515","display_name":"Pennsylvania State University","ror":"https://ror.org/04p491231","country_code":"US","type":"education","lineage":["https://openalex.org/I130769515"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Dongpeng Xu","raw_affiliation_strings":["Pennsylvania State University, University Park, PA, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Pennsylvania State University, University Park, PA, USA","institution_ids":["https://openalex.org/I130769515"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101420644","display_name":"Jiang Ming","orcid":"https://orcid.org/0000-0001-9682-0502"},"institutions":[{"id":"https://openalex.org/I189196454","display_name":"The University of Texas at Arlington","ror":"https://ror.org/019kgqr73","country_code":"US","type":"education","lineage":["https://openalex.org/I189196454"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Jiang Ming","raw_affiliation_strings":["University of Texas at Arlington, Arlington, TX, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Texas at Arlington, Arlington, TX, USA","institution_ids":["https://openalex.org/I189196454"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5025582376","display_name":"Yu Fu","orcid":"https://orcid.org/0000-0002-8022-9002"},"institutions":[{"id":"https://openalex.org/I130769515","display_name":"Pennsylvania State University","ror":"https://ror.org/04p491231","country_code":"US","type":"education","lineage":["https://openalex.org/I130769515"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Yu Fu","raw_affiliation_strings":["Pennsylvania State University, University Park, PA, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Pennsylvania State University, University Park, PA, USA","institution_ids":["https://openalex.org/I130769515"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5008435786","display_name":"Dinghao Wu","orcid":"https://orcid.org/0000-0002-0741-5511"},"institutions":[{"id":"https://openalex.org/I130769515","display_name":"Pennsylvania State University","ror":"https://ror.org/04p491231","country_code":"US","type":"education","lineage":["https://openalex.org/I130769515"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Dinghao Wu","raw_affiliation_strings":["Pennsylvania State University, University Park, PA, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Pennsylvania State University, University Park, PA, USA","institution_ids":["https://openalex.org/I130769515"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":true,"cited_by_count":49,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"442","last_page":"458"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.9995999932289124,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11005","display_name":"Radiation Effects in Electronics","score":0.995199978351593,"subfield":{"id":"https://openalex.org/subfields/2208","display_name":"Electrical and Electronic Engineering"},"field":{"id":"https://openalex.org/fields/22","display_name":"Engineering"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8680267333984375},{"id":"https://openalex.org/keywords/virtualization","display_name":"Virtualization","score":0.6269353032112122},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.5482720136642456},{"id":"https://openalex.org/keywords/hardware-virtualization","display_name":"Hardware virtualization","score":0.5469260215759277},{"id":"https://openalex.org/keywords/symbolic-execution","display_name":"Symbolic execution","score":0.5386229753494263},{"id":"https://openalex.org/keywords/executable","display_name":"Executable","score":0.4910123646259308},{"id":"https://openalex.org/keywords/virtual-machine","display_name":"Virtual machine","score":0.43149691820144653},{"id":"https://openalex.org/keywords/correctness","display_name":"Correctness","score":0.42811059951782227},{"id":"https://openalex.org/keywords/hypervisor","display_name":"Hypervisor","score":0.4162030816078186},{"id":"https://openalex.org/keywords/programming-language","display_name":"Programming language","score":0.38778790831565857},{"id":"https://openalex.org/keywords/cloud-computing","display_name":"Cloud computing","score":0.24438712000846863},{"id":"https://openalex.org/keywords/software","display_name":"Software","score":0.18070104718208313}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8680267333984375},{"id":"https://openalex.org/C513985346","wikidata":"https://www.wikidata.org/wiki/Q270471","display_name":"Virtualization","level":3,"score":0.6269353032112122},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.5482720136642456},{"id":"https://openalex.org/C68793194","wikidata":"https://www.wikidata.org/wiki/Q1616095","display_name":"Hardware virtualization","level":5,"score":0.5469260215759277},{"id":"https://openalex.org/C2779639559","wikidata":"https://www.wikidata.org/wiki/Q7661178","display_name":"Symbolic execution","level":3,"score":0.5386229753494263},{"id":"https://openalex.org/C160145156","wikidata":"https://www.wikidata.org/wiki/Q778586","display_name":"Executable","level":2,"score":0.4910123646259308},{"id":"https://openalex.org/C25344961","wikidata":"https://www.wikidata.org/wiki/Q192726","display_name":"Virtual machine","level":2,"score":0.43149691820144653},{"id":"https://openalex.org/C55439883","wikidata":"https://www.wikidata.org/wiki/Q360812","display_name":"Correctness","level":2,"score":0.42811059951782227},{"id":"https://openalex.org/C112904061","wikidata":"https://www.wikidata.org/wiki/Q1077480","display_name":"Hypervisor","level":4,"score":0.4162030816078186},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.38778790831565857},{"id":"https://openalex.org/C79974875","wikidata":"https://www.wikidata.org/wiki/Q483639","display_name":"Cloud computing","level":2,"score":0.24438712000846863},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.18070104718208313}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3243734.3243827","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3243734.3243827","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3243734.3243827","source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security","raw_type":"proceedings-article"}],"best_oa_location":{"id":"doi:10.1145/3243734.3243827","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3243734.3243827","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3243734.3243827","source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security","raw_type":"proceedings-article"},"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/16","score":0.4099999964237213,"display_name":"Peace, Justice and strong institutions"}],"awards":[{"id":"https://openalex.org/G1935525211","display_name":null,"funder_award_id":"N00014-17-1-2894","funder_id":"https://openalex.org/F4320337345","funder_display_name":"Office of Naval Research"},{"id":"https://openalex.org/G2431306685","display_name":null,"funder_award_id":"N00014-16-1-2265,N00014-16-1-2912,N00014-17-1-2894","funder_id":"https://openalex.org/F4320338298","funder_display_name":"Office of Naval Research Global"},{"id":"https://openalex.org/G4504108201","display_name":null,"funder_award_id":"N00014-17-1","funder_id":"https://openalex.org/F4320337345","funder_display_name":"Office of Naval Research"},{"id":"https://openalex.org/G5445530159","display_name":"CAREER: Advanced Trace-Oriented Binary Code Analysis","funder_award_id":"1652790","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"},{"id":"https://openalex.org/G5863267203","display_name":null,"funder_award_id":"N00014-16-1-2265","funder_id":"https://openalex.org/F4320337345","funder_display_name":"Office of Naval Research"},{"id":"https://openalex.org/G7472533776","display_name":null,"funder_award_id":"CNS-1652790","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"},{"id":"https://openalex.org/G7575587687","display_name":null,"funder_award_id":"N00014-16-1-2912","funder_id":"https://openalex.org/F4320337345","funder_display_name":"Office of Naval Research"},{"id":"https://openalex.org/G8876996369","display_name":null,"funder_award_id":"N00014","funder_id":"https://openalex.org/F4320337345","funder_display_name":"Office of Naval Research"}],"funders":[{"id":"https://openalex.org/F4320306076","display_name":"National Science Foundation","ror":"https://ror.org/021nxhr62"},{"id":"https://openalex.org/F4320309536","display_name":"University of Texas System","ror":"https://ror.org/01gek1696"},{"id":"https://openalex.org/F4320337345","display_name":"Office of Naval Research","ror":"https://ror.org/00rk2pe57"},{"id":"https://openalex.org/F4320338298","display_name":"Office of Naval Research Global","ror":"https://ror.org/00rk2pe57"}],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W2891539454.pdf","grobid_xml":"https://content.openalex.org/works/W2891539454.grobid-xml"},"referenced_works_count":63,"referenced_works":["https://openalex.org/W10639112","https://openalex.org/W17195072","https://openalex.org/W62185554","https://openalex.org/W116627068","https://openalex.org/W119062149","https://openalex.org/W157156687","https://openalex.org/W174339829","https://openalex.org/W1496222301","https://openalex.org/W1514023947","https://openalex.org/W1514687127","https://openalex.org/W1538186256","https://openalex.org/W1892063863","https://openalex.org/W1975157166","https://openalex.org/W1975857176","https://openalex.org/W1981033991","https://openalex.org/W1997847700","https://openalex.org/W2000507036","https://openalex.org/W2002325351","https://openalex.org/W2008453980","https://openalex.org/W2010142027","https://openalex.org/W2010417554","https://openalex.org/W2025025782","https://openalex.org/W2049629426","https://openalex.org/W2100002952","https://openalex.org/W2104495462","https://openalex.org/W2115428539","https://openalex.org/W2117030266","https://openalex.org/W2119251836","https://openalex.org/W2126851641","https://openalex.org/W2128389850","https://openalex.org/W2129487583","https://openalex.org/W2131266495","https://openalex.org/W2134633067","https://openalex.org/W2137530017","https://openalex.org/W2139749211","https://openalex.org/W2142980910","https://openalex.org/W2150042079","https://openalex.org/W2165597437","https://openalex.org/W2167505354","https://openalex.org/W2170793790","https://openalex.org/W2171035369","https://openalex.org/W2176830056","https://openalex.org/W2339802588","https://openalex.org/W2408027109","https://openalex.org/W2461805967","https://openalex.org/W2514974017","https://openalex.org/W2536319814","https://openalex.org/W2560252021","https://openalex.org/W2560284310","https://openalex.org/W2586453064","https://openalex.org/W2614925308","https://openalex.org/W2620946705","https://openalex.org/W2642053679","https://openalex.org/W2670925489","https://openalex.org/W2708742135","https://openalex.org/W2742249911","https://openalex.org/W2751013686","https://openalex.org/W2752559890","https://openalex.org/W2752859356","https://openalex.org/W2766950896","https://openalex.org/W2797618589","https://openalex.org/W3038021728","https://openalex.org/W4239813889"],"related_works":["https://openalex.org/W3083135738","https://openalex.org/W2005435933","https://openalex.org/W2413559826","https://openalex.org/W2179519055","https://openalex.org/W2747005099","https://openalex.org/W2145292010","https://openalex.org/W2549930939","https://openalex.org/W1973516247","https://openalex.org/W1775827617","https://openalex.org/W1991063492"],"abstract_inverted_index":{"Code":[0],"virtualization":[1,23,41,151],"is":[2,42,51,93,148,152,283],"a":[3,26,133,153,198,221,229,284],"highly":[4],"sophisticated":[5],"obfuscation":[6,217],"technique":[7],"adopted":[8],"by":[9],"malware":[10],"authors":[11],"to":[12,33,55,74,136,174,238],"stay":[13],"under":[14],"the":[15,18,57,77,88,101,111,124,138,161,169,176,181,188,195,206,215,241,250,288,291],"radar.":[16],"However,":[17],"increasing":[19],"complexity":[20],"of":[21,60,90,104,113,128,140,155,183,209,253,290],"code":[22,40,61,92,105,129,143,150],"also":[24],"becomes":[25],"\"double-edged":[27],"sword\"":[28],"for":[29],"practical":[30],"application.":[31],"Due":[32],"its":[34],"performance":[35],"limitations":[36],"and":[37,66,97,126,160,167,268,274],"compatibility":[38],"problems,":[39],"seldom":[43],"used":[44,53,173],"on":[45,100,123,180],"an":[46,263],"entire":[47],"program.":[48],"Rather,":[49],"it":[50,270],"mainly":[52,98],"only":[54],"safeguard":[56],"key":[58,146],"parts":[59],"such":[62],"as":[63,262],"security":[64],"checks":[65],"encryption":[67],"keys.":[68],"Many":[69],"techniques":[70],"have":[71,258],"been":[72],"proposed":[73],"reverse":[75],"engineer":[76],"virtualized":[78,91,189,200],"code,":[79],"but":[80],"they":[81],"share":[82],"some":[83],"common":[84],"limitations.":[85],"They":[86],"assume":[87],"scope":[89,127,182],"known":[94],"in":[95,197],"advance":[96],"focus":[99],"classic":[102],"structure":[103],"emulator.":[106],"Also,":[107],"few":[108],"work":[109],"verifies":[110],"correctness":[112,251],"their":[114],"deobfuscation":[115],"results.":[116,256],"In":[117],"this":[118],"paper,":[119],"with":[120,271],"fewer":[121],"assumptions":[122],"type":[125],"virtualization,":[130],"we":[131,186,226],"present":[132],"verifiable":[134],"method":[135],"address":[137],"challenge":[139],"partially-virtualized":[141],"binary":[142],"simplification.":[144],"Our":[145],"insight":[147],"that":[149,202,210,219,281],"kind":[154],"process-level":[156],"virtual":[157],"machine":[158],"(VM),":[159],"context":[162],"switch":[163],"patterns":[164],"when":[165],"entering":[166],"exiting":[168],"VM":[170,177,184],"can":[171],"be":[172],"detect":[175],"boundaries.":[178],"Based":[179],"boundary,":[185],"simplify":[187,240],"code.":[190],"We":[191,257],"first":[192],"ignore":[193],"all":[194],"instructions":[196],"given":[199],"snippet":[201],"do":[203],"not":[204],"affect":[205],"final":[207],"result":[208],"snippet.":[211,243],"To":[212],"better":[213],"revert":[214],"data":[216],"effect":[218],"encodes":[220],"variable":[222],"through":[223],"bitwise":[224],"operations,":[225],"then":[227],"run":[228],"new":[230],"symbolic":[231,236,247],"execution":[232,237],"called":[233],"multiple":[234],"granularity":[235],"further":[239],"trace":[242],"The":[244,276],"generated":[245],"concise":[246],"formulas":[248],"facilitate":[249],"testing":[252],"our":[254,260],"simplification":[255],"implemented":[259],"idea":[261],"open":[264],"source":[265],"tool,":[266],"VMHunt,":[267],"evaluated":[269],"real-world":[272],"applications":[273],"malware.":[275],"encouraging":[277],"experimental":[278],"results":[279],"demonstrate":[280],"VMHunt":[282],"significant":[285],"improvement":[286],"over":[287],"state":[289],"art.":[292]},"counts_by_year":[{"year":2026,"cited_by_count":2},{"year":2025,"cited_by_count":6},{"year":2024,"cited_by_count":4},{"year":2023,"cited_by_count":6},{"year":2022,"cited_by_count":5},{"year":2021,"cited_by_count":9},{"year":2020,"cited_by_count":10},{"year":2019,"cited_by_count":6},{"year":2018,"cited_by_count":1}],"updated_date":"2026-07-14T23:27:15.235271","created_date":"2018-09-27T00:00:00"}