Pith. sign in

REVIEW 3 major objections 5 minor 48 references

Detecting Covert Cryptomining using HPC

T0 review · 3 major / 5 minor · reviewed 2026-08-14 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Hardware performance counters can fingerprint proof-of-work algorithms, letting a generic detector catch covert cryptomining with near-perfect accuracy from five-second samples.

desk verdict A methodologically solid HPC-based cryptomining detector whose same-processor results are convincing, but whose genericity claims exceed what the experiments actually show. read the letter →

arxiv 1909.00268 v2 pith:JEVM5JBY submitted 2019-08-31 cs.CR

Ankit Gangwal , Samuele Giuliano Piazzetta , Gianluca Lain , Mauro Conti This is my paper · ORCID
classification cs.CR
keywords cryptocurrencymachinelearningminingprofilinghardwareperformancecounterscovertcryptominingcryptojackingproof-of-work
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper sets out to detect covert cryptomining—unauthorized use of a victim's CPU to mine cryptocurrency—in a way that does not depend on any particular coin or delivery mechanism. Its bet is that every proof-of-work algorithm leaves a recognizable pattern in hardware performance counters, the processor's built-in event counters, because each algorithm executes a distinct sequence of operations that strains different parts of the CPU. The authors profile eleven cryptocurrencies covering the top mining pools, train Random Forest and SVM classifiers on 28 hardware, software, and cache events, and report near-perfect binary classification with five-second samples. If the approach holds, defenders could catch cryptojacking in real time across currencies, including currencies released after deployment, without inspecting process behavior or network traffic.

What carries the argument

The load-bearing object is the "clean HPC signature" of a proof-of-work algorithm: the per-process pattern of 28 hardware, software, and hardware-cache events (branch misses, cache misses, memory loads, context switches, page faults, etc.) recorded at 10 Hz while the miner is in its stable execution stage. Each sample becomes one row of 336 features by applying 12 statistical functions—quantiles, means, variance, skewness, kurtosis—to each event. Feature selection with forests of trees prunes this down, and a Random Forest (or SVM) learns the mining/non-mining boundary. The signature does the work because a proof-of-work algorithm repeated millions of times strains the same processor resources every iteration, making its event profile stable enough to distinguish from other heavy tasks and from other PoW algorithms.

What would settle it

On one of the paper's test systems, modify a miner to interleave a second compute-heavy workload or to pause for random intervals, then collect five-second HPC samples and test the trained classifier; if even a modest sacrifice in hashing rate pushes the false-negative rate well above the reported near-perfect levels, the generic detection claim holds only for uncompromised full-speed mining.

Watch

Extended reading notes

Core claim

The paper's central claim is that a proof-of-work algorithm, not the specific cryptocurrency or miner program, is the right unit of detection. Because a miner runs the same PoW computation repeatedly, the processor's hardware performance counters settle into a repeatable pattern—some events (cache misses, branch misses, instructions retired, page faults, and so on) are heavily exercised while others are relatively quiet. The authors build clean signatures from 28 such events, sample them ten times per second, reduce each sample to 336 statistical features, and train Random Forest and SVM classifiers. On two Intel laptops they report $F_1$ scores at or above 0.999 for binary mining-versus-non-mining classification with 30-second samples, still near-perfect with five-second samples, accuracy around 0.98 for telling eleven cryptocurrencies apart, and high accuracy when classifying a Bitcoin miner program that was unseen during training. They also report that profiles trained on one processor model do not transfer to another.

Load-bearing premise

The approach assumes a profit-maximizing attacker who will run the proof-of-work algorithm continuously at full speed without adding dummy work, because the clean HPC signature is only guaranteed when the mining computation is not diluted by other operations.

Editorial extensions

If this is right

  • A single classifier can cover all cryptocurrencies built on known proof-of-work algorithms, regardless of mining pool or delivery method, because it targets the algorithm rather than the coin.
  • Detection can happen in real time: samples as short as five seconds already give near-perfect binary classification, so a deployed monitor could raise an alarm within seconds of a process entering its stable mining phase.
  • Zero-day cryptocurrencies are manageable: as long as the new coin's proof-of-work algorithm becomes public before mining begins, a clean signature can be collected and the model retrained.
  • The same signature generalizes across miner programs for the same coin but not across processor models, so profiles are per algorithm and per processor rather than per currency.
  • The authors expect the approach to extend from CPUs to GPUs using GPU event counters such as nvprof, since the underlying principle is event-pattern fingerprinting.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • An implication the authors do not develop is that the same algorithm-level fingerprinting could be used positively: because currency classification reaches about 0.98 accuracy, an operator who detects mining could also identify which coin is being mined and respond accordingly.
  • The profit-maximizer assumption is the boundary of the result; a natural follow-up is to quantify the evasion trade-off curve, measuring how many wasted cycles an attacker must burn to push detection below a given threshold.
  • Since the paper finds no cross-processor transfer, deployments would need per-CPU-model profiling; a testable extension would be whether a small calibration set collected on a new CPU can adapt an existing signature rather than recollecting the full dataset.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper proposes detecting covert cryptocurrency mining by profiling the core proof-of-work (PoW) algorithm with hardware performance counters (HPC), rather than detecting a specific cryptocurrency or a specific delivery mechanism. The authors collect 28 HPC events from 11 cryptocurrency mining programs and 11 benign resource-intensive tasks on two Intel-based laptops, extract 12 statistical features per event, and train Random Forest and SVM classifiers under a 90/10 stratified split repeated ten times. They report near-perfect binary classification, high-accuracy currency classification, and useful results for sample lengths as short as 5 seconds, and they make the dataset and code publicly available.

Significance. If the claimed generality holds, the approach is a useful low-overhead complement to existing cryptojacking detectors, and the focus on PoW algorithms rather than individual currencies is a sensible design choice that supports adaptation to new cryptocurrencies. The evaluation is methodologically careful in several ways: train/test separation is respected, feature scaling and selection are fit on the training set only, ten repeated runs with confidence intervals are reported, and an unseen-miner experiment tests transfer across mining programs. The public release of data and code is a definite strength. However, the experiments cover only standalone native CPU miner processes, so the paper's core claim that the solution is 'not tailored to a specific cryptocurrency or a particular form of cryptomining' is broader than the evidence supports.

major comments (3)
  1. [Section 3.2, Section 4.6, Algorithm 1] The training and test data for the positive class consist exclusively of standalone miner binaries profiled in a clean, stable stage with system restarts between samples. Browser-based cryptomining, which the Introduction explicitly identifies as a major covert-mining vector, executes the PoW loop inside a browser renderer process, so per-process HPC profiling captures a mixture of browser, JIT, and mining activity rather than the clean PoW signature used for training. Section 5.3 discusses process selection but assumes that the mining process can be isolated; it does not address the case where the monitored process is intrinsically mixed. Consequently, the Abstract's 'near-perfect' claim and Section 1's statement that the solution is 'not tailored to ... a particular form of cryptomining' are not supported for browser-based or process-injected mining. The authors should either add experiments with browser-based (e.g., WebAssembly) miners and with mining code injected into a benign host process, or explicitly restrict the claims to standalone native mining processes.
  2. [Section 3.1, Section 5.4] The clean-signature assumption rests on the stated assumption that 'the attacker wants to maximize the profit and does not want to lose the computation cycles (hashing rate).' The paper acknowledges in Section 5.4 that restricted mining—interleaving arbitrary operations with the PoW loop—can change the HPC footprint, but it is dismissed only by an appeal to profitability. This is a threat-model limitation, not a demonstrated robustness property. The paper should state clearly that detection is guaranteed only for profit-maximizing miners that run the unmodified PoW algorithm, and should report any experiments or bounds on how much dilution the classifier tolerates; otherwise the practical deployment claims in the Abstract are too strong.
  3. [Section 4.6 (cross-platform paragraph)] The cross-platform paragraph asserts without quantitative results that a profile of an algorithm on one processor is 'not useful' for classifying samples from another processor. This is a load-bearing limitation for a system intended for real-world deployment across diverse machines, since the proposed remedy in Section 5.2 is to profile every available CPU/GPU. The claim should be backed by the actual accuracy/CI numbers for cross-processor classification, or explicitly presented as preliminary rather than as an evaluated finding.
minor comments (5)
  1. [Table 2] The symbols in Table 2 render poorly in the provided text; please ensure the table formatting clearly distinguishes mined from non-mined cryptocurrencies for each pool.
  2. [Figure 1] The y-axis labels such as '0x107' and '10x107' appear to be formatting artifacts; they should be rendered as 10^7, and axis captions should be made unambiguous.
  3. [Section 4.5] The feature-relevance experiment says features are sorted in ascending order of importance and the first-Ψ% are selected, yet the discussion says 'including important features further improves the classification.' If the lowest-importance features are selected first, the interpretation is confusing; please clarify whether Ψ% refers to the top or bottom of the ranked list.
  4. [Section 4.6] The notation X-Y for unseen miner experiments is defined only in the prose after the table; please move the definition of α, β, and γ into the table caption for readability.
  5. [Section 5.2 and Section 6] Section 5.2 mentions profiling GPUs, but all experiments are CPU-only and Section 6 explicitly defers GPUs to future work; please align the scalability discussion with the evaluated scope.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity found: supervised HPC mining detection is evaluated on held-out test partitions; no prediction reduces to a fitted input or self-citation.

full rationale

This paper is an empirical machine-learning study rather than a derivation. The claimed result is that HPC event streams from core proof-of-work algorithms yield near-perfect binary and currency classification on held-out data. The evaluation pipeline (Section 3.4, Algorithm 1) uses a 90/10 stratified train-test split, fits the scaler and feature-selection on the training set only, and reports metrics on the test set (Section 4). Hence the reported accuracy is not a re-statement of the training fit and is not circular by construction. The unseen-miner experiment (Section 4.6) further trains on one BTC miner and tests on another, which is a genuine generalization test, not a renamed input. The only self-citation is the authors' prior magnetic side-channel paper [33], which appears solely in the related-work paragraph and is not used as evidence for any claim in this paper; therefore it is not load-bearing. The profit-maximizing adversary assumption in Section 3.1 and the acknowledged restricted-mining evasion in Section 5.4 are explicit assumptions and limitations about deployment scope, not circular reductions. Likewise, the claim that the solution can adapt to zero-day cryptocurrencies is an argued extrapolation in Section 5.1, not a fitted input called a prediction. Concerns about browser-based or process-injected miners being absent from the training distribution are scope/generality risks, not circularity. Accordingly, the circularity score is 0.

Assumptions & free parameters 0 free parameters · 4 assumptions · 0 invented entities

No scientific free parameters beyond standard ML hyperparameters are introduced; the number of HPC events (28) and statistical features (12) are fixed experimental choices rather than fitted values. Hyperparameters are selected via cross-validation. No new physical entities are postulated.

assumptions (4)
  • domain assumption HPC event counts provide a stable, distinguishable signature for each proof-of-work algorithm.
    The central idea of Section 3.1 is that each PoW algorithm affects specific hardware events more than others, producing a repeatable signature.
  • ad hoc to paper An attacker maximizes profit and will not sacrifice hashrate to evade detection.
    Stated in Section 3.1: 'we make a practical assumption that the attacker wants to maximize the profit and does not want to lose the computation cycles (hashing rate).' This rules out obfuscation strategies.
  • domain assumption The perf tool can profile per-process HPC events in user-mode without root privileges.
    Section 3.2 states 'All miner programs and the perf tool were launched in user-mode' and relies on per-process PID profiling.
  • domain assumption The eleven selected non-mining tasks represent the diversity of benign workloads on a typical user machine.
    Section 3.2 lists eleven representative tasks; the near-perfect binary accuracy is measured against this fixed set, so real-world generalization depends on this representativeness.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Detecting Covert Cryptomining using HPC." pith.science (2026). https://pith.science/paper/JEVM5JBY

@misc{pith2026190900268,
  author       = {Pith},
  title        = {Pith review of: Detecting Covert Cryptomining using HPC},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/JEVM5JBY}},
  note         = {Machine review of arXiv:1909.00268}
}
read the original abstract

Cybercriminals have been exploiting cryptocurrencies to commit various unique financial frauds. Covert cryptomining - which is defined as an unauthorized harnessing of victims' computational resources to mine cryptocurrencies - is one of the prevalent ways nowadays used by cybercriminals to earn financial benefits. Such exploitation of resources causes financial losses to the victims. In this paper, we present our novel and efficient approach to detect covert cryptomining. Our solution is a generic solution that, unlike currently available solutions to detect covert cryptomining, is not tailored to a specific cryptocurrency or a particular form of cryptomining. In particular, we focus on the core mining algorithms and utilize Hardware Performance Counters (HPC) to create clean signatures that grasp the execution pattern of these algorithms on a processor. We built a complete implementation of our solution employing advanced machine learning techniques. We evaluated our methodology on two different processors through an exhaustive set of experiments. In our experiments, we considered all the cryptocurrencies mined by the top-10 mining pools, which collectively represent the largest share (84% during Q3 2018) of the cryptomining market. Our results show that our classifier can achieve a near-perfect classification with samples of length as low as five seconds. Due to its robust and practical design, our solution can even adapt to zero-day cryptocurrencies. Finally, we believe our solution is scalable and can be deployed to tackle the uprising problem of covert cryptomining.

Figures

Figures reproduced from arXiv: 1909.00268 by the authors.

Figure 1
Figure 1. A representative example of variation in [PITH_FULL_IMAGE:figures/full_fig_p005_1.png] view at source ↗
Figure 2
Figure 2. Confusion matrix for classification among various cryptocurrencies [PITH_FULL_IMAGE:figures/full_fig_p012_2.png] view at source ↗
Figure 3
Figure 3. F1 score for different sample lengths (whiskers represent margin of error) As explained in Section 3.1, the task of mining is to repeatedly execute the core PoW algorithm. Hence, even samples of shorter length can grasp the signature. As shown in [PITH_FULL_IMAGE:figures/full_fig_p013_3.png] view at source ↗
Figures from the paper (1 more)
Figure 4
Figure 4. Figure 4: F1 score for first-Ψ% features (whiskers represent margin of error) [PITH_FULL_IMAGE:figures/full_fig_p013_4.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

48 extracted references · 48 canonical work pages

  1. [1]

    Coinhive

    “Coinhive”. https://tinyurl.com/ybsy89k2

    work page

  2. [2]

    CoinMarketCap

    “CoinMarketCap”. https://tinyurl.com/o94fhlw

    work page

  3. [3]

    Crypto-Loot

    “Crypto-Loot”. https://tinyurl.com/y76ppd5g

    work page

  4. [4]

    The nvprof tool

    “The nvprof tool”. https://tinyurl.com/y8tqxn74

    work page

  5. [5]

    The perf tool

    “The perf tool”. https://tinyurl.com/ybpmxw8

    work page

  6. [6]

    The stress-ng tool

    “The stress-ng tool”. https://tinyurl.com/my6ehnj

    work page

  7. [7]

    An Italian Bank’s Server was Hijacked to Mine Bitcoin

    “An Italian Bank’s Server was Hijacked to Mine Bitcoin”. https:// tinyurl.com/yac8c8jq (2017)

    work page 2017

  8. [8]

    Persistent Drive-by Cryptomining Coming to a Browser Near You

    “Persistent Drive-by Cryptomining Coming to a Browser Near You”. https://tinyurl.com/yd5roadb (2017)

    work page 2017

Show all 48 references
  1. [9]

    https://tinyurl.com/y8w5yj9l (2018)

    Bitcoin Energy Consumption Index. https://tinyurl.com/y8w5yj9l (2018)

    2018

  2. [10]

    Cryptojacking: A Modern Cash Cow

    “Cryptojacking: A Modern Cash Cow”. https://tinyurl.com/y28eqdav (2018)

    2018

  3. [11]

    Cryptojacking Attack Found on Los Angeles Times Website

    “Cryptojacking Attack Found on Los Angeles Times Website”. https:// tinyurl.com/y8ghcvmd (2018)

    2018

  4. [12]

    https://tinyurl.com/yd2zja9q (2018)

    FacexWorm Targets Cryptocurrency Trading Platforms, Abuses Facebook Messenger for Propagation. https://tinyurl.com/yd2zja9q (2018)

    2018

  5. [13]

    Greedy Cybercriminals Host Malware on GitHub

    “Greedy Cybercriminals Host Malware on GitHub”. https: //tinyurl.com/y9qon8ch (2018)

    2018

  6. [14]

    Is Bitcoin Mining Profitable or Worth it in 2018?

    “Is Bitcoin Mining Profitable or Worth it in 2018?”. https://tinyurl.com/ ybnydb8g (2018)

    2018

  7. [15]

    KSN Report: Ransomware and Malicious Cryptominers 2016-2018

    “KSN Report: Ransomware and Malicious Cryptominers 2016-2018”. https://tinyurl.com/y29kybtx (2018)

    2018

  8. [16]

    Revenues Down, Hashrates Up: 2018 Mining Outlook By The Numbers

    “Revenues Down, Hashrates Up: 2018 Mining Outlook By The Numbers”. https://tinyurl.com/yc586s9v (2018)

    2018

  9. [17]

    rTorrent Client Exploited in the Wild to Deploy Monero Crypto-miner

    “rTorrent Client Exploited in the Wild to Deploy Monero Crypto-miner”. https://tinyurl.com/yaqy7u3k (2018)

    2018

  10. [18]

    Tesla Hackers Hijacked Amazon Cloud Account to Mine Cryptocurrency

    “Tesla Hackers Hijacked Amazon Cloud Account to Mine Cryptocurrency”. https://tinyurl.com/y9epv3do (2018)

    2018

  11. [19]

    Thousands of Websites Hijacked by Hidden Crypto-mining Code after Popular Plug-in Pwned

    UK ICO, USCourts.gov... Thousands of Websites Hijacked by Hidden Crypto-mining Code after Popular Plug-in Pwned. https://tinyurl.com/ y7upaxgv (2018)

    2018

  12. [20]

    WebCobra Malware Uses Victims’ Computers to Mine Cryptocurrency

    “WebCobra Malware Uses Victims’ Computers to Mine Cryptocurrency”. https://tinyurl.com/ycuhowb3 (2018)

    2018

  13. [21]

    Bitcoin Mining Pools

    “Bitcoin Mining Pools”. https://tinyurl.com/y8pdk922 (2019)

    2019

  14. [22]

    Feature Importances with Forests of Trees

    “Feature Importances with Forests of Trees”. https://tinyurl.com/ y3nlad2h (2019)

    2019

  15. [23]

    IBM X-Force Threat Intelligence Index

    “IBM X-Force Threat Intelligence Index”. https://tinyurl.com/y5nbprve (2019)

    2019

  16. [24]

    SonicWall Cyber Threat Report

    “SonicWall Cyber Threat Report”. https://tinyurl.com/y3wj69s7 (2019) 18 A. Gangwal et al

    2019

  17. [25]

    Under the Hood of Cyber Crime

    “Under the Hood of Cyber Crime”. https://tinyurl.com/ydhauj8x (2019)

    2019

  18. [26]

    In: 36th IEEE S&P

    Bonneau, J., et al.: SoK: Research Perspectives and Challenges for Bitcoin and Cryptocurrencies. In: 36th IEEE S&P. pp. 104–121 (2015)

    2015

  19. [27]

    : Real-time Detection of Cache-based Side-channel Attacks using Hardware Performance Counters

    Chiappetta, M., et al. : Real-time Detection of Cache-based Side-channel Attacks using Hardware Performance Counters. Elsevier Applied Soft Com- puting 49, 1162–1174 (2016)

    2016

  20. [28]

    https: //tinyurl.com/y8eos9pl (2018)

    Comodo Cybersecurity: Global Threat Report Q2 2018 Edition. https: //tinyurl.com/y8eos9pl (2018)

    2018

  21. [29]

    Elsevier Computers & Security 79, 162–189 (2018)

    Conti, M., et al.: On the Economic Significance of Ransomware Campaigns: A Bitcoin Transactions Perspective. Elsevier Computers & Security 79, 162–189 (2018)

    2018

  22. [30]

    Machine Learning 20(3), 273–297 (1995)

    Cortes, C., Vapnik, V.: Support Vector Networks. Machine Learning 20(3), 273–297 (1995)

    1995

  23. [31]

    https://tinyurl.com/yco7cykl (2018)

    Cyber Threat Alliance (CTA): The Illicit Cryptocurrency Mining Threat Report. https://tinyurl.com/yco7cykl (2018)

    2018

  24. [32]

    : On the Feasibility of Online Malware Detection with Performance Counters

    Demme, J., et al. : On the Feasibility of Online Malware Detection with Performance Counters. In: 40th ISCA. pp. 559–570 (2013)

    2013

  25. [33]

    IEEE Transactions on Information Forensics and Security 15(1), 1630–1639 (2019)

    Gangwal, A., Conti, M.: Cryptomining cannot Change its Spots: Detecting Covert Cryptomining using Magnetic Side-channel. IEEE Transactions on Information Forensics and Security 15(1), 1630–1639 (2019)

    2019

  26. [34]

    In: 3rd ICDAR

    Ho, T.K.: Random Decision Forests. In: 3rd ICDAR. pp. 278–282 (1995)

    1995

  27. [35]

    Hsu, C.W., et al.: A practical guide to support vector classification. Tech. rep. (2003)

    2003

  28. [36]

    In: 21st NDSS

    Huang, D.Y., et al.: Botcoin: Monetizing Stolen Cycles. In: 21st NDSS. pp. 1–16 (2014)

    2014

  29. [37]

    In: 25th ACM CCS (2018)

    Konoth, R.K., et al.: MineSweeper: An In-depth Look into Drive-by Crypto- currency Mining and Its Defense. In: 25th ACM CCS (2018)

    2018

  30. [38]

    In: 3rd IEEE DSC

    Liu, J., et al.: A Novel Approach for Detecting Browser-based Silent Miner. In: 3rd IEEE DSC. pp. 490–497 (2018)

    2018

  31. [39]

    : Bitcoin Emissions Alone could Push Global Warming above 2 ◦C

    Mora, C., et al. : Bitcoin Emissions Alone could Push Global Warming above 2 ◦C. Nature Climate Change 8(11), 931–933 (2018)

    2018

  32. [40]

    https:// tinyurl.com/3f4a6lr (2008)

    Nakamoto, S.: Bitcoin: A Peer-to-Peer Electronic Cash System. https:// tinyurl.com/3f4a6lr (2008)

    2008

  33. [41]

    In: 13th ARES

    Rauchberger, J., et al.: The Other Side of the Coin: A Framework for De- tecting and Analyzing Web-based Cryptocurrency Mining Campaigns. In: 13th ARES. pp. 1–10 (2018)

    2018

  34. [42]

    arXiv preprint: 1808.00811 (2018)

    R¨ uth, J.,et al.: Digging into Browser-based Crypto Mining. arXiv preprint: 1808.00811 (2018)

    2018 arXiv

  35. [43]

    In: 20th RAID

    Tahir, R., et al.: Mining on Someone Else’s Dime: Mitigating Covert Mining Operations in Clouds and Enterprises. In: 20th RAID. pp. 287–310 (2017)

    2017

  36. [44]

    In: 23rd ESORICS

    Wang, W., et al.: SEISMIC: SEcure In-lined Script Monitors for Interrupt- ing Cryptojacks. In: 23rd ESORICS. pp. 1–20 (2018)

    2018

  37. [45]

    : ConFirm: Detecting Firmware Modifications in Embed- ded Systems using Hardware Performance Counters

    Wang, X., et al. : ConFirm: Detecting Firmware Modifications in Embed- ded Systems using Hardware Performance Counters. In: 34th IEEE/ACM ICCAD. pp. 544–551 (2015) Detecting Covert Cryptomining using HPC 19

    2015

  38. [46]

    : Hardware Performance Counter-Based Malware Identi- fication and Detection with Adaptive Compressive Sensing

    Wang, X., et al. : Hardware Performance Counter-Based Malware Identi- fication and Detection with Adaptive Compressive Sensing. ACM TACO 13(1), 1–23 (2016)

    2016

  39. [47]

    In: 50th DAC

    Wang, X., Karri, R.: Numchecker: Detecting Kernel Control-flow Modifying Rootkits by using Hardware Performance Counters. In: 50th DAC. pp. 1–7 (2013)

    2013

  40. [48]

    In: 2nd ACM SIGOPS APSys

    Yuan, L., et al.: Security Breaches as PMU Deviation: Detecting and Identi- fying Security Attacks using Performance Counters. In: 2nd ACM SIGOPS APSys. pp. 1–6 (2011) Appendix A Validated hyper-parameters The validated hyper-parameters for RF and SVM are shown in Table A.1 an...

    2011

Pith tools

Reviewed August 14, 2026 · model on record in the stance chip above.