{"id":"https://openalex.org/W7163537486","doi":"https://doi.org/10.1145/3779208.3785293","title":"TRM: An Efficient Hypervisor-Based Framework For Malware Analysis and Memory Reconstruction","display_name":"TRM: An Efficient Hypervisor-Based Framework For Malware Analysis and Memory Reconstruction","publication_year":2026,"publication_date":"2026-06-01","ids":{"openalex":"https://openalex.org/W7163537486","doi":"https://doi.org/10.1145/3779208.3785293"},"language":"en","primary_location":{"id":"doi:10.1145/3779208.3785293","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3779208.3785293","pdf_url":null,"source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the ACM Asia Conference on Computer and Communications Security","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://doi.org/10.1145/3779208.3785293","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5021846368","display_name":"Mohammad Sina Karvandi","orcid":"https://orcid.org/0009-0007-5810-4549"},"institutions":[{"id":"https://openalex.org/I865915315","display_name":"Vrije Universiteit Amsterdam","ror":"https://ror.org/008xxew50","country_code":"NL","type":"education","lineage":["https://openalex.org/I865915315"]}],"countries":["NL"],"is_corresponding":false,"raw_author_name":"Mohammad Sina Karvandi","raw_affiliation_strings":["Vrije Universiteit Amsterdam, Amsterdam, Netherlands"],"raw_orcid":"https://orcid.org/0009-0007-5810-4549","affiliations":[{"raw_affiliation_string":"Vrije Universiteit Amsterdam, Amsterdam, Netherlands","institution_ids":["https://openalex.org/I865915315"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5058015470","display_name":"Soroush Meghdadizanjani","orcid":"https://orcid.org/0000-0002-8478-2470"},"institutions":[{"id":"https://openalex.org/I59553526","display_name":"Stony Brook University","ror":"https://ror.org/05qghxh33","country_code":"US","type":"education","lineage":["https://openalex.org/I59553526"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Soroush Meghdadizanjani","raw_affiliation_strings":["Stony Brook University, Stony Brook, USA"],"raw_orcid":"https://orcid.org/0000-0002-8478-2470","affiliations":[{"raw_affiliation_string":"Stony Brook University, Stony Brook, USA","institution_ids":["https://openalex.org/I59553526"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5039150275","display_name":"Sima Arasteh","orcid":null},"institutions":[{"id":"https://openalex.org/I1174212","display_name":"University of Southern California","ror":"https://ror.org/03taz7m60","country_code":"US","type":"education","lineage":["https://openalex.org/I1174212"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Sima Arasteh","raw_affiliation_strings":["University of Southern California, Los Angeles, USA"],"raw_orcid":"https://orcid.org/0009-0000-5950-8245","affiliations":[{"raw_affiliation_string":"University of Southern California, Los Angeles, USA","institution_ids":["https://openalex.org/I1174212"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5021442954","display_name":"Saleh Khalaj Monfared","orcid":"https://orcid.org/0000-0001-5369-5270"},"institutions":[{"id":"https://openalex.org/I107077323","display_name":"Worcester Polytechnic Institute","ror":"https://ror.org/05ejpqr48","country_code":"US","type":"education","lineage":["https://openalex.org/I107077323"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Saleh Khalaj Monfared","raw_affiliation_strings":["Worcester Polytechnic Institute, Worcester, USA"],"raw_orcid":"https://orcid.org/0000-0001-5369-5270","affiliations":[{"raw_affiliation_string":"Worcester Polytechnic Institute, Worcester, USA","institution_ids":["https://openalex.org/I107077323"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5122194970","display_name":"Mohammad K. Fallah","orcid":null},"institutions":[{"id":"https://openalex.org/I152238500","display_name":"Chosun University","ror":"https://ror.org/01zt9a375","country_code":"KR","type":"education","lineage":["https://openalex.org/I152238500"]}],"countries":["KR"],"is_corresponding":false,"raw_author_name":"Mohammad K. Fallah","raw_affiliation_strings":["Chosun University, Gwangju, Republic of Korea"],"raw_orcid":"https://orcid.org/0000-0002-8271-3885","affiliations":[{"raw_affiliation_string":"Chosun University, Gwangju, Republic of Korea","institution_ids":["https://openalex.org/I152238500"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5137862857","display_name":"Saeid Gorgin","orcid":"https://orcid.org/0000-0001-5898-4872"},"institutions":[{"id":"https://openalex.org/I848706","display_name":"Sungkyunkwan University","ror":"https://ror.org/04q78tk20","country_code":"KR","type":"education","lineage":["https://openalex.org/I848706"]}],"countries":["KR"],"is_corresponding":false,"raw_author_name":"Saeid Gorgin","raw_affiliation_strings":["Sungkyunkwan University, Suwon, Republic of Korea"],"raw_orcid":"https://orcid.org/0000-0001-5898-4872","affiliations":[{"raw_affiliation_string":"Sungkyunkwan University, Suwon, Republic of Korea","institution_ids":["https://openalex.org/I848706"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5073344264","display_name":"Jeong\u2013A Lee","orcid":"https://orcid.org/0000-0002-5166-0629"},"institutions":[{"id":"https://openalex.org/I152238500","display_name":"Chosun University","ror":"https://ror.org/01zt9a375","country_code":"KR","type":"education","lineage":["https://openalex.org/I152238500"]}],"countries":["KR"],"is_corresponding":false,"raw_author_name":"Jeong-A Lee","raw_affiliation_strings":["Chosun University, Gwangju, Republic of Korea"],"raw_orcid":"https://orcid.org/0000-0002-5166-0629","affiliations":[{"raw_affiliation_string":"Chosun University, Gwangju, Republic of Korea","institution_ids":["https://openalex.org/I152238500"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5010266944","display_name":"Asia Slowinska","orcid":"https://orcid.org/0009-0008-0416-3751"},"institutions":[{"id":"https://openalex.org/I865915315","display_name":"Vrije Universiteit Amsterdam","ror":"https://ror.org/008xxew50","country_code":"NL","type":"education","lineage":["https://openalex.org/I865915315"]}],"countries":["NL"],"is_corresponding":false,"raw_author_name":"Asia Slowinska","raw_affiliation_strings":["Vrije Universiteit Amsterdam, Amsterdam, Netherlands"],"raw_orcid":"https://orcid.org/0009-0008-0416-3751","affiliations":[{"raw_affiliation_string":"Vrije Universiteit Amsterdam, Amsterdam, Netherlands","institution_ids":["https://openalex.org/I865915315"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5084448782","display_name":"Erik van der Kouwe","orcid":"https://orcid.org/0000-0002-0312-9913"},"institutions":[{"id":"https://openalex.org/I865915315","display_name":"Vrije Universiteit Amsterdam","ror":"https://ror.org/008xxew50","country_code":"NL","type":"education","lineage":["https://openalex.org/I865915315"]}],"countries":["NL"],"is_corresponding":false,"raw_author_name":"Erik van der Kouwe","raw_affiliation_strings":["Vrije Universiteit Amsterdam, Amsterdam, Netherlands"],"raw_orcid":"https://orcid.org/0000-0002-0312-9913","affiliations":[{"raw_affiliation_string":"Vrije Universiteit Amsterdam, Amsterdam, Netherlands","institution_ids":["https://openalex.org/I865915315"]}]}],"institutions":[],"countries_distinct_count":3,"institutions_distinct_count":6,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"68","last_page":"82"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.8849999904632568,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.8849999904632568,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.05590000003576279,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":0.022099999710917473,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.37279999256134033},{"id":"https://openalex.org/keywords/key","display_name":"Key (lock)","score":0.26989999413490295},{"id":"https://openalex.org/keywords/feature","display_name":"Feature (linguistics)","score":0.24469999969005585},{"id":"https://openalex.org/keywords/perspective","display_name":"Perspective (graphical)","score":0.23810000717639923},{"id":"https://openalex.org/keywords/component","display_name":"Component (thermodynamics)","score":0.23559999465942383}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6779000163078308},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.37279999256134033},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.36649999022483826},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.30790001153945923},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.27880001068115234},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.26989999413490295},{"id":"https://openalex.org/C2776401178","wikidata":"https://www.wikidata.org/wiki/Q12050496","display_name":"Feature (linguistics)","level":2,"score":0.24469999969005585},{"id":"https://openalex.org/C12713177","wikidata":"https://www.wikidata.org/wiki/Q1900281","display_name":"Perspective (graphical)","level":2,"score":0.23810000717639923},{"id":"https://openalex.org/C168167062","wikidata":"https://www.wikidata.org/wiki/Q1117970","display_name":"Component (thermodynamics)","level":2,"score":0.23559999465942383},{"id":"https://openalex.org/C116834253","wikidata":"https://www.wikidata.org/wiki/Q2039217","display_name":"Identification (biology)","level":2,"score":0.23000000417232513}],"mesh":[],"locations_count":3,"locations":[{"id":"doi:10.1145/3779208.3785293","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3779208.3785293","pdf_url":null,"source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the ACM Asia Conference on Computer and Communications Security","raw_type":"proceedings-article"},{"id":"pmh:oai:research.vu.nl:openaire/9f31a26e-5d94-4ed5-9af1-42c2b3be39eb","is_oa":true,"landing_page_url":"https://research.vu.nl/en/publications/9f31a26e-5d94-4ed5-9af1-42c2b3be39eb","pdf_url":null,"source":{"id":"https://openalex.org/S4306401107","display_name":"VU Research Portal","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I865915315","host_organization_name":"Vrije Universiteit Amsterdam","host_organization_lineage":["https://openalex.org/I865915315"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":null,"raw_type":"info:eu-repo/semantics/conferenceObject"},{"id":"pmh:oai:research.vu.nl:publications/9f31a26e-5d94-4ed5-9af1-42c2b3be39eb","is_oa":true,"landing_page_url":"https://hdl.handle.net/1871.1/9f31a26e-5d94-4ed5-9af1-42c2b3be39eb","pdf_url":null,"source":{"id":"https://openalex.org/S4306401107","display_name":"VU Research Portal","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I865915315","host_organization_name":"Vrije Universiteit Amsterdam","host_organization_lineage":["https://openalex.org/I865915315"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"info:eu-repo/semantics/conferenceObject"}],"best_oa_location":{"id":"doi:10.1145/3779208.3785293","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3779208.3785293","pdf_url":null,"source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the ACM Asia Conference on Computer and Communications Security","raw_type":"proceedings-article"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":39,"referenced_works":["https://openalex.org/W17195072","https://openalex.org/W1514687127","https://openalex.org/W1981984793","https://openalex.org/W2000249510","https://openalex.org/W2057907247","https://openalex.org/W2092756033","https://openalex.org/W2098431065","https://openalex.org/W2100002952","https://openalex.org/W2117359657","https://openalex.org/W2132874238","https://openalex.org/W2137365926","https://openalex.org/W2140807364","https://openalex.org/W2144981449","https://openalex.org/W2145688371","https://openalex.org/W2151182669","https://openalex.org/W2154529672","https://openalex.org/W2159265516","https://openalex.org/W2160914149","https://openalex.org/W2162765234","https://openalex.org/W2294049595","https://openalex.org/W2514974017","https://openalex.org/W2895892359","https://openalex.org/W2916667465","https://openalex.org/W2934053005","https://openalex.org/W2979393298","https://openalex.org/W3003925307","https://openalex.org/W3006140559","https://openalex.org/W3013896538","https://openalex.org/W3020335785","https://openalex.org/W3153698034","https://openalex.org/W3168458510","https://openalex.org/W3178360204","https://openalex.org/W3196101218","https://openalex.org/W3216796243","https://openalex.org/W4221070120","https://openalex.org/W4308642425","https://openalex.org/W4313558727","https://openalex.org/W4402957775","https://openalex.org/W4405183032"],"related_works":[],"abstract_inverted_index":{"Modern":[0],"rootkits":[1],"leverage":[2],"kernel":[3,159],"privileges":[4],"to":[5,16,70,85,122,141,144],"hide":[6],"from":[7,139],"analysis":[8,115],"tools,":[9],"while":[10,119],"obfuscation":[11],"techniques":[12],"render":[13],"them":[14],"resistant":[15],"static":[17],"analysis.":[18,185],"Reverse":[19],"engineering":[20,151],"malware":[21,184],"requires":[22],"observing":[23],"memory":[24,73,93,112,165],"usage":[25],"and":[26,44,75,91,114,131,147,182],"reconstructing":[27],"data":[28,117,132,168],"structures.":[29],"Existing":[30],"tools":[31],"rely":[32],"on":[33,154],"instrumentation":[34],"or":[35],"emulation,":[36],"which":[37],"introduce":[38],"high":[39],"overhead,":[40],"leave":[41],"detectable":[42],"artifacts,":[43],"cannot":[45],"reliably":[46],"analyze":[47],"kernel-level":[48],"malware.":[49,64,123],"We":[50,124],"present":[51],"The":[52],"Reversing":[53],"Machine":[54],"(TRM),":[55],"a":[56,97],"hypervisor-based":[57],"framework":[58],"for":[59,110,157],"high-performance":[60],"introspection":[61],"of":[62,96,116,128],"evasive":[63],"It":[65],"is":[66],"the":[67,79,176],"first":[68],"system":[69,135],"support":[71],"selective":[72],"tracing":[74,166],"structure":[76,169],"reconstruction":[77,113,127,170],"in":[78,172],"hypervisor.":[80],"TRM":[81,102,161],"repurposes":[82],"hardware":[83,108],"virtualization":[84,109],"efficiently":[86],"detect":[87],"user-kernel":[88],"mode":[89],"transitions":[90],"obtain":[92],"traces":[94],"independently":[95],"potentially":[98],"compromised":[99],"guest":[100],"kernel.":[101],"introduces":[103],"new":[104],"insights":[105],"into":[106],"leveraging":[107],"runtime":[111],"structures":[118],"remaining":[120],"invisible":[121],"demonstrate":[125],"automatic":[126],"function":[129],"signatures":[130],"structures,":[133],"reduce":[134],"call":[136],"latency":[137],"overhead":[138],"142%":[140],"57%":[142],"compared":[143],"prior":[145,179],"work,":[146],"accelerate":[148],"manual":[149],"reverse":[150],"by":[152],"43%":[153],"average,":[155],"even":[156],"complex":[158],"objects.":[160],"shows":[162],"that":[163],"hypervisor-level":[164],"makes":[167],"practical":[171],"hostile":[173],"environments,":[174],"bridging":[175],"gap":[177],"between":[178],"feasibility":[180],"studies":[181],"real-world":[183]},"counts_by_year":[],"updated_date":"2026-07-23T08:03:31.855105","created_date":"2026-06-05T00:00:00"}