22nd Conference on Detection of Intrusions and Malware & Vulnerability Assessment (DIMVA '25)
July 9 to 11, 2025 at Graz University of Technology, Austria
Follow us on Mastodon Follow us on X/Twitter Follow us on BlueskyConference Program
Wednesday, July 9: Day 0
Welcome event: Graz city tour
On this walking tour, we'll explore the old town of Graz. This is a great opportunity to get to know the other conference attendees and to walk off any travel fatigue.Welcome dinner @ Gösser Bräu
Thursday, July 10: Day 1 @ TU Graz Main Building Aula
Chair's welcome to DIMVA'25
Session 1: Web Security
ScamFerret: Detecting Scam Websites Autonomously with Large Language Models by Hiroki Nakano, Takashi Koide, Daiki Chiba (NTT Security Holdings Corporation & NTT Corporation)
Domain Name Encryption Does Not Ensure Privacy: Website Fingerprinting Attack With Only a Few Samples Using Siamese Network by Asaf Shabtai, Neriya Mazuz (Ben Gurion University of the Negev)
Making (Only) the Right Calls: Preventing Remote Code Execution Attacks in PHP Applications with Contextual, State-Sensitive System Call Filtering by Yunsen Lei, Craig A. Shue (Worcester Polytechnic Institute)
Session 2: Vulnerability Detection
Sourcerer: channeling the void by Nicolas Badoux (EPFL); Flavio Toffalini (RUB); Mathias Payer (EPFL)
CodeGrafter: Unifying Source and Binary Graphs for Robust Vulnerability Detection by Saquib Irtiza, Mahmoud Zamani, Shamila Wickramasuriya, Kevin Hamlen, Latifur Khan (University of Texas at Dallas)
SyzFroge:An Automated System Call Specification Generation Process for Efficient Kernel Fuzzing by ZhiZhuo Tang (Information Engineering University); Jian Lin, Weiyu Dong (State Key Laboratory of Mathematical Engineering and Advanced Computing); Tieming Liu (Information Engineering University)
Early and Small Lunch
We will have a chocolate tasting and all-you-can-eat running chocolate in the afternoon, followed by a full dinner in the evening. Keeping it very light for lunch is essential to stand a chance against all the chocolate tasting stations.
Session 3: Side Channels
Reverse-Engineering the Address Translation Caches by Philipp Ertmer (Ruhr University Bochum); Robert Dumitru (Ruhr University Bochum and The University of Adelaide); Yuval Yarom (Ruhr University Bochum)
The HMB Timing Side Channel: Exploiting the SSD's Host Memory Buffer by Jonas Juffinger, Hannes Weissteiner, Thomas Steinbauer, Daniel Gruss (Graz University of Technology)
Cohere+Reload: Re-enabling High-Resolution Cache Attacks on AMD SEV-SNP by Lukas Giner, Sudheendra Raghav Neela, Daniel Gruss (Graz University of Technology)
Session 4: Obfuscation
Experimental Study of Binary Diffing Resilience on Obfuscated Programs by Roxane Cohen (Quarkslab, LAMSADE, Paris-Dauphine University - PSL); Robin David, Riccardo Mori (Quarkslab); Florian Yger (LITIS, INSA Rouen Normandy); Fabrice Rossi (CEREMADE, CNRS, Université Paris-Dauphine - PSL)
Quantifying and Mitigating the Impact of Obfuscations on Machine-Learning-Based Decompilation Improvement by Luke Dramko (Carnegie Mellon University); Deniz Boloni-Turgut (Cornell University); Claire Le Goues, Edward Schwartz (Carnegie Mellon University)
Exploring the Potential of LLMs for Code Deobfuscation by David Beste (CISPA Helmholtz Center for Information Security); Grégoire Menguy (Université Paris-Saclay, CEA, List); Hossein Hajipour, Mario Fritz (CISPA Helmholtz Center for Information Security); Antonio Emanuele Cinà (University of Genoa); Sébastien Bardin (CEA List, Université Paris Saclay); Thorsten Holz (CISPA Helmholtz Center for Information Security); Thorsten Eisenhofer (BIFOLD & TU Berlin); Lea Schönherr (CISPA Helmholtz Center for Information Security)
Bus Departure to Social Event, Poster Session, and Dinner
Social event: Zotter Chocolate Factory Tour and Edible Zoo
We'll take a sweet and immersive tour through the Zotter Chocolate Factory, one of the most creative and sustainable chocolate producers worldwide. You'll get an inside look at the entire process from bean to bar and enjoy numerous (more than you can eat!) tasting stations. If you haven't had enough, after the tour there's a running chocolate all-you-can-eat included. For those who already had enough of chocolate, Zotter's edible zoo invites for a nice walk and non-chocolate snacks, if you like. Please don't overeat - dinner is afterwards.
Poster Session
GREED: Practical Symbolic Execution for Ethereum Smart Contracts by Nicola Ruaro, Fabio Gritti, Robert McLaughlin, Dongyu Meng, Ilya Grishchenko, Christopher Kruegel, Giovanni Vigna
Referencing your Privileges - A Data-Only Exploit Technique for the Windows Kernel by Nicola Stauffer, Gürkan Gür
Generating the WEB-IDS23 Dataset by Eric Lanfer, Dominik Brockmann, Nils Aschenbruck
Machine Learning for Vulnerability Detection as Target Oracle in Automated Fuzz Driver Generation by Gianpietro Castiglione, Marcello Maugeri, Giampaolo Bella
Extracting Cryptographic Keys from Windows Live Processes by León Abascal, Ricardo J. Rodríguez
All Right Then, (Don't) Keep Your Secrets: Exposing API Hashing in Malware by Nicola Bottura, Giorgia Di Pietro, Yuya Yamada, Daniele Cono D'Elia, Leonardo Querzoni
Exploring the Zero-Shot Potential of Large Language Models for Detecting Algorithmically Generated Domains by Tomás Pelayo-Benedet, Ricardo J. Rodríguez, Carlos H. Gañán
Using Machine Learning to Infer Network Structure from Security Metadata by Asfa Khalid, Seán Óg Murphy, Cormac Sreenan, Utz Roedig
SPECK: From Google Textual Guidelines to Automatic Detection of Android Apps Vulnerabilities by Roberto Rossini, Simeone Pizzi, Samuele Doria, Mauro Conti, Eleonora Losiouk
On the Usage of Kernel Shadow Stacks for User-Level Programs by Marco Calavaro, Pasquale Caporaso, Luca Capotombolo, Giuseppe Bianchi, Francesco Quaglia
Building Confidence in Hardware-based Ransomware Detection through Hardware Performance Counter Event Correlation by Ryan Binder, Joshua Byun, Dane Brown, Owens Walker, Jennie Hill
FedBlockParadox - A Framework for Simulating and Securing Decentralized Federated Learning by Gabriele Digregorio, Francesco Bleggi, Federico Caroli, Michele Carminati, Stefano Zanero, Stefano Longari
Dinner at the Nagl-Hiebaum Buschenschank (a traditional Styrian vineyard tavern)
We'll have a cozy and traditional Styrian/Austrian Buschenschank-dinner experience. A Buschenschank is a vineyard tavern, which only serves their own wine, juice, and food, with ingredients almost entirely from their own production or the same or neighboring villages. Vegetarian and vegan options are available.
Bus Return to TU Graz
Friday, July 11: Day 2 @ TU Graz Main Building Aula
Keynote
Women, Underrepresented and Allies Meetup
Session 5: OS & Network
More Than You Signed Up For: Exposing Gaps in the Validation of Android's App Signing by Norah Ridley, Enrico Branca, Natalia Stakhanova (University of Saskatchewan)
Red Light for Security: Uncovering Feature Check and Access Control Gaps in AAOS by Jumana, Parjanya Vyas, Yousra Aafer (University of Waterloo)
An Empirical Study of Multi-Language Security Patches in Open Source Software by Shiyu Sun, Yunlong Xing (George Mason University); Grant Zou (University of Virginia); Xinda Wang (University of Texas at Dallas); Kun Sun (George Mason University)
Approach for the Optimization of Machine Learning Models for Calculating Binary Function Similarity by Suguru Horimoto (National Police Agency of Japan), Keane Lucas (Carnegie Mellon University), and Lujo Bauer (Carnegie Mellon University)
Session 6: Android & Patches
Linux hurt itself in its confusion! Exploiting Out-of-Memory Killer for Confusion Attacks via Heuristic Manipulation by Lorenzo Bossi, Daniele Mammone, Michele Carminati, Stefano Zanero, Stefano Longari (Politecnico di Milano)
Overlapping data in network protocols: bridging OS and NIDS reassembly gap by Lucas Aubard (Inria); Johan Mazel (ANSSI); Gilles Guette (IMT Atlantique); Pierre Chifflier (ANSSI)
Taming the Linux Memory Allocator for Rapid Prototyping by Ruiyi Zhang, Tristan Hornetz, Lukas Gerlach, Michael Schwarz (CISPA Helmholtz Center for Information Security)
Lunch
Session 7: AI/ML & Security
Hiding in Plain Sight: On the Robustness of AI-generated code detection by Sina Pordanesh, Sufiyan Bukhari, Benjamin Tan, Lorenzo De Carli (University of Calgary)
FlexGE: Towards Secure and Flexible Model Partition for Deep Neural Networks by Xiaolong Wu, Aravind Machiry, Yung-Hsiang Lu, Dave (Jing) Tian (Purdue University)
Towards Explainable Drift Detection and Early Retrain in ML-based Malware Detection Pipelines by Jayesh Tripathi (Texas A&M University); Heitor Gomes (Victoria University of Wellington); Marcus Botacin (Texas A&M University)
InferONNX: Practical and Privacy-preserving Machine Learning Inference using Trusted Execution Environments by Konstantina Papafragkaki (Institute of Computer Science, Foundation for Research and Technology - Hellas, Greece); Giorgos Vasiliadis (Hellenic Mediterranean University and FORTH)
Session 8: Resilient Systems
FAULTLESS: Flexible and Transparent Fault Protection for Superscalar RISC-V Processors by Moritz Waser (Graz University of Technology,Graz); David Schrammel, Robert Schilling (Rivos Inc.); Stefan Mangard (Graz University of Technology)
A History of Avarice: Practical Symbolic Execution for Ethereum Smart Contracts by Nicola Ruaro, Fabio Gritti (UC Santa Barbara); Robert McLaughlin (University of California, Santa Barbara); Dongyu Meng (UC Santa Barbara); Ilya Grishchenko (Univerity of California, Santa Barbara); Christopher Kruegel (UC Santa Barbara and Cisco); Giovanni Vigna (UC Santa Barbara and Broadcom)
PackHero: A Scalable Graph-based Approach for Efficient Packer Identification by Marco Di Gennaro, Mario D'Onghia, Mario Polino, Stefano Zanero, Michele Carminati (Politecnico di Milano)
Closing notes and good bye
Registration
Registration will be open until July 1, 23:59.
At least one Member or Regular fee must be paid for each accepted paper. Papers without registered author(s) will be withdrawn from the program.
All registration fee includes admission to all DIMVA 2025 sessions, selected meals and welcome reception, dinner and social event throughout the official event July 9 – July 11. You will be charged in EUR as stated below.
Please note: On-site registration is not possible!
Requests for cancellation and refunds must be received no later than July, 1, 2025. No refunds will be processed after this date.
The registration does not include the accommodation - please book your accommodation separately.
Ticket | Normal | Late (starting June 7th till July 1st) |
---|---|---|
Regular | 340 | 390 |
GI members and other scientific organization members | 260 | 310 |
B.Sc./M.Sc. Student | 270 | 320 |
The student ticket is available for Bachelor and Master students only!
Please register for the conference here.
Please also have a look at our terms of participation and our privacy notice.
Reach out to dimva2025.isec@tugraz.at if you have questions.
Call for Papers
Important Dates (AoE)
Cycle 1:- Submission:
Dec 4, 2024Dec 10, 2024 (extended!) - Notification (accept/reject):
Jan 22, 2025Jan 27, 2025 (extended!) - Submission Site: https://dimva25.hotcrp.com/
- Submission:
- Cycle 2:
- Submission:
Feb 12, 2024Feb 19, 2024 (extended!) - Notification (accept/reject): Wed. Apr 2, 2025
- Submission Site: https://dimva25r2.hotcrp.com/
- Submission:
- Camera ready deadline: Apr 30, 2025
- Conference: July 9 to 11, 2025
General Information
The annual DIMVA conference serves as a premier forum for advancing the state of the art in the broader areas of intrusion detection, malware analysis, and vulnerability assessment. Each year, DIMVA brings together international experts from academia, industry, and government to present and discuss novel research in these areas. DIMVA is organized by the special interest group Security - Intrusion Detection and Response (SIDAR) of the German Informatics Society (GI). The conference proceedings will appear in the Springer Lecture Notes in Computer Science (LNCS) series.
Topics of Interest
DIMVA solicits submissions of high-quality, original scientific papers presenting novel research on malware analysis, intrusion detection, vulnerability assessment, and related systems security topics.
Topics of interest include, but are not limited to:
Intrusions
- Novel approaches and domains
- Insider detection
- Prevention and response
- Data leakage, exfiltration, and poisoning
- Result correlation and cooperation
- Evasion and other attacks
- Potentials and limitation
- Operational experiences
- Privacy, legal, and social aspects
- Targeted attacks
- Analysis or detection of cryptocurrency heists
Malware
- Automated analyses
- Behavioral models
- Prevention and containment
- Classification
- Lineage
- Forensics and recovery
- Underground economy
- Vulnerabilities in malware
- Financially targeted malware (e.g., ransomware, DeFi)
Vulnerability detection
- Vulnerability prevention
- Vulnerability analysis
- Exploitation and defenses
- Hardware vulnerabilities
- Situational awareness
- Active probing
- Vulnerabilities in decentralized systems
Papers will be judged on novelty, significance, correctness, and clarity. We expect all papers to provide enough details to enable reproducibility of the experimental results. We encourage papers that bridge research in different communities. We also welcome experience papers that clearly articulate lessons learnt.
Types of Submissions Solicited
We invite full papers for submission that present novel and mature research results. Full papers are limited to 20 pages in Springer LNCS format, including bibliography and appendices.
Papers that do not follow these formatting guidelines may be rejected without review.
While we do not accept short papers, we encourage authors to submit a poster instead, presenting original, still ongoing work that has not yet reached the maturity required for a full paper. For more information, please refer to the Call for Posters.
Submission Guidelines
DIMVA 2025 will adopt a double-blind reviewing process. All submissions should be appropriately anonymized. Author names and affiliations must be excluded from the paper. Furthermore, authors should avoid obvious self-references, and should cite their own previous work in third person, whenever necessary. Papers that are not properly anonymized risk being rejected without review.
Submissions must be original work and may not be under submission to another venue at the time of review. At least one author of each accepted paper is required to physically present the submitted work at the conference, for the paper to be included in the proceedings.
Authors are encouraged to submit code appropriately anonymized, using, e.g., https://anonymous.4open.science/.
Ethical considerations
Submissions that report experiments with data gathered from human subjects should disclose whether the research received approval from an institutional ethics review board (IRB), if applicable, and what measures were adopted to minimize risks to privacy.
Submissions that describe experiments related to vulnerabilities in software or systems should discuss the steps taken to avoid negatively affecting any third-parties (e.g., in case of probing of network devices), and how the authors plan to responsibly disclose the vulnerabilities to the appropriate software or system vendors or owners before publication.
If you have any questions, please contact the program chairs at pc-chairs@dimva.org.
Call for Posters
Important Dates (AoE)
- Submission: up to
April 11thApril 18th, 2025 - Notification: April 21st, 2025
- Camera-ready: April 30th, 2025
Submission Guidelines
Committee
Program co-chairs (email: pc-chairs@dimva.org)
- Manuel Egele (Boston University)
- Veelasha Moonsamy (Ruhr University Bochum)
Program committee
- Advait Patel, Broadcom
- Amin Kharraz, Florida International University
- Andrea Continella, University of Twente
- Andrea Lanzi, University of Milan
- Andrea Mambretti, IBM Research Europe - Zurich
- Anita Nikolich, University of Illinois-Urbana Champaign
- Bart Coppens, Ghent University
- Behzad Ousat, Florida International University
- Daniel Gruss, Graz University of Technology
- Daniel Plohmann, Fraunhofer FKIE
- Daniele Antonioli, EURECOM
- Daniele Cono D'Elia, Sapienza University of Rome
- David Klein, Technische Universität Braunschweig
- Eleonora Losiouk, University of Padua
- Emilio Coppa, LUISS University
- Fabio Pagani, Binarly
- Fabio Pierazzi, King's College London
- Flavio Toffalini, RUB
- Hervé Debar, Télécom SudParis
- Ilya Grishchenko, University of California, Santa Barbara
- Jan Wichelmann, Universität zu Lübeck
- Johanna Ullrich, University of Vienna
- Johannes Kinder, LMU Munich
- Juan Caballero, IMDEA Software Institute
- Juan Tapiador, Universidad Carlos III de Madrid
- Kaan Onarlioglu, Akamai
- Kimberly Tam, University of Plymouth / Alan Turing Institute
- Konrad Rieck, TU Berlin
- Mannat Kaur, Max-Planck-Institute for Informatics
- Manuel Egele, Boston University
- Marco Cova, VMware
- Martina Lindorfer, TU Wien
- Mathias Fischer, University of Hamburg
- Michael Meier, University of Bonn and Fraunhofer FKIE
- Michael Schwarz, CISPA Helmholtz Center for Information Security
- Michalis Polychronakis, Stony Brook University
- Michele Carminati, Politecnico di Milano
- Moritz Schloegel, CISPA Helmholtz Center for Information Security
- Prashast Srivastava, Columbia University
- Ricardo J. Rodríguez, Universidad de Zaragoza (Spain)
- Roland Yap, National University of Singapore
- Seungwon Shin, KAIST
- Silvia Sebastián, CISPA
- Simon Koch, TU Braunschweig
- Stefano Zanero, Politecnico di Milano
- Stijn Volckaert, DistriNet, KU Leuven
- Sven Dietrich, City University of New York
- Tapti Palit, UC Davis
- Tiago Heinrich, Max-Planck-Institut für Informatik
- Urko Zurutuza, Mondragon Unibertsitatea
- Vasileios Kemerlis, Brown University
- Vasilios Mavroudis, Alan Turing Institute
- Veelasha Moonsamy, Ruhr University Bochum
- Vera Rimmer, DistriNet, KU Leuven
- Vinod Yegneswaran, SRI
- Yang Zhang, CISPA
- Yinzhi Cao, Johns Hopkins University
Publication chair
- Michele Carminati
Poster co-chairs
- Tarini Saka
- Flavio Toffalini
General chair
- Daniel Gruss (Graz University of Technology)
Steering committee
- Ulrich Flegel (co-chair)
- Michael Meier (co-chair)
- Magnus Almgren
- Sébastien Bardin
- Leyla Bilge
- Gregory Blanc
- Herbert Bos
- Danilo M. Bruschi
- Roland Bueschkes
- Juan Caballero
- Lorenzo Cavallaro
- Hervé Debar
- Sven Dietrich
- Mathias Fischer
- Giorgio Giacinto
- Cristiano Giuffrida
- Daniel Gruss
- Bernhard Haemmerli
- Thorsten Holz
- Marko Jahnke
- Klaus Julisch
- Christian Kreibich
- Christopher Kruegel
- Pavel Laskov
- Federico Maggi
- Clémentine Maurice
- Nuno Neves
- Roberto Perdisci
- Michalis Polychronakis
- Konrad Rieck
- Jean-Pierre Seifert
- Robin Sommer
- Urko Zurutuza
Venue: Graz University of Technology

DIMVA will be held in the Aula of the historic main building of Graz University of Technology (aka "old campus"), located at Rechbauerstraße 12, 8010 Graz. You can reach it via tram lines 1 or 7 from station "Mayffredygasse" within 3 minutes, via tram line 3 from stations "Mandellstraße" or "Rechbauerstraße" within 3-4 minutes, or via tram line 6 from station "Dietrichsteinplatz" within 8 minutes. Tram lines 1 and 7 also pass the main railway station ("Graz Hauptbahnhof") as well as central point of transfer ("Jakominiplatz"). Navigation via Google Maps works fine in Graz. You can buy tickets via the OEBB website or app, or at the ticket machine inside the trams.
As the campus is located right in the city center, there are many hotels and apartments around so that it is easy to find an accommodation that meets your expectations.
Travel Information
By Plane
If you come by plane, the simplest way to get to the venue is to take a taxi from Graz Airport. The fare is approximately EUR 35 and the journey takes around 30 minutes.
By Train
- Fare: EUR 3,10 to "Graz Hauptbahnhof" (main railway station)
- Duration: Approximately 20 minutes
- Walk: A short (~100 m) walk from the airport to the station is required
- Frequency: Leaves every 30 minutes
- Ticket Options: 1-hour ticket EUR 3,10; 24-hour ticket EUR 6,80 (includes all city trams, buses, and the train to/from the airport)
Hotels
We have blocked room allotments in three hotels within walking distance to our conference location. Please mention the code "DIMVA" when booking. Contact the hotel directly (email/phone) to make your reservation!
Motel One Graz
Jakominiplatz 78010 Graz
res.graz@motel-one.com
www.motel-one.com
Single room: EUR 101,50 per night (price includes breakfast)
Hotel Gollner
Schloegelgasse 148010 Graz
Tel: +43 316 822521 0
office@hotelgollner.com
www.hotelgollner.com
Single room basic: EUR 119 per night
Single room business: EUR 124 per night
Price includes breakfast
Boutique Hotel Dom
Bürgergasse 14, 8010 GrazTel: +43 316/824 800
domhotel@domhotel.co.at
www.domhotel.co.at
Single room: EUR 111,50 per night
Double room for single use: EUR 151,50 per night
Price includes breakfast
Further Hotels
- Hotel Weitzer ****: Grieskai 12-16, 8020 Graz, www.hotelweitzer.com
- Hotel Wiesler ****: Grieskai 4-8, 8020 Graz, www.hotelwiesler.com
- Austria Trend Hotel Europa ****: Bahnhofgürtel 89, 8020 Graz, www.austria-trend.at/Hotel-Europa-Graz
- Das Parkhotel Graz ****: Leonhardstraße 8, 8010 Graz, www.parkhotel-graz.at
- Hotel roomz Graz: Conrad-von-Hötzendorf-Straße 96, 8010 Graz, www.roomz-graz.com
If you mention "TU Graz" upon booking, you should also receive a reduced tariff.
Sponsors
Sponsorship Opportunities
We are looking for a few industry sponsors, primarily to provide them with an opportunity to engage with the participants. This way, we hope to make the local security community more visible to an international audience and create networking opportunities.
We offer three sponsorship levels, each of which includes a ticket for a researcher from the sponsoring company to mingle with attendees or place goodies/swag in the welcome bag that we hand out at check-in.
Sponsorship Benefits
- All sponsors will have their logos displayed on the conference website.
- Sponsors will be acknowledged in the opening remarks.
- Sponsors will be mentioned in the acknowledgments of the conference proceedings.
An early confirmation (or decline) of sponsorship would help us with planning, but we need to know by June at the latest whether sponsorship is possible.
Sponsorship Levels
- Gold: €4000 (includes up to 4 free registrations, the option to have a table in the break area, the option to display a roll-up/poster, and the ability to place swag/goodies in the attendee bags)
- Silver: €3000 (includes up to 3 free registrations, the option to display a roll-up/poster, and the ability to place swag/goodies in the attendee bags)
- Bronze: €2000 (includes up to 2 free registrations, the ability to place swag/goodies in the attendee bags)
- Other individual levels can be arranged.
We are happy to discuss other sponsorship options as well. If you have any questions, feel free to reach out. We look forward to this big and international event in Graz!
Content Responsibility and Admin
Daniel Gruss
Graz University of Technology
Rechbauerstraße 12
8010 Graz, Austria
Telephone: +43 316 873 5544
E-Mail: daniel.gruss@tugraz.at
Privacy Policy
Processing of your personal data when you visit this website
We do not store any personal data about your visit to our project website.
We only process your IP address to the extent necessary for the technical delivery of the web content. In addition to the IP address, your browser - depending on the configuration - also transmits other data, e.g. browser type, browser version, operating system used, referrer URL, which we use for delivering the website optimized for your display. Your personal data will not be processed by us beyond what is necessary for delivering the website and will be directly deleted afterwards.
Cookies
We do not use Cookies.
Server log files
Your access to our website will be logged for a maximum of 7 days in order to be able to analyse any problems.
External resources
All pictures, fonts, and additional resources are retrieved solely from our server, so that your visit to our website does not leave any traces at third parties.