{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,3,26]],"date-time":"2025-03-26T18:34:56Z","timestamp":1743014096680,"version":"3.40.3"},"publisher-location":"Cham","reference-count":27,"publisher":"Springer International Publishing","isbn-type":[{"type":"print","value":"9783030526825"},{"type":"electronic","value":"9783030526832"}],"license":[{"start":{"date-parts":[[2020,1,1]],"date-time":"2020-01-01T00:00:00Z","timestamp":1577836800000},"content-version":"tdm","delay-in-days":0,"URL":"http:\/\/www.springer.com\/tdm"},{"start":{"date-parts":[[2020,1,1]],"date-time":"2020-01-01T00:00:00Z","timestamp":1577836800000},"content-version":"vor","delay-in-days":0,"URL":"http:\/\/www.springer.com\/tdm"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2020]]},"DOI":"10.1007\/978-3-030-52683-2_4","type":"book-chapter","created":{"date-parts":[[2020,7,6]],"date-time":"2020-07-06T23:19:19Z","timestamp":1594077559000},"page":"67-88","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":2,"title":["Fast and Furious: Outrunning Windows Kernel Notification Routines from User-Mode"],"prefix":"10.1007","author":[{"given":"Pierre","family":"Ciholas","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Jose Miguel","family":"Such","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Angelos K.","family":"Marnerides","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Benjamin","family":"Green","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Jiajie","family":"Zhang","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Utz","family":"Roedig","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"297","published-online":{"date-parts":[[2020,7,7]]},"reference":[{"key":"4_CR1","unstructured":"Microsoft. Msdn, process security and access rights. \nhttps:\/\/msdn.microsoft.com\/en-us\/library\/windows\/desktop\/ms684880(v=vs.85).aspx"},{"key":"4_CR2","volume-title":"Windows Internals","author":"ME Russinovich","year":"2018","unstructured":"Russinovich, M.E., Solomon, D.A., Yosifovich, P., Ionescu, A.: Windows Internals, 7th edn. Microsoft Press, Redmond (2018)","edition":"7"},{"key":"4_CR3","unstructured":"Microsoft. Msdn, about processes and threads. \nhttps:\/\/docs.microsoft.com\/en-us\/windows\/desktop\/procthread\/about-processes-and-threads"},{"key":"4_CR4","unstructured":"Anonymous. Github, hfromjob exploit. \nhttps:\/\/github.com\/Anonymous-3ab41c\/FastAndFurious\/blob\/master\/hFromJob.cpp"},{"key":"4_CR5","volume-title":"Troubleshoot with the Windows Sysinternals Tools","author":"A Margosis","year":"2018","unstructured":"Margosis, A., Russinovich, M.E.: Troubleshoot with the Windows Sysinternals Tools. Microsoft Press, Redmond (2018)"},{"key":"4_CR6","unstructured":"Anonymous. Github, hthemall exploit. \nhttps:\/\/github.com\/Anonymous-3ab41c\/FastAndFurious\/blob\/master\/hThemAll.cpp"},{"key":"4_CR7","unstructured":"Anonymous. Github, protectiondriver. \nhttps:\/\/github.com\/Anonymous-3ab41c\/FastAndFurious\/blob\/master\/ProtectionDriver.c"},{"key":"4_CR8","unstructured":"Microsoft. Msdn, obregistercallbacks function. \nhttps:\/\/docs.microsoft.com\/en-us\/windows-hardware\/drivers\/ddi\/content\/wdm\/nf-wdm-obregistercallbacks"},{"key":"4_CR9","unstructured":"Anonymous. Youtube, outrunning windows kernel notification routines from user-mode. \nhttps:\/\/youtu.be\/dp_GqDfUUxA"},{"key":"4_CR10","unstructured":"Liu, W.J.: (wj32). Process hacker. \nhttps:\/\/processhacker.sourceforge.io\/"},{"key":"4_CR11","unstructured":"Microsoft. Protected processes. \nhttp:\/\/download.microsoft.com\/download\/a\/f\/7\/af7777e5-7dcd-4800-8a0a-b18336565f5b\/process_Vista.doc"},{"key":"4_CR12","unstructured":"Microsoft. Early launch antimalware. \nhttps:\/\/docs.microsoft.com\/en-us\/windows-hardware\/drivers\/install\/early-launch-antimalware"},{"key":"4_CR13","unstructured":"Microsoft. Mandatory integrity control. \nhttps:\/\/docs.microsoft.com\/en-us\/windows\/desktop\/secauthz\/mandatory-integrity-control"},{"key":"4_CR14","unstructured":"Microsoft. Understanding and working in protected mode internet explorer. \nhttps:\/\/technet.microsoft.com\/en-us\/windows\/bb250462(v=vs.60)"},{"key":"4_CR15","unstructured":"Microsoft. Appcontainer isolation. \nhttps:\/\/docs.microsoft.com\/en-us\/windows\/desktop\/SecAuthZ\/appcontainer-isolation"},{"key":"4_CR16","doi-asserted-by":"publisher","first-page":"23","DOI":"10.1016\/j.diin.2007.06.003","volume":"4","author":"C Seifert","year":"2007","unstructured":"Seifert, C., Steenson, R., Welch, I., Komisarczuk, P., Endicott-Popovsky, B.: Capture-a behavioral analysis tool for applications and documents. Digit. Invest. 4, 23\u201330 (2007)","journal-title":"Digit. Invest."},{"key":"4_CR17","first-page":"10","volume":"7","author":"K Chiang","year":"2007","unstructured":"Chiang, K., Lloyd, L.: A case study of the rustock rootkit and spam bot. HotBots 7, 10 (2007)","journal-title":"HotBots"},{"key":"4_CR18","unstructured":"Liang, S.C.: Understanding behavioural detection of antivirus (2016)"},{"key":"4_CR19","unstructured":"Jeong, H.C., Im, C.T., Oh, J.H.: Malware auto-analysis system and method using kernel callback mechanism, US Patent App. 12\/942,700, 29 March 2012"},{"key":"4_CR20","unstructured":"Liu, Z., Chen, P.: Improved method of packet filtering. In: Proceedings, The 2009 International Symposium on Web Information Systems and Applications (WISA 2009), p. 294. Academy Publisher (2009)"},{"key":"4_CR21","unstructured":"Perez, D.S., Balinsky, H., Simske, S.J.: Injection of data flow control objects into application processes, US Patent App. 14\/917,839, November 24 2016"},{"key":"4_CR22","unstructured":"Aussel, J.-D.: Portable mass storage device with hooking process, US Patent App. 12\/667,196, 22 July 2010"},{"key":"4_CR23","series-title":"Advances in Intelligent Systems and Computing","doi-asserted-by":"publisher","first-page":"211","DOI":"10.1007\/978-3-319-59162-9_22","volume-title":"Proceedings of the 10th International Conference on Computer Recognition Systems CORES 2017","author":"A Pekta\u015f","year":"2018","unstructured":"Pekta\u015f, A., Acarman, T.: Portable dynamic malware analysis with an improved scalability and automatisation. In: Kurzynski, M., Wozniak, M., Burduk, R. (eds.) CORES 2017. AISC, vol. 578, pp. 211\u2013220. Springer, Cham (2018). \nhttps:\/\/doi.org\/10.1007\/978-3-319-59162-9_22"},{"key":"4_CR24","unstructured":"Shochat, E., Elkind, D.: Real time monitoring of computer for determining speed of various processes, US Patent 8,307,246, 6 November 2012"},{"key":"4_CR25","unstructured":"Teller, T., Segal, A.: Method of defending a computer from malware, US Patent 9,536,090, 3 January 2017"},{"key":"4_CR26","unstructured":"Leitch, J.: Process hollowing (2013)"},{"key":"4_CR27","unstructured":"Microsoft. Microsoft, report an issue faq. \nhttps:\/\/www.microsoft.com\/en-us\/msrc\/faqs-report-an-issue"}],"container-title":["Lecture Notes in Computer Science","Detection of Intrusions and Malware, and Vulnerability Assessment"],"original-title":[],"language":"en","link":[{"URL":"http:\/\/link.springer.com\/content\/pdf\/10.1007\/978-3-030-52683-2_4","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2020,7,7]],"date-time":"2020-07-07T00:04:48Z","timestamp":1594080288000},"score":1,"resource":{"primary":{"URL":"http:\/\/link.springer.com\/10.1007\/978-3-030-52683-2_4"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2020]]},"ISBN":["9783030526825","9783030526832"],"references-count":27,"URL":"https:\/\/doi.org\/10.1007\/978-3-030-52683-2_4","relation":{},"ISSN":["0302-9743","1611-3349"],"issn-type":[{"type":"print","value":"0302-9743"},{"type":"electronic","value":"1611-3349"}],"subject":[],"published":{"date-parts":[[2020]]},"assertion":[{"value":"7 July 2020","order":1,"name":"first_online","label":"First Online","group":{"name":"ChapterHistory","label":"Chapter History"}},{"value":"DIMVA","order":1,"name":"conference_acronym","label":"Conference Acronym","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment","order":2,"name":"conference_name","label":"Conference Name","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Lisbon","order":3,"name":"conference_city","label":"Conference City","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Portugal","order":4,"name":"conference_country","label":"Conference Country","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"2020","order":5,"name":"conference_year","label":"Conference Year","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"24 June 2020","order":7,"name":"conference_start_date","label":"Conference Start Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"26 June 2020","order":8,"name":"conference_end_date","label":"Conference End Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"17","order":9,"name":"conference_number","label":"Conference Number","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"dimva2020","order":10,"name":"conference_id","label":"Conference ID","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"https:\/\/dimva2020.campus.ciencias.ulisboa.pt\/index.html","order":11,"name":"conference_url","label":"Conference URL","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Double-blind","order":1,"name":"type","label":"Type","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"Hotcrp","order":2,"name":"conference_management_system","label":"Conference Management System","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"45","order":3,"name":"number_of_submissions_sent_for_review","label":"Number of Submissions Sent for Review","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"12","order":4,"name":"number_of_full_papers_accepted","label":"Number of Full Papers Accepted","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"1","order":5,"name":"number_of_short_papers_accepted","label":"Number of Short Papers Accepted","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"27% - The value is computed by the equation \"Number of Full Papers Accepted \/ Number of Submissions Sent for Review * 100\" and then rounded to a whole number.","order":6,"name":"acceptance_rate_of_full_papers","label":"Acceptance Rate of Full Papers","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"3","order":7,"name":"average_number_of_reviews_per_paper","label":"Average Number of Reviews per Paper","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"3","order":8,"name":"average_number_of_papers_per_reviewer","label":"Average Number of Papers per Reviewer","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"Yes","order":9,"name":"external_reviewers_involved","label":"External Reviewers Involved","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"The conference was held virtually due to the COVID-19 pandemic.","order":10,"name":"additional_info_on_review_process","label":"Additional Info on Review Process","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"This content has been made available to all.","name":"free","label":"Free to read"}]}}