{"id":"https://openalex.org/W3087990352","doi":"https://doi.org/10.1145/3403943","title":"Hardware Performance Counter-Based Fine-Grained Malware Detection","display_name":"Hardware Performance Counter-Based Fine-Grained Malware Detection","publication_year":2020,"publication_date":"2020-09-26","ids":{"openalex":"https://openalex.org/W3087990352","doi":"https://doi.org/10.1145/3403943","mag":"3087990352"},"language":"en","primary_location":{"id":"doi:10.1145/3403943","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3403943","pdf_url":null,"source":{"id":"https://openalex.org/S136160450","display_name":"ACM Transactions on Embedded Computing Systems","issn_l":"1539-9087","issn":["1539-9087","1558-3465"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"ACM Transactions on Embedded Computing Systems","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5086870564","display_name":"Sai Praveen Kadiyala","orcid":"https://orcid.org/0000-0001-5996-2421"},"institutions":[{"id":"https://openalex.org/I172675005","display_name":"Nanyang Technological University","ror":"https://ror.org/02e7b5302","country_code":"SG","type":"education","lineage":["https://openalex.org/I172675005"]}],"countries":["SG"],"is_corresponding":false,"raw_author_name":"Sai Praveen Kadiyala","raw_affiliation_strings":["Nanyang Technological University, Singapore"],"raw_orcid":"https://orcid.org/0000-0001-5996-2421","affiliations":[{"raw_affiliation_string":"Nanyang Technological University, Singapore","institution_ids":["https://openalex.org/I172675005"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5110950202","display_name":"Pranav Jadhav","orcid":null},"institutions":[{"id":"https://openalex.org/I74796645","display_name":"Birla Institute of Technology and Science, Pilani","ror":"https://ror.org/001p3jz28","country_code":"IN","type":"education","lineage":["https://openalex.org/I74796645"]}],"countries":["IN"],"is_corresponding":false,"raw_author_name":"Pranav Jadhav","raw_affiliation_strings":["BITS Pilani, India"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"BITS Pilani, India","institution_ids":["https://openalex.org/I74796645"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5002694277","display_name":"Siew-Kei Lam","orcid":"https://orcid.org/0000-0002-8346-2635"},"institutions":[{"id":"https://openalex.org/I172675005","display_name":"Nanyang Technological University","ror":"https://ror.org/02e7b5302","country_code":"SG","type":"education","lineage":["https://openalex.org/I172675005"]}],"countries":["SG"],"is_corresponding":false,"raw_author_name":"Siew-Kei Lam","raw_affiliation_strings":["Nanyang Technological University, Singapore"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Nanyang Technological University, Singapore","institution_ids":["https://openalex.org/I172675005"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5070475093","display_name":"Thambipillai Srikanthan","orcid":"https://orcid.org/0000-0003-3664-4345"},"institutions":[{"id":"https://openalex.org/I172675005","display_name":"Nanyang Technological University","ror":"https://ror.org/02e7b5302","country_code":"SG","type":"education","lineage":["https://openalex.org/I172675005"]}],"countries":["SG"],"is_corresponding":false,"raw_author_name":"Thambipillai Srikanthan","raw_affiliation_strings":["Nanyang Technological University, Singapore"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Nanyang Technological University, Singapore","institution_ids":["https://openalex.org/I172675005"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":4,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":2.7373,"has_fulltext":false,"cited_by_count":31,"citation_normalized_percentile":{"value":0.91227498,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":95,"max":99},"biblio":{"volume":"19","issue":"5","first_page":"1","last_page":"17"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.9984999895095825,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12122","display_name":"Physical Unclonable Functions (PUFs) and Hardware Security","score":0.9966999888420105,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.9033180475234985},{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.8674168586730957},{"id":"https://openalex.org/keywords/false-positive-rate","display_name":"False positive rate","score":0.6011882424354553},{"id":"https://openalex.org/keywords/software","display_name":"Software","score":0.517910897731781},{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.5149034261703491},{"id":"https://openalex.org/keywords/feature","display_name":"Feature (linguistics)","score":0.44529277086257935},{"id":"https://openalex.org/keywords/computer-hardware","display_name":"Computer hardware","score":0.4295492470264435},{"id":"https://openalex.org/keywords/embedded-system","display_name":"Embedded system","score":0.4220532774925232},{"id":"https://openalex.org/keywords/machine-learning","display_name":"Machine learning","score":0.39978623390197754},{"id":"https://openalex.org/keywords/computer-engineering","display_name":"Computer engineering","score":0.3649649918079376},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.33067086338996887},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.2985139489173889}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.9033180475234985},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.8674168586730957},{"id":"https://openalex.org/C95922358","wikidata":"https://www.wikidata.org/wiki/Q5432725","display_name":"False positive rate","level":2,"score":0.6011882424354553},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.517910897731781},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.5149034261703491},{"id":"https://openalex.org/C2776401178","wikidata":"https://www.wikidata.org/wiki/Q12050496","display_name":"Feature (linguistics)","level":2,"score":0.44529277086257935},{"id":"https://openalex.org/C9390403","wikidata":"https://www.wikidata.org/wiki/Q3966","display_name":"Computer hardware","level":1,"score":0.4295492470264435},{"id":"https://openalex.org/C149635348","wikidata":"https://www.wikidata.org/wiki/Q193040","display_name":"Embedded system","level":1,"score":0.4220532774925232},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.39978623390197754},{"id":"https://openalex.org/C113775141","wikidata":"https://www.wikidata.org/wiki/Q428691","display_name":"Computer engineering","level":1,"score":0.3649649918079376},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.33067086338996887},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.2985139489173889},{"id":"https://openalex.org/C138885662","wikidata":"https://www.wikidata.org/wiki/Q5891","display_name":"Philosophy","level":0,"score":0.0},{"id":"https://openalex.org/C41895202","wikidata":"https://www.wikidata.org/wiki/Q8162","display_name":"Linguistics","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3403943","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3403943","pdf_url":null,"source":{"id":"https://openalex.org/S136160450","display_name":"ACM Transactions on Embedded Computing Systems","issn_l":"1539-9087","issn":["1539-9087","1558-3465"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"ACM Transactions on Embedded Computing Systems","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":15,"referenced_works":["https://openalex.org/W1647869403","https://openalex.org/W2034053858","https://openalex.org/W2191468669","https://openalex.org/W2199175040","https://openalex.org/W2290702548","https://openalex.org/W2315350509","https://openalex.org/W2522718524","https://openalex.org/W2560157870","https://openalex.org/W2564494760","https://openalex.org/W2612278735","https://openalex.org/W2625408821","https://openalex.org/W2795845996","https://openalex.org/W2800557391","https://openalex.org/W2932551155","https://openalex.org/W3007346474"],"related_works":["https://openalex.org/W2097492617","https://openalex.org/W2753240997","https://openalex.org/W1764168690","https://openalex.org/W2537959205","https://openalex.org/W2740895074","https://openalex.org/W2772446090","https://openalex.org/W3152891574","https://openalex.org/W2388600609","https://openalex.org/W2938728536","https://openalex.org/W2062826214"],"abstract_inverted_index":{"Detection":[0],"of":[1,41,49,57,71,97,101,111,135],"malicious":[2],"programs":[3],"using":[4],"hardware-based":[5,171],"features":[6],"has":[7,146,158],"gained":[8],"prominence":[9],"recently.":[10],"The":[11],"tamper-resistant":[12],"hardware":[13,52],"metrics":[14],"prove":[15],"to":[16,115,131,166],"be":[17,29],"a":[18,55,82,108,126,148,153],"better":[19],"security":[20],"feature":[21],"than":[22],"the":[23,42,47,64,69,90,95,112,117,133,136,160],"high-level":[24],"software":[25],"metrics,":[26],"which":[27,36],"can":[28],"easily":[30],"obfuscated.":[31],"Hardware":[32],"Performance":[33],"Counters":[34],"(HPC),":[35],"are":[37,45],"inbuilt":[38],"in":[39,59,77,170],"most":[40],"recent":[43,168],"processors,":[44],"often":[46],"choice":[48],"researchers":[50],"amongst":[51],"metrics.":[53],"However,":[54],"lack":[56],"determinism":[58],"their":[60],"counts,":[61],"thereby":[62],"affecting":[63],"malware":[65,87],"detection":[66,150,161],"rate,":[67,151],"minimizes":[68],"advantages":[70],"HPCs.":[72],"To":[73],"overcome":[74],"this":[75],"problem,":[76],"our":[78],"work,":[79],"we":[80,93,106,124],"propose":[81],"three-step":[83],"methodology":[84,145],"for":[85],"fine-grained":[86,113],"detection.":[88,173],"In":[89],"first":[91],"step,":[92],"extract":[94],"HPCs":[96],"each":[98],"system":[99],"call":[100],"an":[102],"unknown":[103,137],"program.":[104],"Later,":[105],"make":[107],"dimensionality":[109],"reduction":[110],"data":[114],"identify":[116],"components":[118],"that":[119],"have":[120],"maximum":[121],"variance.":[122],"Finally,":[123],"use":[125],"machine":[127],"learning":[128],"based":[129],"approach":[130],"classify":[132],"nature":[134],"program":[138],"into":[139],"benign":[140],"or":[141],"malicious.":[142],"Our":[143],"proposed":[144],"obtained":[147],"98.4%":[149],"with":[152],"3.1%":[154],"false":[155],"positive.":[156],"It":[157],"improved":[159],"rate":[162],"significantly":[163],"when":[164],"compared":[165],"other":[167],"works":[169],"anomaly":[172]},"counts_by_year":[{"year":2026,"cited_by_count":1},{"year":2025,"cited_by_count":4},{"year":2024,"cited_by_count":8},{"year":2023,"cited_by_count":9},{"year":2022,"cited_by_count":5},{"year":2021,"cited_by_count":4}],"updated_date":"2026-06-11T09:08:48.828518","created_date":"2025-10-10T00:00:00"}