{"id":"https://openalex.org/W3169708636","doi":"https://doi.org/10.1145/3433210.3437531","title":"See through Walls: Detecting Malware in SGX Enclaves with SGX-Bouncer","display_name":"See through Walls: Detecting Malware in SGX Enclaves with SGX-Bouncer","publication_year":2021,"publication_date":"2021-05-24","ids":{"openalex":"https://openalex.org/W3169708636","doi":"https://doi.org/10.1145/3433210.3437531","mag":"3169708636"},"language":"en","primary_location":{"id":"doi:10.1145/3433210.3437531","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3433210.3437531","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2021 ACM Asia Conference on Computer and Communications Security","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5100358748","display_name":"Zeyu Zhang","orcid":"https://orcid.org/0009-0005-1357-0146"},"institutions":[{"id":"https://openalex.org/I99065089","display_name":"Tsinghua University","ror":"https://ror.org/03cve4549","country_code":"CN","type":"education","lineage":["https://openalex.org/I99065089"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Zeyu Zhang","raw_affiliation_strings":["Tsinghua University & George Mason University, Beijing, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Tsinghua University & George Mason University, Beijing, China","institution_ids":["https://openalex.org/I99065089"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5072385772","display_name":"Xiaoli Zhang","orcid":"https://orcid.org/0000-0002-5608-9564"},"institutions":[{"id":"https://openalex.org/I99065089","display_name":"Tsinghua University","ror":"https://ror.org/03cve4549","country_code":"CN","type":"education","lineage":["https://openalex.org/I99065089"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Xiaoli Zhang","raw_affiliation_strings":["Tsinghua University, Beijing, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Tsinghua University, Beijing, China","institution_ids":["https://openalex.org/I99065089"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100350165","display_name":"Qi Li","orcid":"https://orcid.org/0000-0001-8776-8730"},"institutions":[{"id":"https://openalex.org/I99065089","display_name":"Tsinghua University","ror":"https://ror.org/03cve4549","country_code":"CN","type":"education","lineage":["https://openalex.org/I99065089"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Qi Li","raw_affiliation_strings":["Tsinghua University, Beijing, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Tsinghua University, Beijing, China","institution_ids":["https://openalex.org/I99065089"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5026728546","display_name":"Kun Sun","orcid":"https://orcid.org/0000-0003-4152-2107"},"institutions":[{"id":"https://openalex.org/I162714631","display_name":"George Mason University","ror":"https://ror.org/02jqj7156","country_code":"US","type":"education","lineage":["https://openalex.org/I162714631"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Kun Sun","raw_affiliation_strings":["George Mason University, Fairfax, VA, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"George Mason University, Fairfax, VA, USA","institution_ids":["https://openalex.org/I162714631"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5070946957","display_name":"Yinqian Zhang","orcid":"https://orcid.org/0000-0002-7585-1075"},"institutions":[{"id":"https://openalex.org/I52357470","display_name":"The Ohio State University","ror":"https://ror.org/00rs6vg23","country_code":"US","type":"education","lineage":["https://openalex.org/I52357470"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Yinqian Zhang","raw_affiliation_strings":["Ohio State University, Columbus, OH, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Ohio State University, Columbus, OH, USA","institution_ids":["https://openalex.org/I52357470"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5013365392","display_name":"Songsong Liu","orcid":"https://orcid.org/0000-0001-8412-274X"},"institutions":[{"id":"https://openalex.org/I162714631","display_name":"George Mason University","ror":"https://ror.org/02jqj7156","country_code":"US","type":"education","lineage":["https://openalex.org/I162714631"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Songsong Liu","raw_affiliation_strings":["George Mason University, Fairfax, VA, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"George Mason University, Fairfax, VA, USA","institution_ids":["https://openalex.org/I162714631"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100778207","display_name":"Yukun Liu","orcid":"https://orcid.org/0000-0001-7322-9947"},"institutions":[{"id":"https://openalex.org/I45928872","display_name":"Alibaba Group (China)","ror":"https://ror.org/00k642b80","country_code":"CN","type":"company","lineage":["https://openalex.org/I45928872"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yukun Liu","raw_affiliation_strings":["Alibaba Inc., Hangzhou, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Alibaba Inc., Hangzhou, China","institution_ids":["https://openalex.org/I45928872"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5100619626","display_name":"Xiaoning Li","orcid":"https://orcid.org/0000-0001-5991-0955"},"institutions":[{"id":"https://openalex.org/I4210095624","display_name":"Alibaba Group (United States)","ror":"https://ror.org/00rn0m335","country_code":"US","type":"company","lineage":["https://openalex.org/I4210095624","https://openalex.org/I45928872"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Xiaoning Li","raw_affiliation_strings":["Alibaba Inc., Seattle, WA, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Alibaba Inc., Seattle, WA, USA","institution_ids":["https://openalex.org/I4210095624"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":5,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":8,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"931","last_page":"943"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.9998000264167786,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.9998000264167786,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9990000128746033,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9937000274658203,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.7899925708770752},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.7104021310806274},{"id":"https://openalex.org/keywords/guard","display_name":"Guard (computer science)","score":0.7030921578407288},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7016389966011047},{"id":"https://openalex.org/keywords/hypervisor","display_name":"Hypervisor","score":0.5956701040267944},{"id":"https://openalex.org/keywords/software","display_name":"Software","score":0.5453245043754578},{"id":"https://openalex.org/keywords/security-guard","display_name":"Security guard","score":0.4832537770271301},{"id":"https://openalex.org/keywords/confidentiality","display_name":"Confidentiality","score":0.4486996829509735},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.291831374168396},{"id":"https://openalex.org/keywords/virtualization","display_name":"Virtualization","score":0.16774699091911316},{"id":"https://openalex.org/keywords/cloud-computing","display_name":"Cloud computing","score":0.08504661917686462}],"concepts":[{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.7899925708770752},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.7104021310806274},{"id":"https://openalex.org/C141141315","wikidata":"https://www.wikidata.org/wiki/Q2379942","display_name":"Guard (computer science)","level":2,"score":0.7030921578407288},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7016389966011047},{"id":"https://openalex.org/C112904061","wikidata":"https://www.wikidata.org/wiki/Q1077480","display_name":"Hypervisor","level":4,"score":0.5956701040267944},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.5453245043754578},{"id":"https://openalex.org/C2992838255","wikidata":"https://www.wikidata.org/wiki/Q856887","display_name":"Security guard","level":2,"score":0.4832537770271301},{"id":"https://openalex.org/C71745522","wikidata":"https://www.wikidata.org/wiki/Q2476929","display_name":"Confidentiality","level":2,"score":0.4486996829509735},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.291831374168396},{"id":"https://openalex.org/C513985346","wikidata":"https://www.wikidata.org/wiki/Q270471","display_name":"Virtualization","level":3,"score":0.16774699091911316},{"id":"https://openalex.org/C79974875","wikidata":"https://www.wikidata.org/wiki/Q483639","display_name":"Cloud computing","level":2,"score":0.08504661917686462},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3433210.3437531","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3433210.3437531","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2021 ACM Asia Conference on Computer and Communications Security","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[{"display_name":"Peace, Justice and strong institutions","id":"https://metadata.un.org/sdg/16","score":0.8199999928474426}],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":35,"referenced_works":["https://openalex.org/W1427174644","https://openalex.org/W1740185811","https://openalex.org/W1934458198","https://openalex.org/W1956767865","https://openalex.org/W1964241047","https://openalex.org/W1964281299","https://openalex.org/W2103289002","https://openalex.org/W2137365926","https://openalex.org/W2337480911","https://openalex.org/W2473598730","https://openalex.org/W2507765405","https://openalex.org/W2550858797","https://openalex.org/W2585270215","https://openalex.org/W2594560662","https://openalex.org/W2600769197","https://openalex.org/W2616901112","https://openalex.org/W2618073834","https://openalex.org/W2712617220","https://openalex.org/W2726246108","https://openalex.org/W2735614364","https://openalex.org/W2751989915","https://openalex.org/W2769061097","https://openalex.org/W2769824527","https://openalex.org/W2794801050","https://openalex.org/W2888798936","https://openalex.org/W2889224812","https://openalex.org/W2898003417","https://openalex.org/W2899912069","https://openalex.org/W2903166669","https://openalex.org/W2911594609","https://openalex.org/W2953150480","https://openalex.org/W2964118667","https://openalex.org/W2976763854","https://openalex.org/W2984937325","https://openalex.org/W3008819066"],"related_works":["https://openalex.org/W2379568912","https://openalex.org/W2505999637","https://openalex.org/W2943860641","https://openalex.org/W2383607474","https://openalex.org/W2432628879","https://openalex.org/W2979413027","https://openalex.org/W3016806905","https://openalex.org/W2990841437","https://openalex.org/W2911038896","https://openalex.org/W3838057"],"abstract_inverted_index":{"Intel":[0],"Software":[1],"Guard":[2],"Extensions":[3],"(SGX)":[4],"offers":[5],"strong":[6],"confidentiality":[7],"and":[8,30,72,81,84,106],"integrity":[9],"protection":[10],"to":[11,26,51],"software":[12],"programs":[13],"running":[14],"in":[15,33],"untrusted":[16],"operating":[17],"systems.":[18],"Unfortunately,":[19],"SGX":[20,34,116],"may":[21],"be":[22,38],"abused":[23],"by":[24,41,101],"attackers":[25],"shield":[27],"suspicious":[28],"payloads":[29],"conceal":[31],"misbehaviors":[32],"enclaves,":[35],"which":[36,118],"cannot":[37],"easily":[39],"detected":[40],"existing":[42,114],"defense":[43],"solutions.":[44],"There":[45],"is":[46],"no":[47],"comprehensive":[48],"study":[49,63],"conducted":[50],"characterize":[52],"malicious":[53,115,128],"enclaves.":[54,129],"In":[55],"this":[56],"paper,":[57],"we":[58,90],"present":[59],"the":[60,73],"first":[61],"systematic":[62],"that":[64,96],"scrutinizes":[65],"all":[66],"possible":[67],"interaction":[68],"interfaces":[69],"between":[70],"enclaves":[71],"outside":[74],"(i.e.,":[75],"cache-memory":[76],"hierarchy,":[77],"host":[78],"virtual":[79],"memory,":[80],"enclave-mode":[82],"transitions),":[83],"identifies":[85],"seven":[86],"attack":[87],"vectors.":[88],"Moreover,":[89],"propose":[91],"SGX-Bouncer,":[92],"a":[93],"detection":[94],"framework":[95],"can":[97,121],"detect":[98,123],"these":[99],"attacks":[100],"leveraging":[102],"multifarious":[103],"side-channel":[104],"observations":[105],"SGX-specific":[107],"features.":[108],"We":[109],"conduct":[110],"empirical":[111],"evaluations":[112],"with":[113],"applications,":[117],"suggests":[119],"SGX-Bouncer":[120],"effectively":[122],"various":[124],"abnormal":[125],"behaviors":[126],"from":[127]},"counts_by_year":[{"year":2026,"cited_by_count":1},{"year":2025,"cited_by_count":1},{"year":2024,"cited_by_count":3},{"year":2023,"cited_by_count":2},{"year":2022,"cited_by_count":1}],"updated_date":"2026-07-14T23:27:15.235271","created_date":"2025-10-10T00:00:00"}