{"id":"https://openalex.org/W4235983615","doi":"https://doi.org/10.1504/ijhpcn.2016.10001335","title":"BeCFI: detecting hidden control flow with performance monitoring counters","display_name":"BeCFI: detecting hidden control flow with performance monitoring counters","publication_year":2016,"publication_date":"2016-01-01","ids":{"openalex":"https://openalex.org/W4235983615","doi":"https://doi.org/10.1504/ijhpcn.2016.10001335"},"language":"en","primary_location":{"id":"doi:10.1504/ijhpcn.2016.10001335","is_oa":false,"landing_page_url":"https://doi.org/10.1504/ijhpcn.2016.10001335","pdf_url":null,"source":{"id":"https://openalex.org/S159903936","display_name":"International Journal of High Performance Computing and Networking","issn_l":"1740-0562","issn":["1740-0562","1740-0570"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310317825","host_organization_name":"Inderscience Publishers","host_organization_lineage":["https://openalex.org/P4310317825"],"host_organization_lineage_names":["Inderscience Publishers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"International Journal of High Performance Computing and Networking","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5102960478","display_name":"Fulin Li","orcid":"https://orcid.org/0000-0002-4039-7263"},"institutions":[{"id":"https://openalex.org/I169689159","display_name":"PLA Information Engineering University","ror":"https://ror.org/00mm1qk40","country_code":"CN","type":"education","lineage":["https://openalex.org/I169689159"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"FuLin Li","raw_affiliation_strings":["Institute of Electronic Technology, Information Engineering University, Zhengzhou, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Institute of Electronic Technology, Information Engineering University, Zhengzhou, China","institution_ids":["https://openalex.org/I169689159"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5017405627","display_name":"Wenchang Shi","orcid":"https://orcid.org/0000-0002-5160-1223"},"institutions":[{"id":"https://openalex.org/I78988378","display_name":"Renmin University of China","ror":"https://ror.org/041pakw92","country_code":"CN","type":"education","lineage":["https://openalex.org/I78988378"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"WenChang Shi","raw_affiliation_strings":["School of Information, Renmin University of China, Beijing, China; Key Laboratory of Data Engineering and Knowledge Engineering, Ministry of Education, Renmin University of China, Beijing, China","School of Information, Renmin University of China, Beijing, China","Key Laboratory of Data Engineering and Knowledge Engineering, Ministry of Education, Renmin University of China, Beijing, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Information, Renmin University of China, Beijing, China; Key Laboratory of Data Engineering and Knowledge Engineering, Ministry of Education, Renmin University of China, Beijing, China","institution_ids":["https://openalex.org/I78988378"]},{"raw_affiliation_string":"School of Information, Renmin University of China, Beijing, China","institution_ids":["https://openalex.org/I78988378"]},{"raw_affiliation_string":"Key Laboratory of Data Engineering and Knowledge Engineering, Ministry of Education, Renmin University of China, Beijing, China","institution_ids":["https://openalex.org/I78988378"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100873249","display_name":"Jinhui Yuan","orcid":null},"institutions":[{"id":"https://openalex.org/I169689159","display_name":"PLA Information Engineering University","ror":"https://ror.org/00mm1qk40","country_code":"CN","type":"education","lineage":["https://openalex.org/I169689159"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"JinHui Yuan","raw_affiliation_strings":["Institute of Electronic Technology, Information Engineering University, Zhengzhou, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Institute of Electronic Technology, Information Engineering University, Zhengzhou, China","institution_ids":["https://openalex.org/I169689159"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5010062994","display_name":"Hongwei Zhou","orcid":"https://orcid.org/0009-0002-9782-9415"},"institutions":[{"id":"https://openalex.org/I169689159","display_name":"PLA Information Engineering University","ror":"https://ror.org/00mm1qk40","country_code":"CN","type":"education","lineage":["https://openalex.org/I169689159"]},{"id":"https://openalex.org/I78988378","display_name":"Renmin University of China","ror":"https://ror.org/041pakw92","country_code":"CN","type":"education","lineage":["https://openalex.org/I78988378"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"HongWei Zhou","raw_affiliation_strings":["Information Engineering University, Zhengzhou, China; Key Laboratory of Data Engineering and Knowledge Engineering, Ministry of Education, Renmin University of China, Beijing, China","Information Engineering University, Zhengzhou, China","Key Laboratory of Data Engineering and Knowledge Engineering, Ministry of Education, Renmin University of China, Beijing, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Information Engineering University, Zhengzhou, China; Key Laboratory of Data Engineering and Knowledge Engineering, Ministry of Education, Renmin University of China, Beijing, China","institution_ids":["https://openalex.org/I78988378"]},{"raw_affiliation_string":"Information Engineering University, Zhengzhou, China","institution_ids":["https://openalex.org/I169689159"]},{"raw_affiliation_string":"Key Laboratory of Data Engineering and Knowledge Engineering, Ministry of Education, Renmin University of China, Beijing, China","institution_ids":["https://openalex.org/I78988378"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":4,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.23698884,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"9","issue":"5/6","first_page":"470","last_page":"470"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.9998000264167786,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.9998000264167786,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9976999759674072,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11181","display_name":"Advanced Data Storage Technologies","score":0.9939000010490417,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/rootkit","display_name":"Rootkit","score":0.9470449686050415},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8805969953536987},{"id":"https://openalex.org/keywords/control-flow","display_name":"Control flow","score":0.7252001762390137},{"id":"https://openalex.org/keywords/software","display_name":"Software","score":0.6083282232284546},{"id":"https://openalex.org/keywords/embedded-system","display_name":"Embedded system","score":0.5815836787223816},{"id":"https://openalex.org/keywords/x86","display_name":"x86","score":0.5636420845985413},{"id":"https://openalex.org/keywords/compiler","display_name":"Compiler","score":0.5510271191596985},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.5499746203422546},{"id":"https://openalex.org/keywords/overhead","display_name":"Overhead (engineering)","score":0.5472109913825989},{"id":"https://openalex.org/keywords/linux-kernel","display_name":"Linux kernel","score":0.5279680490493774},{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.4924534261226654},{"id":"https://openalex.org/keywords/system-call","display_name":"System call","score":0.48098790645599365},{"id":"https://openalex.org/keywords/computer-hardware","display_name":"Computer hardware","score":0.4700782597064972},{"id":"https://openalex.org/keywords/kernel","display_name":"Kernel (algebra)","score":0.4368996024131775},{"id":"https://openalex.org/keywords/transfer","display_name":"Transfer (computing)","score":0.43431276082992554},{"id":"https://openalex.org/keywords/binary-translation","display_name":"Binary translation","score":0.42038974165916443},{"id":"https://openalex.org/keywords/control","display_name":"Control (management)","score":0.4197617769241333},{"id":"https://openalex.org/keywords/programming-language","display_name":"Programming language","score":0.12433722615242004},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.1013425886631012}],"concepts":[{"id":"https://openalex.org/C10144332","wikidata":"https://www.wikidata.org/wiki/Q14645","display_name":"Rootkit","level":3,"score":0.9470449686050415},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8805969953536987},{"id":"https://openalex.org/C160191386","wikidata":"https://www.wikidata.org/wiki/Q868299","display_name":"Control flow","level":2,"score":0.7252001762390137},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.6083282232284546},{"id":"https://openalex.org/C149635348","wikidata":"https://www.wikidata.org/wiki/Q193040","display_name":"Embedded system","level":1,"score":0.5815836787223816},{"id":"https://openalex.org/C170723468","wikidata":"https://www.wikidata.org/wiki/Q182933","display_name":"x86","level":3,"score":0.5636420845985413},{"id":"https://openalex.org/C169590947","wikidata":"https://www.wikidata.org/wiki/Q47506","display_name":"Compiler","level":2,"score":0.5510271191596985},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.5499746203422546},{"id":"https://openalex.org/C2779960059","wikidata":"https://www.wikidata.org/wiki/Q7113681","display_name":"Overhead (engineering)","level":2,"score":0.5472109913825989},{"id":"https://openalex.org/C553261973","wikidata":"https://www.wikidata.org/wiki/Q14579","display_name":"Linux kernel","level":2,"score":0.5279680490493774},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.4924534261226654},{"id":"https://openalex.org/C2778579508","wikidata":"https://www.wikidata.org/wiki/Q722192","display_name":"System call","level":2,"score":0.48098790645599365},{"id":"https://openalex.org/C9390403","wikidata":"https://www.wikidata.org/wiki/Q3966","display_name":"Computer hardware","level":1,"score":0.4700782597064972},{"id":"https://openalex.org/C74193536","wikidata":"https://www.wikidata.org/wiki/Q574844","display_name":"Kernel (algebra)","level":2,"score":0.4368996024131775},{"id":"https://openalex.org/C2776175482","wikidata":"https://www.wikidata.org/wiki/Q1195816","display_name":"Transfer (computing)","level":2,"score":0.43431276082992554},{"id":"https://openalex.org/C2778971978","wikidata":"https://www.wikidata.org/wiki/Q2287075","display_name":"Binary translation","level":3,"score":0.42038974165916443},{"id":"https://openalex.org/C2775924081","wikidata":"https://www.wikidata.org/wiki/Q55608371","display_name":"Control (management)","level":2,"score":0.4197617769241333},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.12433722615242004},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.1013425886631012},{"id":"https://openalex.org/C114614502","wikidata":"https://www.wikidata.org/wiki/Q76592","display_name":"Combinatorics","level":1,"score":0.0},{"id":"https://openalex.org/C33923547","wikidata":"https://www.wikidata.org/wiki/Q395","display_name":"Mathematics","level":0,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1504/ijhpcn.2016.10001335","is_oa":false,"landing_page_url":"https://doi.org/10.1504/ijhpcn.2016.10001335","pdf_url":null,"source":{"id":"https://openalex.org/S159903936","display_name":"International Journal of High Performance Computing and Networking","issn_l":"1740-0562","issn":["1740-0562","1740-0570"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310317825","host_organization_name":"Inderscience Publishers","host_organization_lineage":["https://openalex.org/P4310317825"],"host_organization_lineage_names":["Inderscience Publishers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"International Journal of High Performance Computing and Networking","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":["https://openalex.org/W1964586167","https://openalex.org/W2369102298","https://openalex.org/W2766777357","https://openalex.org/W3005677086","https://openalex.org/W2479669872","https://openalex.org/W2911551207","https://openalex.org/W2354398839","https://openalex.org/W2171038386","https://openalex.org/W2025088090","https://openalex.org/W1514297880"],"abstract_inverted_index":{"Most":[0],"of":[1,30,59,63,75,97,137],"existing":[2],"control":[3,10,21,48,105,118,141],"flow":[4,11,22,49,142],"integrity":[5],"efforts":[6],"target":[7],"keeping":[8],"intended":[9],"in":[12,109],"good":[13],"integrity.":[14],"However,":[15],"they":[16],"fail":[17],"to":[18,45],"expose":[19],"hidden":[20,47,117,140],"that":[23,114,155],"may":[24],"be":[25],"introduced":[26,143],"by":[27,89,144],"the":[28,37,61,69,73,95,139],"execution":[29,62,96],"rootkits,":[31],"ROP":[32,148],"gadgets,":[33],"etc.":[34],"To":[35,80],"overcome":[36],"challenge,":[38],"we":[39,84],"propose":[40],"an":[41,158],"innovative":[42],"approach":[43],"BeCFI":[44,67,112,134,156],"detect":[46],"based":[50],"on":[51,126],"cross-view":[52],"principle.":[53],"Since":[54],"modern":[55],"processors":[56],"are":[57],"capable":[58,136],"observing":[60],"all":[64],"branch":[65,98],"instructions,":[66],"obtains":[68],"hardware":[70,110],"view":[71],"with":[72,100],"support":[74],"performance":[76,152],"monitoring":[77],"counters":[78],"(PMCs).":[79],"obtain":[81],"software":[82],"view,":[83,111],"build":[85],"a":[86,104,123],"software-based":[87,101],"counter":[88],"compiler-patching":[90],"and":[91,93,147],"binary-overwriting,":[92],"monitor":[94],"instructions":[99],"counters.":[102],"If":[103],"transfer":[106],"only":[107],"appears":[108],"considers":[113],"it":[115],"is":[116,135],"transfer.":[119],"We":[120],"have":[121],"developed":[122],"prototype":[124],"system":[125],"Intel":[127],"x86":[128],"Linux":[129],"kernel.":[130],"Our":[131],"evaluations":[132],"show":[133],"detecting":[138],"kernel":[145],"rootkits":[146],"attacks.":[149],"Furthermore":[150],"our":[151],"tests":[153],"demonstrate":[154],"incurs":[157],"acceptable":[159],"overhead.":[160]},"counts_by_year":[],"updated_date":"2026-06-11T09:08:48.828518","created_date":"2025-10-10T00:00:00"}