{"id":"https://openalex.org/W2908015413","doi":"https://doi.org/10.1145/3274694.3274712","title":"Now You See Me","display_name":"Now You See Me","publication_year":2018,"publication_date":"2018-12-03","ids":{"openalex":"https://openalex.org/W2908015413","doi":"https://doi.org/10.1145/3274694.3274712","mag":"2908015413"},"language":"en","primary_location":{"id":"doi:10.1145/3274694.3274712","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3274694.3274712","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3274694.3274712?download=true","source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 34th Annual Computer Security Applications Conference","raw_type":"proceedings-article"},"type":"preprint","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://dl.acm.org/doi/pdf/10.1145/3274694.3274712?download=true","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5081683842","display_name":"Franck de Go\u00ebr","orcid":null},"institutions":[{"id":"https://openalex.org/I865915315","display_name":"Vrije Universiteit Amsterdam","ror":"https://ror.org/008xxew50","country_code":"NL","type":"education","lineage":["https://openalex.org/I865915315"]}],"countries":["NL"],"is_corresponding":false,"raw_author_name":"Franck de Go\u00ebr","raw_affiliation_strings":["UGA, VU Amsterdam, ANSSI"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"UGA, VU Amsterdam, ANSSI","institution_ids":["https://openalex.org/I865915315"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5033142771","display_name":"Sanjay Rawat","orcid":"https://orcid.org/0000-0003-0875-7924"},"institutions":[{"id":"https://openalex.org/I865915315","display_name":"Vrije Universiteit Amsterdam","ror":"https://ror.org/008xxew50","country_code":"NL","type":"education","lineage":["https://openalex.org/I865915315"]}],"countries":["NL"],"is_corresponding":false,"raw_author_name":"Sanjay Rawat","raw_affiliation_strings":["Vrije Universiteit Amsterdam"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Vrije Universiteit Amsterdam","institution_ids":["https://openalex.org/I865915315"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5009305206","display_name":"Dennis Andriesse","orcid":null},"institutions":[{"id":"https://openalex.org/I865915315","display_name":"Vrije Universiteit Amsterdam","ror":"https://ror.org/008xxew50","country_code":"NL","type":"education","lineage":["https://openalex.org/I865915315"]}],"countries":["NL"],"is_corresponding":false,"raw_author_name":"Dennis Andriesse","raw_affiliation_strings":["Vrije Universiteit Amsterdam"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Vrije Universiteit Amsterdam","institution_ids":["https://openalex.org/I865915315"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5029566823","display_name":"Herbert Bos","orcid":"https://orcid.org/0000-0001-6179-1510"},"institutions":[{"id":"https://openalex.org/I865915315","display_name":"Vrije Universiteit Amsterdam","ror":"https://ror.org/008xxew50","country_code":"NL","type":"education","lineage":["https://openalex.org/I865915315"]}],"countries":["NL"],"is_corresponding":false,"raw_author_name":"Herbert Bos","raw_affiliation_strings":["Vrije Universiteit Amsterdam"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Vrije Universiteit Amsterdam","institution_ids":["https://openalex.org/I865915315"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5059673708","display_name":"Roland Groz","orcid":"https://orcid.org/0000-0003-3730-8300"},"institutions":[{"id":"https://openalex.org/I4210104430","display_name":"Laboratoire d'Informatique de Grenoble","ror":"https://ror.org/01c8rcg82","country_code":"FR","type":"facility","lineage":["https://openalex.org/I106785703","https://openalex.org/I1294671590","https://openalex.org/I1294671590","https://openalex.org/I1326498283","https://openalex.org/I4210104430","https://openalex.org/I4210159245","https://openalex.org/I899635006","https://openalex.org/I899635006"]},{"id":"https://openalex.org/I899635006","display_name":"Universit\u00e9 Grenoble Alpes","ror":"https://ror.org/02rx3b187","country_code":"FR","type":"education","lineage":["https://openalex.org/I899635006"]}],"countries":["FR"],"is_corresponding":false,"raw_author_name":"Roland Groz","raw_affiliation_strings":["LIG, Univ. Grenoble Alpes"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"LIG, Univ. Grenoble Alpes","institution_ids":["https://openalex.org/I4210104430","https://openalex.org/I899635006"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":5,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.9976,"has_fulltext":true,"cited_by_count":8,"citation_normalized_percentile":{"value":0.77989963,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":90,"max":98},"biblio":{"volume":null,"issue":null,"first_page":"618","last_page":"628"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9997000098228455,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9997000098228455,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.9997000098228455,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10743","display_name":"Software Testing and Debugging Techniques","score":0.9983999729156494,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.880581259727478},{"id":"https://openalex.org/keywords/debugging","display_name":"Debugging","score":0.6989071369171143},{"id":"https://openalex.org/keywords/oracle","display_name":"Oracle","score":0.6980869174003601},{"id":"https://openalex.org/keywords/call-graph","display_name":"Call graph","score":0.695350170135498},{"id":"https://openalex.org/keywords/static-analysis","display_name":"Static analysis","score":0.5717364549636841},{"id":"https://openalex.org/keywords/function","display_name":"Function (biology)","score":0.5382430553436279},{"id":"https://openalex.org/keywords/heuristic","display_name":"Heuristic","score":0.5356423854827881},{"id":"https://openalex.org/keywords/compiler","display_name":"Compiler","score":0.4613746404647827},{"id":"https://openalex.org/keywords/programming-language","display_name":"Programming language","score":0.4535856544971466},{"id":"https://openalex.org/keywords/source-code","display_name":"Source code","score":0.4496406614780426},{"id":"https://openalex.org/keywords/code","display_name":"Code (set theory)","score":0.44777461886405945},{"id":"https://openalex.org/keywords/system-call","display_name":"System call","score":0.44138893485069275},{"id":"https://openalex.org/keywords/symbolic-execution","display_name":"Symbolic execution","score":0.4388720989227295},{"id":"https://openalex.org/keywords/control-flow","display_name":"Control flow","score":0.43342331051826477},{"id":"https://openalex.org/keywords/subroutine","display_name":"Subroutine","score":0.4298783242702484},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.1496812105178833},{"id":"https://openalex.org/keywords/software","display_name":"Software","score":0.1272221803665161}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.880581259727478},{"id":"https://openalex.org/C168065819","wikidata":"https://www.wikidata.org/wiki/Q845566","display_name":"Debugging","level":2,"score":0.6989071369171143},{"id":"https://openalex.org/C55166926","wikidata":"https://www.wikidata.org/wiki/Q2892946","display_name":"Oracle","level":2,"score":0.6980869174003601},{"id":"https://openalex.org/C102379954","wikidata":"https://www.wikidata.org/wiki/Q2589940","display_name":"Call graph","level":2,"score":0.695350170135498},{"id":"https://openalex.org/C97686452","wikidata":"https://www.wikidata.org/wiki/Q7604153","display_name":"Static analysis","level":2,"score":0.5717364549636841},{"id":"https://openalex.org/C14036430","wikidata":"https://www.wikidata.org/wiki/Q3736076","display_name":"Function (biology)","level":2,"score":0.5382430553436279},{"id":"https://openalex.org/C173801870","wikidata":"https://www.wikidata.org/wiki/Q201413","display_name":"Heuristic","level":2,"score":0.5356423854827881},{"id":"https://openalex.org/C169590947","wikidata":"https://www.wikidata.org/wiki/Q47506","display_name":"Compiler","level":2,"score":0.4613746404647827},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.4535856544971466},{"id":"https://openalex.org/C43126263","wikidata":"https://www.wikidata.org/wiki/Q128751","display_name":"Source code","level":2,"score":0.4496406614780426},{"id":"https://openalex.org/C2776760102","wikidata":"https://www.wikidata.org/wiki/Q5139990","display_name":"Code (set theory)","level":3,"score":0.44777461886405945},{"id":"https://openalex.org/C2778579508","wikidata":"https://www.wikidata.org/wiki/Q722192","display_name":"System call","level":2,"score":0.44138893485069275},{"id":"https://openalex.org/C2779639559","wikidata":"https://www.wikidata.org/wiki/Q7661178","display_name":"Symbolic execution","level":3,"score":0.4388720989227295},{"id":"https://openalex.org/C160191386","wikidata":"https://www.wikidata.org/wiki/Q868299","display_name":"Control flow","level":2,"score":0.43342331051826477},{"id":"https://openalex.org/C96147967","wikidata":"https://www.wikidata.org/wiki/Q190686","display_name":"Subroutine","level":2,"score":0.4298783242702484},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.1496812105178833},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.1272221803665161},{"id":"https://openalex.org/C78458016","wikidata":"https://www.wikidata.org/wiki/Q840400","display_name":"Evolutionary biology","level":1,"score":0.0},{"id":"https://openalex.org/C86803240","wikidata":"https://www.wikidata.org/wiki/Q420","display_name":"Biology","level":0,"score":0.0},{"id":"https://openalex.org/C177264268","wikidata":"https://www.wikidata.org/wiki/Q1514741","display_name":"Set (abstract data type)","level":2,"score":0.0}],"mesh":[],"locations_count":5,"locations":[{"id":"doi:10.1145/3274694.3274712","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3274694.3274712","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3274694.3274712?download=true","source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 34th Annual Computer Security Applications Conference","raw_type":"proceedings-article"},{"id":"pmh:oai:research.vu.nl:publications/4ab38c01-f319-4b1c-8a2b-a3320b03067e","is_oa":true,"landing_page_url":"https://hdl.handle.net/1871.1/4ab38c01-f319-4b1c-8a2b-a3320b03067e","pdf_url":"https://research.vu.nl/en/publications/4ab38c01-f319-4b1c-8a2b-a3320b03067e","source":{"id":"https://openalex.org/S4306400546","display_name":"Digital Academic REpository of VU University Amsterdam (Vrije Universiteit Amsterdam)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I865915315","host_organization_name":"Vrije Universiteit Amsterdam","host_organization_lineage":["https://openalex.org/I865915315"],"host_organization_lineage_names":[],"type":"repository"},"license":"other-oa","license_id":"https://openalex.org/licenses/other-oa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"De Go\u00ebr, F, Rawat, S, Andriesse, D, Bos, H & Groz, R 2018, Now you see me : Real-time dynamic function call detection. in ACSAC '18 : Proceedings of the 34th Annual Computer Security Applications Conference . Association for Computing Machinery, pp. 618-628, 34th Annual Computer Security Applications Conference, ACSAC 2018, San Juan, United States, 3/12/18. https://doi.org/10.1145/3274694.3274712","raw_type":"contributionToPeriodical"},{"id":"pmh:oai:HAL:hal-02012990v1","is_oa":false,"landing_page_url":"https://hal.science/hal-02012990","pdf_url":null,"source":{"id":"https://openalex.org/S4306402512","display_name":"HAL (Le Centre pour la Communication Scientifique Directe)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I1294671590","host_organization_name":"Centre National de la Recherche Scientifique","host_organization_lineage":["https://openalex.org/I1294671590"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"ACSAC 2018: Annual Computer Security Applications Conference, Dec 2018, San Juan, Puerto Rico","raw_type":"Conference papers"},{"id":"pmh:oai:research-information.bris.ac.uk:openaire_cris_publications/3e44646c-f22c-4374-83bf-6a58ee0b570c","is_oa":false,"landing_page_url":"https://research-information.bris.ac.uk/en/publications/3e44646c-f22c-4374-83bf-6a58ee0b570c","pdf_url":null,"source":{"id":"https://openalex.org/S4306400895","display_name":"Bristol Research (University of Bristol)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I36234482","host_organization_name":"University of Bristol","host_organization_lineage":["https://openalex.org/I36234482"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"de Herve, F D G, Rawat, S, Andriesse, D, Bos, H & Groz, R 2018, Now You See Me: Real-time Dynamic Function Call Detection. in ACSAC 2018: Annual Computer Security Applications Conference. pp. 618-628. https://doi.org/10.1145/3274694.3274712","raw_type":"contributionToPeriodical"},{"id":"pmh:vu:oai:research.vu.nl:publications/4ab38c01-f319-4b1c-8a2b-a3320b03067e","is_oa":true,"landing_page_url":"https://research.vu.nl/en/publications/4ab38c01-f319-4b1c-8a2b-a3320b03067e","pdf_url":null,"source":{"id":"https://openalex.org/S4306401843","display_name":"Data Archiving and Networked Services (DANS)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I1322597698","host_organization_name":"Royal Netherlands Academy of Arts and Sciences","host_organization_lineage":["https://openalex.org/I1322597698"],"host_organization_lineage_names":[],"type":"repository"},"license":"other-oa","license_id":"https://openalex.org/licenses/other-oa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"ACSAC '18 Proceedings of the 34th Annual Computer Security Applications Conference, 618 - 628","raw_type":"info:eu-repo/semantics/conferencepaper"}],"best_oa_location":{"id":"doi:10.1145/3274694.3274712","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3274694.3274712","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3274694.3274712?download=true","source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 34th Annual Computer Security Applications Conference","raw_type":"proceedings-article"},"sustainable_development_goals":[{"score":0.6000000238418579,"id":"https://metadata.un.org/sdg/16","display_name":"Peace, Justice and strong institutions"}],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W2908015413.pdf"},"referenced_works_count":20,"referenced_works":["https://openalex.org/W101581383","https://openalex.org/W1484956826","https://openalex.org/W1507845365","https://openalex.org/W1823377586","https://openalex.org/W1942295288","https://openalex.org/W1993682390","https://openalex.org/W1997429190","https://openalex.org/W2033029512","https://openalex.org/W2059969702","https://openalex.org/W2134633067","https://openalex.org/W2160468841","https://openalex.org/W2213021386","https://openalex.org/W2293673734","https://openalex.org/W2400347054","https://openalex.org/W2496999134","https://openalex.org/W2516933175","https://openalex.org/W2598603502","https://openalex.org/W2625806818","https://openalex.org/W4239813889","https://openalex.org/W4285719527"],"related_works":["https://openalex.org/W2108229043","https://openalex.org/W2756723748","https://openalex.org/W2380745217","https://openalex.org/W2274607126","https://openalex.org/W4378364622","https://openalex.org/W2091491463","https://openalex.org/W2919495556","https://openalex.org/W2167432494","https://openalex.org/W2138385884","https://openalex.org/W2085562432"],"abstract_inverted_index":{"Efficient":[0],"detection":[1,94],"and":[2,22,55,106,113],"instrumentation":[3],"of":[4,12,29,71,90,139,146],"function":[5,48,63,92],"calls":[6,31,50],"is":[7,37,65],"fundamental":[8],"for":[9,40,160],"a":[10,61,80,99],"variety":[11],"dynamic":[13,17,91],"analysis":[14],"techniques,":[15],"including":[16,110],"callgraph":[18],"construction,":[19],"control-flow":[20],"integrity,":[21],"automatic":[23],"vulnerability":[24],"discovery.":[25],"A":[26],"common":[27],"way":[28],"detecting":[30],"at":[32,116],"the":[33,69,88,142,156],"machine":[34],"code":[35],"level":[36],"to":[38,104],"look":[39],"CALL":[41],"instructions.":[42],"However,":[43],"optimizing":[44],"compilers":[45],"frequently":[46],"implement":[47],"tail":[49],"with":[51],"JMP":[52],"instructions":[53],"instead,":[54],"distinguishing":[56],"an":[57,137],"intra-procedural":[58],"jump":[59],"from":[60],"JMP-based":[62,114],"call":[64,93],"not":[66,78,120],"straightforward.":[67],"Despite":[68],"importance":[70],"making":[72],"this":[73,84],"distinction,":[74],"prior":[75],"research":[76],"has":[77],"produced":[79],"reliable":[81],"solution.":[82],"In":[83],"paper,":[85],"we":[86,158],"address":[87],"problem":[89],"in":[95,141],"real-time.":[96],"We":[97,132,149],"propose":[98],"heuristic-based":[100],"approach":[101],"named":[102],"iCi":[103,118,135],"efficiently":[105],"automatically":[107],"instrument":[108],"calls,":[109,115],"conventional":[111],"CALLs":[112],"runtime.":[117],"does":[119],"rely":[121],"on":[122],"source":[123],"code,":[124],"debug":[125],"information,":[126],"symbol":[127],"tables":[128],"or":[129],"static":[130],"analysis.":[131],"show":[133],"that":[134],"achieves":[136],"f-score":[138],"0.95":[140],"worst":[143],"case,":[144],"regardless":[145],"optimization":[147],"level.":[148],"open-source":[150],"our":[151,161],"implementation":[152],"as":[153,155],"well":[154],"oracle":[157],"used":[159],"evaluation.1":[162]},"counts_by_year":[{"year":2026,"cited_by_count":1},{"year":2023,"cited_by_count":1},{"year":2021,"cited_by_count":3},{"year":2020,"cited_by_count":3}],"updated_date":"2026-06-11T09:08:48.828518","created_date":"2019-01-11T00:00:00"}