{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,3,19]],"date-time":"2025-03-19T11:22:44Z","timestamp":1742383364031},"publisher-location":"Boston, MA","reference-count":27,"publisher":"Springer US","isbn-type":[{"type":"print","value":"9780387687667"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"DOI":"10.1007\/978-0-387-68768-1_5","type":"book-chapter","created":{"date-parts":[[2007,10,22]],"date-time":"2007-10-22T11:27:09Z","timestamp":1193052429000},"page":"89-116","source":"Crossref","is-referenced-by-count":7,"title":["Towards Sound Detection of Virtual Machines"],"prefix":"10.1007","author":[{"given":"Jason","family":"Franklin","sequence":"first","affiliation":[]},{"given":"Mark","family":"Luk","sequence":"additional","affiliation":[]},{"given":"Jonathan M.","family":"McCune","sequence":"additional","affiliation":[]},{"given":"Arvind","family":"Seshadri","sequence":"additional","affiliation":[]},{"given":"Adrian","family":"Perrig","sequence":"additional","affiliation":[]},{"given":"Leendert van","family":"Doorn","sequence":"additional","affiliation":[]}],"member":"297","reference":[{"key":"5_CR1","doi-asserted-by":"crossref","unstructured":"K. Adams and O. Agesen. A comparison of software and hardware techniques for x86 virtualization. In Proceedings of the ACM Conference on Architectural Support for Programming Languages and Operating Systems, October 2006.","DOI":"10.1145\/1168857.1168860"},{"key":"5_CR2","doi-asserted-by":"crossref","unstructured":"P. Barham, B. Dragovic, K. Fraser, S. Hand, T. Harris, A. Ho, R. Neugebauer, I. Pratt, and A. Warfield. Xen and the art of virtualization. In Proceedings of the Symposium on Operating Systems Principles (SOSP), 2003.","DOI":"10.1145\/945445.945462"},{"key":"5_CR3","unstructured":"D. Boggs, A. Baktha, J. Hawkins, D. T. Marr, J. A. Miller, P. Roussel, Singhal R, B. Toll, and K. S. Venkatraman. The microarchitecture of the Intel Pentium 4 processor on 90nm technology. Intel Technology Journal, 8(1), February 2004."},{"key":"5_CR4","unstructured":"G. Delalleau. Mesure locale des temps d\u2019execution: application au controle d\u2019integrite et au fingerprinting. In Proceedings of SSTIC, 2004."},{"key":"5_CR5","unstructured":"Advanced Micro Devices. AMD64 virtualization: Secure virtual machine architecture reference manual. AMD Publication no. 33047 rev. 3.01, May 2005."},{"key":"5_CR6","doi-asserted-by":"crossref","unstructured":"M. Dornseif, T. Holz, and C. Klein. Nosebreak - attacking honeynets. In Proceedings of the 2004 IEEE Information Assurance Workshop, June 2004.","DOI":"10.1109\/IAW.2004.1437807"},{"key":"5_CR7","doi-asserted-by":"crossref","unstructured":"T. Holz and F. Raynal. Detecting honeypots and other suspicious environments. In Proceedings of the IEEE Workshop on Information Assurance and Security, June 2005.","DOI":"10.1109\/IAW.2005.1495930"},{"key":"5_CR8","unstructured":"Intel Corporation. Intel virtualization technology. Available at: http:\/\/www.intel. com\/technology\/computing\/vptech\/, October 2005."},{"key":"5_CR9","doi-asserted-by":"crossref","unstructured":"X. Jiang, D. Xu, H. J. Wang, and E. H. Spafford. Virtual playgrounds for worm behavior investigation. In 8th International Symposium on Recent Advances in Intrusion Detection (RAID \u201905), 2005.","DOI":"10.1007\/11663812_1"},{"key":"5_CR10","doi-asserted-by":"crossref","unstructured":"S. T. King, P. M. Chen, Y.-M. Wang, C. Verbowski, H. J. Wang, and J. R. Lorch. SubVirt: Implementing malware with virtual machines. In Proceedings of the IEEE Symposium on Security and Privacy, May 2006.","DOI":"10.1109\/SP.2006.38"},{"key":"5_CR11","doi-asserted-by":"crossref","unstructured":"T. Kohno, A. Broido, and K. Claffy. Remote physical device fingerprinting. In IEEE Symposium on Security and Privacy, May 2005.","DOI":"10.1109\/SP.2005.18"},{"key":"5_CR12","doi-asserted-by":"crossref","unstructured":"G. J. Popek and R. P. Goldberg. Formal requirements for virtualizable third generation architectures. Communications of the ACM, 17, July 1974.","DOI":"10.1145\/361011.361073"},{"key":"5_CR13","unstructured":"N. Provos. Honeyd: A virtual honeypot daemon. In Proceedings of the 10th DFN-CERT Workshop, 2003."},{"key":"5_CR14","doi-asserted-by":"crossref","unstructured":"J. S. Robin and C. E. Irvine. Analysis of the intel pentium\u2019s ability to support a secure virtual machine monitor. In Proceedings of the USENIX Security Symposium, 2000.","DOI":"10.21236\/ADA423654"},{"key":"5_CR15","unstructured":"R. Rose. Survey of system virtualization techniques. Available at: http:\/\/www. robertwrose.com\/vita\/rose-virtualization.pdf, March 2004."},{"issue":"4","key":"5_CR16","doi-asserted-by":"publisher","first-page":"34","DOI":"10.1109\/88.473612","volume":"3","author":"M. Rosenblum","year":"1995","unstructured":"M. Rosenblum, S. A. Herrod, E. Witchel, and A. Gupta. Complete computer system simulation: The SimOS approach. IEEE Parallel and Distributed Technology: Systems and Applications, 3(4):34\u201343, Winter 1995.","journal-title":"IEEE Parallel and Distributed Technology: Systems and Applications"},{"key":"5_CR17","doi-asserted-by":"crossref","unstructured":"E. Rotenberg, S. Bennett, and J. E. Smith. Trace cache: A low latency approach to high bandwidth instruction fetching. In Proceedings of the 29th Annual International Symposium on Microarchitecture, November 1996.","DOI":"10.1109\/MICRO.1996.566447"},{"key":"5_CR18","unstructured":"J. Rutkowska. Subverting Vista kernel for fun and profit. Presented at Black Hat USA, 2006."},{"key":"5_CR19","unstructured":"J. Rutkowska. Red Pill... or how to detect VMM using (almost) one CPU instruction. http:\/\/invisiblethings.org\/papers\/redpill.html, 2004."},{"key":"5_CR20","unstructured":"J. Rutkowski. Execution path analysis: finding kernel rootkits. Phrack, 11(59), July 2002."},{"key":"5_CR21","doi-asserted-by":"crossref","unstructured":"A. Seshadri, M. Luk, E. Shi, A. Perrig, L. VanDoorn, and P. Khosla. Pioneer: Verifying integrity and guaranteeing execution of code on legacy platforms. In Proceedings of the Symposium on Operating Systems Principals (SOSP), 2005.","DOI":"10.1145\/1095810.1095812"},{"key":"5_CR22","unstructured":"S. Staniford, V. Paxson, and N. Weaver. How to 0wn the internet in your spare time. In Proceedings of the 11th USENIX Security Symposium (Security \u201902), 2002."},{"key":"5_CR23","unstructured":"G. Venkitachalam and B. Lim. Virtualizing I\/O devices on VMware workstation\u2019s hosted virtual machine monitor. In USENIX Technical Conference, 2001."},{"key":"5_CR24","unstructured":"VMWare. Timekeeping in VMWare virtual machines. Technical Report NP-ENG-Q305127, VMWare, Inc., July 2005."},{"key":"5_CR25","unstructured":"VMWare. VMWare Workstation. Available at: http:\/\/www.vmware.com\/, October 2005."},{"key":"5_CR26","doi-asserted-by":"crossref","unstructured":"M. Vrable, J. Ma, J. Chen, D. Moore, E. Vandekieft, A. C. Snoeren, G. M. Voelker, and S. Savage. Scalability, fidelity and containment in the potemkin virtual honeyfarm. In Proceedings of the Symposium on Operating Systems Principals (SOSP), 2005.","DOI":"10.1145\/1095810.1095825"},{"key":"5_CR27","unstructured":"D. D. Zovi. Hardware virtualization-based rootkits. Presented at Black Hat USA, August 2006."}],"container-title":["Advances in Information Security","Botnet Detection"],"original-title":[],"language":"en","link":[{"URL":"http:\/\/link.springer.com\/content\/pdf\/10.1007\/978-0-387-68768-1_5.pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2020,11,17]],"date-time":"2020-11-17T22:02:54Z","timestamp":1605650574000},"score":1,"resource":{"primary":{"URL":"http:\/\/link.springer.com\/10.1007\/978-0-387-68768-1_5"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[null]]},"ISBN":["9780387687667"],"references-count":27,"URL":"https:\/\/doi.org\/10.1007\/978-0-387-68768-1_5","relation":{},"subject":[]}}