{"id":"https://openalex.org/W4414295442","doi":"https://doi.org/10.3390/jcp5030075","title":"Microarchitectural Malware Detection via Translation Lookaside Buffer (TLB) Events","display_name":"Microarchitectural Malware Detection via Translation Lookaside Buffer (TLB) Events","publication_year":2025,"publication_date":"2025-09-17","ids":{"openalex":"https://openalex.org/W4414295442","doi":"https://doi.org/10.3390/jcp5030075"},"language":"en","primary_location":{"id":"doi:10.3390/jcp5030075","is_oa":true,"landing_page_url":"https://doi.org/10.3390/jcp5030075","pdf_url":"https://www.mdpi.com/2624-800X/5/3/75/pdf?version=1758094830","source":{"id":"https://openalex.org/S4210232532","display_name":"Journal of Cybersecurity and Privacy","issn_l":"2624-800X","issn":["2624-800X"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of Cybersecurity and Privacy","raw_type":"journal-article"},"type":"article","indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://www.mdpi.com/2624-800X/5/3/75/pdf?version=1758094830","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5114602386","display_name":"Cristian Agredo","orcid":null},"institutions":[{"id":"https://openalex.org/I55061410","display_name":"U.S. Air Force Institute of Technology","ror":"https://ror.org/03f9f1d95","country_code":"US","type":"education","lineage":["https://openalex.org/I1294991024","https://openalex.org/I1330347796","https://openalex.org/I1330347796","https://openalex.org/I2802362820","https://openalex.org/I4210089612","https://openalex.org/I4210102105","https://openalex.org/I4210102105","https://openalex.org/I55061410"]}],"countries":["US"],"is_corresponding":true,"raw_author_name":"Cristian Agredo","raw_affiliation_strings":["Air Force Institute of Technology, 2950 Hobson Way, Wright-Patterson AFB, OH 45433, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Air Force Institute of Technology, 2950 Hobson Way, Wright-Patterson AFB, OH 45433, USA","institution_ids":["https://openalex.org/I55061410"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5062779194","display_name":"Daniel Koranek","orcid":"https://orcid.org/0000-0002-6477-2646"},"institutions":[{"id":"https://openalex.org/I55061410","display_name":"U.S. Air Force Institute of Technology","ror":"https://ror.org/03f9f1d95","country_code":"US","type":"education","lineage":["https://openalex.org/I1294991024","https://openalex.org/I1330347796","https://openalex.org/I1330347796","https://openalex.org/I2802362820","https://openalex.org/I4210089612","https://openalex.org/I4210102105","https://openalex.org/I4210102105","https://openalex.org/I55061410"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Daniel F. Koranek","raw_affiliation_strings":["Air Force Institute of Technology, 2950 Hobson Way, Wright-Patterson AFB, OH 45433, USA"],"raw_orcid":"https://orcid.org/0000-0002-6477-2646","affiliations":[{"raw_affiliation_string":"Air Force Institute of Technology, 2950 Hobson Way, Wright-Patterson AFB, OH 45433, USA","institution_ids":["https://openalex.org/I55061410"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5029816966","display_name":"Christine M. Schubert Kabban","orcid":"https://orcid.org/0000-0001-9778-0813"},"institutions":[{"id":"https://openalex.org/I55061410","display_name":"U.S. Air Force Institute of Technology","ror":"https://ror.org/03f9f1d95","country_code":"US","type":"education","lineage":["https://openalex.org/I1294991024","https://openalex.org/I1330347796","https://openalex.org/I1330347796","https://openalex.org/I2802362820","https://openalex.org/I4210089612","https://openalex.org/I4210102105","https://openalex.org/I4210102105","https://openalex.org/I55061410"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Christine M. Schubert Kabban","raw_affiliation_strings":["Air Force Institute of Technology, 2950 Hobson Way, Wright-Patterson AFB, OH 45433, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Air Force Institute of Technology, 2950 Hobson Way, Wright-Patterson AFB, OH 45433, USA","institution_ids":["https://openalex.org/I55061410"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5009588860","display_name":"Jose A. Gutierrez del Arroyo","orcid":"https://orcid.org/0000-0001-5298-3051"},"institutions":[{"id":"https://openalex.org/I55061410","display_name":"U.S. Air Force Institute of Technology","ror":"https://ror.org/03f9f1d95","country_code":"US","type":"education","lineage":["https://openalex.org/I1294991024","https://openalex.org/I1330347796","https://openalex.org/I1330347796","https://openalex.org/I2802362820","https://openalex.org/I4210089612","https://openalex.org/I4210102105","https://openalex.org/I4210102105","https://openalex.org/I55061410"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Jose A. Gutierrez del Arroyo","raw_affiliation_strings":["Air Force Institute of Technology, 2950 Hobson Way, Wright-Patterson AFB, OH 45433, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Air Force Institute of Technology, 2950 Hobson Way, Wright-Patterson AFB, OH 45433, USA","institution_ids":["https://openalex.org/I55061410"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5052039290","display_name":"Scott Graham","orcid":"https://orcid.org/0000-0003-0193-1192"},"institutions":[{"id":"https://openalex.org/I55061410","display_name":"U.S. Air Force Institute of Technology","ror":"https://ror.org/03f9f1d95","country_code":"US","type":"education","lineage":["https://openalex.org/I1294991024","https://openalex.org/I1330347796","https://openalex.org/I1330347796","https://openalex.org/I2802362820","https://openalex.org/I4210089612","https://openalex.org/I4210102105","https://openalex.org/I4210102105","https://openalex.org/I55061410"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Scott R. Graham","raw_affiliation_strings":["Air Force Institute of Technology, 2950 Hobson Way, Wright-Patterson AFB, OH 45433, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Air Force Institute of Technology, 2950 Hobson Way, Wright-Patterson AFB, OH 45433, USA","institution_ids":["https://openalex.org/I55061410"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":["https://openalex.org/A5114602386"],"corresponding_institution_ids":["https://openalex.org/I55061410"],"apc_list":{"value":1000,"currency":"CHF","value_usd":1207},"apc_paid":{"value":1000,"currency":"CHF","value_usd":1207},"fwci":0.0,"has_fulltext":true,"cited_by_count":0,"citation_normalized_percentile":{"value":0.23893473,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"5","issue":"3","first_page":"75","last_page":"75"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9998000264167786,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9998000264167786,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.9994999766349792,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.994700014591217,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/translation-lookaside-buffer","display_name":"Translation lookaside buffer","score":0.8986999988555908},{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.7107999920845032},{"id":"https://openalex.org/keywords/task","display_name":"Task (project management)","score":0.5526000261306763},{"id":"https://openalex.org/keywords/workload","display_name":"Workload","score":0.5293999910354614},{"id":"https://openalex.org/keywords/focus","display_name":"Focus (optics)","score":0.46050000190734863},{"id":"https://openalex.org/keywords/translation","display_name":"Translation (biology)","score":0.32589998841285706},{"id":"https://openalex.org/keywords/malware-analysis","display_name":"Malware analysis","score":0.30649998784065247}],"concepts":[{"id":"https://openalex.org/C116007543","wikidata":"https://www.wikidata.org/wiki/Q1071403","display_name":"Translation lookaside buffer","level":4,"score":0.8986999988555908},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7717999815940857},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.7107999920845032},{"id":"https://openalex.org/C2780451532","wikidata":"https://www.wikidata.org/wiki/Q759676","display_name":"Task (project management)","level":2,"score":0.5526000261306763},{"id":"https://openalex.org/C2778476105","wikidata":"https://www.wikidata.org/wiki/Q628539","display_name":"Workload","level":2,"score":0.5293999910354614},{"id":"https://openalex.org/C192209626","wikidata":"https://www.wikidata.org/wiki/Q190909","display_name":"Focus (optics)","level":2,"score":0.46050000190734863},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.3878999948501587},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.3813000023365021},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.33390000462532043},{"id":"https://openalex.org/C149364088","wikidata":"https://www.wikidata.org/wiki/Q185917","display_name":"Translation (biology)","level":4,"score":0.32589998841285706},{"id":"https://openalex.org/C2779395397","wikidata":"https://www.wikidata.org/wiki/Q15731404","display_name":"Malware analysis","level":3,"score":0.30649998784065247},{"id":"https://openalex.org/C98045186","wikidata":"https://www.wikidata.org/wiki/Q205663","display_name":"Process (computing)","level":2,"score":0.29980000853538513},{"id":"https://openalex.org/C110083411","wikidata":"https://www.wikidata.org/wiki/Q1744628","display_name":"Statistical classification","level":2,"score":0.28679999709129333},{"id":"https://openalex.org/C112758219","wikidata":"https://www.wikidata.org/wiki/Q16038819","display_name":"Duration (music)","level":2,"score":0.27129998803138733},{"id":"https://openalex.org/C66905080","wikidata":"https://www.wikidata.org/wiki/Q17005494","display_name":"Binary classification","level":3,"score":0.26589998602867126},{"id":"https://openalex.org/C68043766","wikidata":"https://www.wikidata.org/wiki/Q267416","display_name":"Static random-access memory","level":2,"score":0.25929999351501465},{"id":"https://openalex.org/C137822555","wikidata":"https://www.wikidata.org/wiki/Q2587068","display_name":"Information sensitivity","level":2,"score":0.25859999656677246},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.2533000111579895}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.3390/jcp5030075","is_oa":true,"landing_page_url":"https://doi.org/10.3390/jcp5030075","pdf_url":"https://www.mdpi.com/2624-800X/5/3/75/pdf?version=1758094830","source":{"id":"https://openalex.org/S4210232532","display_name":"Journal of Cybersecurity and Privacy","issn_l":"2624-800X","issn":["2624-800X"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of Cybersecurity and Privacy","raw_type":"journal-article"},{"id":"pmh:oai:doaj.org/article:754fc2e4aaef43e0a666506d0aa21f52","is_oa":true,"landing_page_url":"https://doaj.org/article/754fc2e4aaef43e0a666506d0aa21f52","pdf_url":null,"source":{"id":"https://openalex.org/S4306401280","display_name":"DOAJ (DOAJ: Directory of Open Access Journals)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-sa","license_id":"https://openalex.org/licenses/cc-by-sa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Journal of Cybersecurity and Privacy, Vol 5, Iss 3, p 75 (2025)","raw_type":"article"}],"best_oa_location":{"id":"doi:10.3390/jcp5030075","is_oa":true,"landing_page_url":"https://doi.org/10.3390/jcp5030075","pdf_url":"https://www.mdpi.com/2624-800X/5/3/75/pdf?version=1758094830","source":{"id":"https://openalex.org/S4210232532","display_name":"Journal of Cybersecurity and Privacy","issn_l":"2624-800X","issn":["2624-800X"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of Cybersecurity and Privacy","raw_type":"journal-article"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4414295442.pdf","grobid_xml":"https://content.openalex.org/works/W4414295442.grobid-xml"},"referenced_works_count":27,"referenced_works":["https://openalex.org/W1488058190","https://openalex.org/W1498436455","https://openalex.org/W1934458198","https://openalex.org/W2103212315","https://openalex.org/W2119438786","https://openalex.org/W2172060328","https://openalex.org/W2249344705","https://openalex.org/W2255548496","https://openalex.org/W2295598076","https://openalex.org/W2911964244","https://openalex.org/W2932551155","https://openalex.org/W2965115498","https://openalex.org/W3029114445","https://openalex.org/W3036557299","https://openalex.org/W3159996419","https://openalex.org/W3166541059","https://openalex.org/W4380881129","https://openalex.org/W4383981974","https://openalex.org/W4386764070","https://openalex.org/W4396506305","https://openalex.org/W4396949712","https://openalex.org/W4400235424","https://openalex.org/W4400350991","https://openalex.org/W4404262684","https://openalex.org/W4406322419","https://openalex.org/W4410887412","https://openalex.org/W4411639888"],"related_works":[],"abstract_inverted_index":{"Prior":[0],"work":[1,171],"has":[2],"shown":[3],"that":[4,124,160,181],"Translation":[5],"Lookaside":[6],"Buffer":[7],"(TLB)":[8],"data":[9,66],"contains":[10],"valuable":[11],"behavioral":[12,168],"information.":[13],"Many":[14],"existing":[15],"methodologies":[16],"rely":[17],"on":[18,24,49],"timing":[19,50,70],"features":[20,51],"or":[21,57,129],"focus":[22],"solely":[23],"workload":[25],"classification.":[26],"In":[27],"this":[28,82],"study,":[29],"we":[30],"propose":[31],"a":[32,99,109],"novel":[33],"approach":[34],"to":[35,104,137],"malware":[36,119,194],"classification":[37,85,90,101,111],"using":[38],"only":[39],"TLB-related":[40],"Hardware":[41],"Performance":[42],"Counters":[43],"(HPCs),":[44],"explicitly":[45],"excluding":[46],"any":[47,69],"dependence":[48],"such":[52],"as":[53,166],"task":[54],"execution":[55,127],"duration":[56],"memory":[58,130],"access":[59,131],"timing.":[60],"Our":[61,121],"methodology":[62],"evaluates":[63],"whether":[64],"TLB":[65,133,162],"alone,":[67],"without":[68,126],"information,":[71],"can":[72,164,188],"effectively":[73,190],"distinguish":[74],"between":[75],"malicious":[76,94],"and":[77,107,118,143,150],"benign":[78,96,117],"programs.":[79],"We":[80],"test":[81],"across":[83],"three":[84],"scenarios:":[86],"(1)":[87],"A":[88],"binary":[89],"problem":[91,102,112],"involving":[92],"distinguishing":[93],"from":[95],"tasks,":[97],"(2)":[98],"4-way":[100],"designed":[103],"improve":[105],"separability,":[106],"(3)":[108],"10-way":[110],"with":[113],"classes":[114],"of":[115,175,185],"individual":[116],"tasks.":[120],"results":[122],"demonstrate":[123,159],"even":[125],"time":[128],"timing,":[132],"events":[134],"achieve":[135],"up":[136],"81%":[138],"accuracy":[139,145,152],"for":[140,146,153,192],"the":[141,147,154,173],"binary,":[142],"72%":[144],"4-class":[148],"grouping,":[149],"61%":[151],"10-class":[155],"grouping.":[156],"These":[157],"findings":[158],"time-independent":[161],"patterns":[163],"serve":[165],"robust":[167],"signatures.":[169],"This":[170],"expands":[172],"understanding":[174],"microarchitectural":[176],"side":[177],"effects":[178],"by":[179],"demonstrating":[180],"TLB-only":[182],"features,":[183],"independent":[184],"timing-based":[186],"techniques,":[187],"be":[189],"used":[191],"real-world":[193],"detection.":[195]},"counts_by_year":[],"updated_date":"2026-08-25T07:29:55.448023","created_date":"2025-10-10T00:00:00"}