{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,25]],"date-time":"2026-04-25T17:31:15Z","timestamp":1777138275441,"version":"3.51.4"},"publisher-location":"Cham","reference-count":24,"publisher":"Springer International Publishing","isbn-type":[{"value":"9783030808242","type":"print"},{"value":"9783030808259","type":"electronic"}],"license":[{"start":{"date-parts":[[2021,1,1]],"date-time":"2021-01-01T00:00:00Z","timestamp":1609459200000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springer.com\/tdm"},{"start":{"date-parts":[[2021,1,1]],"date-time":"2021-01-01T00:00:00Z","timestamp":1609459200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springer.com\/tdm"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2021]]},"DOI":"10.1007\/978-3-030-80825-9_13","type":"book-chapter","created":{"date-parts":[[2021,7,8]],"date-time":"2021-07-08T23:38:40Z","timestamp":1625787520000},"page":"258-277","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":1,"title":["Introspect Virtual Machines Like It Is the Linux Kernel!"],"prefix":"10.1007","author":[{"given":"Ahmed","family":"Abdelraoof","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Benjamin","family":"Taubmann","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Thomas","family":"Dangl","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-2815-5747","authenticated-orcid":false,"given":"Hans P.","family":"Reiser","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"297","published-online":{"date-parts":[[2021,7,9]]},"reference":[{"key":"13_CR1","unstructured":"Xen Hypercall ABI. http:\/\/xenbits.xenproject.org\/docs\/sphinx-unstable\/guest-guide\/x86\/hypercall-abi.html#. Accessed 11 June 2020"},{"key":"13_CR2","unstructured":"LibVMI: Simplified virtual machine introspection (2020). https:\/\/github.com\/libvmi\/libvmi\/blob\/master\/README.rst. Accessed 7 June 2020"},{"key":"13_CR3","unstructured":"Xen Hypercalls (2020). https:\/\/wiki.xenproject.org\/wiki\/Hypercall. Accessed 7 June 2020"},{"key":"13_CR4","unstructured":"Xen Project Software Overview (2020). https:\/\/wiki.xen.org\/wiki\/Xen_Overview. Accessed 7 June 2020"},{"key":"13_CR5","unstructured":"XenBus (2020). https:\/\/wiki.xen.org\/wiki\/XenBus. Accessed 7 June 2020"},{"key":"13_CR6","unstructured":"XenStore (2020). https:\/\/wiki.xen.org\/wiki\/XenStore. Accessed 7 June 2020"},{"key":"13_CR7","doi-asserted-by":"crossref","unstructured":"Bhatt, M., Ahmed, I., Lin, Z.: Using virtual machine introspection for operating systems security education. In: Proceedings of the 49th ACM Technical Symposium on Computer Science Education, pp. 396\u2013401 (2018)","DOI":"10.1145\/3159450.3159606"},{"key":"13_CR8","doi-asserted-by":"crossref","unstructured":"Dangl, T., Taubmann, B., Reiser, H.P.: RapidVMI: fast and multi-core aware active virtual machine introspection. In: Proceedings of the 16th International Conference on Availability, Reliability and Security (ARES) (2021)","DOI":"10.1145\/3465481.3465752"},{"key":"13_CR9","doi-asserted-by":"crossref","unstructured":"Dinaburg, A., Royal, P., Sharif, M., Lee, W.: Ether: malware analysis via hardware virtualization extensions. In: Proceedings of the 15th ACM Conference on Computer and Communications Security (CCS), pp. 51\u201362 (2008)","DOI":"10.1145\/1455770.1455779"},{"key":"13_CR10","doi-asserted-by":"crossref","unstructured":"Harrison, C., Cook, D., McGraw, R., Hamilton Jr., J.A.: Constructing a cloud-based IDS by merging VMI with FMA. In: IEEE 11th International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom), pp. 163\u2013169 (2012)","DOI":"10.1109\/TrustCom.2012.113"},{"key":"13_CR11","unstructured":"Hsiao, S., Sun, Y.S., Chen, M.C.: Virtual machine introspection based malware behavior profiling and family grouping. CoRR arXiv:1705.01697 (2017)"},{"key":"13_CR12","doi-asserted-by":"crossref","unstructured":"Jain, B., Baig, M.B., Zhang, D., Porter, D.E., Sion, R.: SoK: introspections on trust and the semantic gap. In: 2014 IEEE Symposium on Security and Privacy, pp. 605\u2013620 (2014)","DOI":"10.1109\/SP.2014.45"},{"key":"13_CR13","first-page":"518","volume":"17","author":"P Klemperer","year":"2018","unstructured":"Klemperer, P., Jeon, H.Y., Payne, B.D., Hoe, J.C.: High-performance memory snapshotting for real-time, consistent, hypervisor-based monitors. IEEE Trans. Dependable Secure Comput. 17, 518\u2013535 (2018)","journal-title":"IEEE Trans. Dependable Secure Comput."},{"key":"13_CR14","unstructured":"Lengyel, T.K.: Stealthy monitoring with Xen altp2m, April 2016. https:\/\/xenproject.org\/2016\/04\/13\/stealthy-monitoring-with-xen-altp2m\/. Accessed 11 June 2020"},{"key":"13_CR15","doi-asserted-by":"publisher","unstructured":"Lengyel, T.K., Maresca, S., Payne, B.D., Webster, G.D., Vogl, S., Kiayias, A.: Scalability, fidelity and stealth in the DRAKVUF dynamic malware analysis system. In: Proceedings of the 30th Annual Computer Security Applications Conference (ACSAC 2014), pp. 386\u2013395. ACM (2014). https:\/\/doi.org\/10.1145\/2664243.2664252","DOI":"10.1145\/2664243.2664252"},{"key":"13_CR16","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"465","DOI":"10.1007\/978-3-319-27161-3_42","volume-title":"Algorithms and Architectures for Parallel Processing","author":"C Li","year":"2015","unstructured":"Li, C., Xiang, Y., Shi, J.: A model of dynamic malware analysis based on VMI. In: Wang, G., Zomaya, A., Perez, G.M., Li, K. (eds.) ICA3PP 2015. LNCS, vol. 9532, pp. 465\u2013475. Springer, Cham (2015). https:\/\/doi.org\/10.1007\/978-3-319-27161-3_42"},{"key":"13_CR17","first-page":"957","volume":"8","author":"P Mishra","year":"2018","unstructured":"Mishra, P., Varadharajan, V., Pilli, E., Tupakula, U.: VMGuard: a VMI-based security architecture for intrusion detection in cloud environment. IEEE Trans. Cloud Comput. 8, 957\u2013971 (2018)","journal-title":"IEEE Trans. Cloud Comput."},{"key":"13_CR18","unstructured":"Reginato, L.: Updated analysis of PatchGuard on Microsoft Windows 10 RS4 (2019). https:\/\/blog.tetrane.com\/downloads\/Tetrane_PatchGuard_Analysis_RS4_v1.01.pdf"},{"key":"13_CR19","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"255","DOI":"10.1007\/978-3-030-03638-6_16","volume-title":"Secure IT Systems","author":"S Sentanoe","year":"2018","unstructured":"Sentanoe, S., Taubmann, B., Reiser, H.P.: Sarracenia: enhancing the performance and stealthiness of SSH honeypots using virtual machine introspection. In: Gruschka, N. (ed.) NordSec 2018. LNCS, vol. 11252, pp. 255\u2013271. Springer, Cham (2018). https:\/\/doi.org\/10.1007\/978-3-030-03638-6_16"},{"key":"13_CR20","doi-asserted-by":"crossref","unstructured":"Taubmann, B., Rakotondravony, N., Reiser, H.P.: CloudPhylactor: harnessing mandatory access control for virtual machine introspection in cloud data centers. In: The 15th IEEE International Conference on Trust, Security and Privacy in Computing and Communications (IEEE TrustCom-16) (2016)","DOI":"10.1109\/TrustCom.2016.0162"},{"key":"13_CR21","doi-asserted-by":"publisher","first-page":"41","DOI":"10.1007\/978-3-030-50323-9_3","volume-title":"Distributed Applications and Interoperable Systems","author":"B Taubmann","year":"2020","unstructured":"Taubmann, B., Reiser, H.P.: Towards hypervisor support for enhancing the performance of virtual machine introspection. In: Remke, A., Schiavoni, V. (eds.) Distributed Applications and Interoperable Systems, pp. 41\u201354. Springer, Cham (2020)"},{"key":"13_CR22","unstructured":"Windows Vista Security Team: An introduction to kernel patch protection (2006). https:\/\/web.archive.org\/web\/20061124094344\/http:\/\/blogs.msdn.com\/windowsvistasecurity\/archive\/2006\/08\/11\/695993.aspx. Accessed 7 June 2020"},{"key":"13_CR23","unstructured":"Zhao, S., Ding, X., Xu, W., Gu, D.: Seeing through the same lens: introspecting guest address space at native speed. In: 26th USENIX Security Symposium (USENIX Security 17), Vancouver, BC, pp. 799\u2013813. USENIX Association, August 2017. https:\/\/www.usenix.org\/conference\/usenixsecurity17\/technical-sessions\/presentation\/zhao"},{"key":"13_CR24","unstructured":"Zillner, T.: Memory forensics using virtual machine introspection for cloud computing. Presented at Black Hat USA (2016)"}],"container-title":["Lecture Notes in Computer Science","Detection of Intrusions and Malware, and Vulnerability Assessment"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/978-3-030-80825-9_13","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2023,1,3]],"date-time":"2023-01-03T12:09:17Z","timestamp":1672747757000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/978-3-030-80825-9_13"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2021]]},"ISBN":["9783030808242","9783030808259"],"references-count":24,"URL":"https:\/\/doi.org\/10.1007\/978-3-030-80825-9_13","relation":{},"ISSN":["0302-9743","1611-3349"],"issn-type":[{"value":"0302-9743","type":"print"},{"value":"1611-3349","type":"electronic"}],"subject":[],"published":{"date-parts":[[2021]]},"assertion":[{"value":"9 July 2021","order":1,"name":"first_online","label":"First Online","group":{"name":"ChapterHistory","label":"Chapter History"}},{"value":"DIMVA","order":1,"name":"conference_acronym","label":"Conference Acronym","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment","order":2,"name":"conference_name","label":"Conference Name","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"2021","order":5,"name":"conference_year","label":"Conference Year","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"14 July 2021","order":7,"name":"conference_start_date","label":"Conference Start Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"16 July 2021","order":8,"name":"conference_end_date","label":"Conference End Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"18","order":9,"name":"conference_number","label":"Conference Number","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"dimva2021","order":10,"name":"conference_id","label":"Conference ID","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"https:\/\/dimva2021.campus.ciencias.ulisboa.pt\/cfp.html","order":11,"name":"conference_url","label":"Conference URL","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Double-blind","order":1,"name":"type","label":"Type","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"HotCRP","order":2,"name":"conference_management_system","label":"Conference Management System","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"65","order":3,"name":"number_of_submissions_sent_for_review","label":"Number of Submissions Sent for Review","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"18","order":4,"name":"number_of_full_papers_accepted","label":"Number of Full Papers Accepted","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"1","order":5,"name":"number_of_short_papers_accepted","label":"Number of Short Papers Accepted","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"28% - The value is computed by the equation \"Number of Full Papers Accepted \/ Number of Submissions Sent for Review * 100\" and then rounded to a whole number.","order":6,"name":"acceptance_rate_of_full_papers","label":"Acceptance Rate of Full Papers","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"3","order":7,"name":"average_number_of_reviews_per_paper","label":"Average Number of Reviews per Paper","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"5","order":8,"name":"average_number_of_papers_per_reviewer","label":"Average Number of Papers per Reviewer","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"Yes","order":9,"name":"external_reviewers_involved","label":"External Reviewers Involved","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}}]}}