{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,8,17]],"date-time":"2026-08-17T15:02:09Z","timestamp":1786978929550,"version":"build-2736575974"},"publisher-location":"Cham","reference-count":27,"publisher":"Springer Nature Switzerland","isbn-type":[{"value":"9783032115386","type":"print"},{"value":"9783032115393","type":"electronic"}],"license":[{"start":{"date-parts":[[2026,1,1]],"date-time":"2026-01-01T00:00:00Z","timestamp":1767225600000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"},{"start":{"date-parts":[[2026,1,1]],"date-time":"2026-01-01T00:00:00Z","timestamp":1767225600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2026]]},"DOI":"10.1007\/978-3-032-11539-3_14","type":"book-chapter","created":{"date-parts":[[2026,2,11]],"date-time":"2026-02-11T05:13:36Z","timestamp":1770786816000},"page":"238-254","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":1,"title":["Evaluating eBPF as\u00a0an\u00a0Alternative to\u00a0Virtual Machine Introspection for\u00a0High-Interaction Honeypot Implementation"],"prefix":"10.1007","author":[{"ORCID":"https:\/\/orcid.org\/0009-0002-7751-0327","authenticated-orcid":false,"given":"Niku Waltteri Saulinpoika","family":"Nuutinen","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Miguel","family":"Fa\u00edsco","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Milan","family":"Petrusic","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-4478-8680","authenticated-orcid":false,"given":"Ib\u00e9ria","family":"Medeiros","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-2815-5747","authenticated-orcid":false,"given":"Hans P.","family":"Reiser","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"297","published-online":{"date-parts":[[2026,2,12]]},"reference":[{"key":"14_CR1","doi-asserted-by":"publisher","unstructured":"Bilge, L., Cavallaro, L., Pellegrino, G., Neves, N. (eds.): DIMVA 2021. Detection of Intrusions and Malware, and Vulnerability Assessment. LNCS, vol. 12756. Springer, Cham (2021). https:\/\/doi.org\/10.1007\/978-3-030-80825-9","DOI":"10.1007\/978-3-030-80825-9"},{"key":"14_CR2","unstructured":"Agman, Y., Hendler, D.: BPFroid: Robust Real Time Android Malware Detection Framework (2021). https:\/\/arxiv.org\/abs\/2105.14344"},{"key":"14_CR3","unstructured":"Amit, N., Wei, M.: The design and implementation of hyperupcalls. In: Proceedings of the 2018 USENIX Conference on Usenix Annual Technical Conference. p. 97\u2013111. USENIX ATC \u201918, USENIX Association, USA (2018)"},{"key":"14_CR4","doi-asserted-by":"publisher","unstructured":"Bushouse, M., Reeves, D.: Hyperagents: Migrating host agents to the hypervisor. In: Proceedings of the Eighth ACM Conference on Data and Application Security and Privacy. pp. 212\u2013223. CODASPY \u201918, ACM, New York, NY, USA (2018). https:\/\/doi.org\/10.1145\/3176258.3176317","DOI":"10.1145\/3176258.3176317"},{"key":"14_CR5","doi-asserted-by":"publisher","unstructured":"Dangl, T., Sentanoe, S., Reiser, H.P.: Retrofitting AMD x86 processors with active virtual machine introspection capabilities. In: Proceedings of the 36th International Conference on the Architecture of Computing Systems, ARCS 2023, Athens, Greece. LNCS, vol. 13949, pp. 168\u2013182. Springer, Cham (2023). https:\/\/doi.org\/10.1007\/978-3-031-42785-5_12","DOI":"10.1007\/978-3-031-42785-5_12"},{"key":"14_CR6","doi-asserted-by":"publisher","unstructured":"Dangl, T., Sentanoe, S., Reiser, H.P.: VMIFresh: Efficient and fresh caches for virtual machine introspection. Comput. Secur. 135, 103527 (2023). https:\/\/doi.org\/10.1016\/J.COSE.2023.103527","DOI":"10.1016\/J.COSE.2023.103527"},{"key":"14_CR7","doi-asserted-by":"publisher","first-page":"113061","DOI":"10.1109\/ACCESS.2021.3104115","volume":"9","author":"M Dimolianis","year":"2021","unstructured":"Dimolianis, M., Pavlidis, A., Maglaris, V.: Signature-based traffic classification and mitigation for ddos attacks using programmable network data planes. IEEE Access 9, 113061\u2013113076 (2021). https:\/\/doi.org\/10.1109\/ACCESS.2021.3104115","journal-title":"IEEE Access"},{"key":"14_CR8","doi-asserted-by":"publisher","unstructured":"Ding, Z., Guo, Y., Xu, H., Yan, L., Cui, L., Peng, Y., Cheng, F., Hao, Z.: SeqTrace: API call tracing based on Intel PT and VMI for malware detection. In: Algorithms and Architectures for Parallel Processing: 22nd International Conference, ICA3PP 2022, Copenhagen, Denmark, October 10\u201312, 2022, Proceedings. pp. 98\u2013116. Springer-Verlag, Berlin, Heidelberg (2022). https:\/\/doi.org\/10.1007\/978-3-031-22677-9_6","DOI":"10.1007\/978-3-031-22677-9_6"},{"key":"14_CR9","unstructured":"Farasat, T., Kim, J., Posegga, J.: SmartX Intelligent Sec: A Security Framework Based on Machine Learning and eBPF\/XDP (2024). https:\/\/arxiv.org\/abs\/2410.20244"},{"key":"14_CR10","doi-asserted-by":"publisher","unstructured":"Fraser, T., Evenson, M.R., Arbaugh, W.A.: VICI Virtual Machine Introspection for Cognitive Immunity. In: Twenty-Fourth Annual Computer Security Applications Conference, ACSAC 2008, Anaheim, California, USA, 8\u201312 December 2008. pp. 87\u201396. IEEE Computer Society (2008). https:\/\/doi.org\/10.1109\/ACSAC.2008.33","DOI":"10.1109\/ACSAC.2008.33"},{"key":"14_CR11","unstructured":"Garfinkel, T., Rosenblum, M.: A Virtual Machine Introspection Based Architecture for Intrusion Detection. In: Proceedings of the Network and Distributed System Security Symposium, NDSS 2003, San Diego, California, USA. The Internet Society (2003). https:\/\/www.ndss-symposium.org\/ndss2003\/virtual-machine-introspection-based-architecture-intrusion-detection\/"},{"issue":"3","key":"14_CR12","doi-asserted-by":"publisher","first-page":"74","DOI":"10.1145\/1368506.1368517","volume":"42","author":"B Hay","year":"2008","unstructured":"Hay, B., Nance, K.: Forensics examination of volatile system data using virtual introspection. SIGOPS Oper. Syst. Rev. 42(3), 74\u201382 (2008). https:\/\/doi.org\/10.1145\/1368506.1368517","journal-title":"SIGOPS Oper. Syst. Rev."},{"key":"14_CR13","unstructured":"Intel: Product brief: Hardware-enhanced threat detection. https:\/\/www.intel.com\/content\/dam\/www\/public\/us\/en\/documents\/product-briefs\/tdt-product-brief.pdf (2021). Accessed 25 Aug 2025"},{"key":"14_CR14","doi-asserted-by":"publisher","unstructured":"Jain, B., Baig, M.B., Zhang, D., Porter, D.E., Sion, R.: Introspections on the semantic gap. IEEE Secur. Priv. 13(2), 48\u201355 (2015). https:\/\/doi.org\/10.1109\/MSP.2015.35 Type: Conference Paper","DOI":"10.1109\/MSP.2015.35"},{"key":"14_CR15","doi-asserted-by":"publisher","unstructured":"Kaffes, K., Humphries, J.T., Mazi\u00e8res, D., Kozyrakis, C.: Syrup: User-defined scheduling across the stack. In: Proceedings of the ACM SIGOPS 28th Symposium on Operating Systems Principles. p. 605\u2013620. SOSP \u201921, Association for Computing Machinery, New York, NY, USA (2021). https:\/\/doi.org\/10.1145\/3477132.3483548","DOI":"10.1145\/3477132.3483548"},{"key":"14_CR16","unstructured":"Lengyel, T.K., et\u00a0al.: LibVMI: Simplified Virtual Machine Introspection. https:\/\/github.com\/libvmi\/libvmi, Accessed 25 Aug 2025"},{"key":"14_CR17","doi-asserted-by":"publisher","unstructured":"Lutas, A., Sebestyen, G., Tosa, R., Colesa, A.: VE-VMI: High-Performance Virtual Machine Introspection Based on Virtualization Exception. In: Potolea, R., Iancu, B., Slavescu, R.R. (eds.) In: 20th International Symposium on Parallel and Distributed Computing, ISPDC 2021, Cluj-Napoca, Romania, July 28-30, 2021. pp. 73\u201380. IEEE (2021). https:\/\/doi.org\/10.1109\/ISPDC52870.2021.9521609","DOI":"10.1109\/ISPDC52870.2021.9521609"},{"key":"14_CR18","unstructured":"Microsoft: eBPF for Windows. https:\/\/github.com\/microsoft\/ebpf-for-windows, Accessed 21 Apr 2025"},{"issue":"1","key":"14_CR19","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1186\/s13677-014-0016-2","volume":"3","author":"A More","year":"2014","unstructured":"More, A., Tapaswi, S.: Virtual machine introspection: towards bridging the semantic gap. J. Cloud Comput. 3(1), 1\u201314 (2014). https:\/\/doi.org\/10.1186\/s13677-014-0016-2","journal-title":"J. Cloud Comput."},{"key":"14_CR20","doi-asserted-by":"publisher","unstructured":"Qiang, W., Xu, G., Dai, W., Zou, D., Jin, H.: CloudVMI: a cloud-oriented writable virtual machine introspection. IEEE Access 5, 21962\u201321976 (2017). https:\/\/doi.org\/10.1109\/ACCESS.2017.2758356","DOI":"10.1109\/ACCESS.2017.2758356"},{"key":"14_CR21","doi-asserted-by":"publisher","unstructured":"Sentanoe, S., Dangl, T., Reiser, H.P.: KVMIveggur: flexible, secure, and efficient support for self-service virtual machine introspection. Forensic Sci. Int. Digital Invest. 42 (2022). https:\/\/doi.org\/10.1016\/j.fsidi.2022.301397","DOI":"10.1016\/j.fsidi.2022.301397"},{"key":"14_CR22","doi-asserted-by":"crossref","unstructured":"Sentanoe, S., Taubmann, B., Reiser, H.P.: Sarracenia: Enhancing the performance and stealthiness of SSH honeypots using virtual machine introspection. In: Proceedings of the 23rd Nordic Conference on Secure IT Systems (2018)","DOI":"10.1007\/978-3-030-03638-6_16"},{"key":"14_CR23","unstructured":"Tarral, M.: KVMi Subsystem for KVM. https:\/\/kvm-vmi.github.io\/kvm-vmi\/master\/kvmi.html (2020). Accessed 25 Aug 2025"},{"key":"14_CR24","doi-asserted-by":"publisher","unstructured":"Taubmann, B., Rakotondravony, N., Reiser, H.P.: CloudPhylactor: harnessing mandatory access control for virtual machine introspection in cloud data centers. In: 2016 IEEE Trustcom\/BigDataSE\/ISPA, Tianjin, China, August 23\u201326, 2016. pp. 957\u2013964. IEEE (2016). https:\/\/doi.org\/10.1109\/TRUSTCOM.2016.0162","DOI":"10.1109\/TRUSTCOM.2016.0162"},{"key":"14_CR25","unstructured":"Wang, Z., Chen, T., Dai, Q., Chen, Y., Wei, H., Zeng, Q.: When ebpf Meets Machine Learning: On-the-Fly os Kernel Compartmentalization (2024). https:\/\/arxiv.org\/abs\/2401.05641"},{"key":"14_CR26","unstructured":"Xie, X.: Understanding the Performance of eBPF-Based Applications. https:\/\/nsg.ee.ethz.ch\/files\/public\/theses\/2024-benchmarking_ebpf_programs\/thesis-1.pdf (2025). Semester Thesis"},{"key":"14_CR27","unstructured":"Yang, Z., et al.: $$\\lambda $$-io: a unified io stack for computational storage. In: Proceedings of the 21st USENIX Conference on File and Storage Technologies. FAST\u201923, USENIX Association, USA (2023)"}],"container-title":["Communications in Computer and Information Science","Dependable and Secure Computing"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/978-3-032-11539-3_14","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,2,11]],"date-time":"2026-02-11T05:13:41Z","timestamp":1770786821000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/978-3-032-11539-3_14"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026]]},"ISBN":["9783032115386","9783032115393"],"references-count":27,"URL":"https:\/\/doi.org\/10.1007\/978-3-032-11539-3_14","relation":{},"ISSN":["1865-0929","1865-0937"],"issn-type":[{"value":"1865-0929","type":"print"},{"value":"1865-0937","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026]]},"assertion":[{"value":"12 February 2026","order":1,"name":"first_online","label":"First Online","group":{"name":"ChapterHistory","label":"Chapter History"}},{"value":"LADC","order":1,"name":"conference_acronym","label":"Conference Acronym","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Latin-American Symposium on Dependable Computing","order":2,"name":"conference_name","label":"Conference Name","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Valpara\u00edso","order":3,"name":"conference_city","label":"Conference City","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Chile","order":4,"name":"conference_country","label":"Conference Country","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"2025","order":5,"name":"conference_year","label":"Conference Year","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"27 October 2025","order":7,"name":"conference_start_date","label":"Conference Start Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"31 October 2025","order":8,"name":"conference_end_date","label":"Conference End Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"14","order":9,"name":"conference_number","label":"Conference Number","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"ladc2025a","order":10,"name":"conference_id","label":"Conference ID","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"https:\/\/ladc.sbc.org.br\/2025\/","order":11,"name":"conference_url","label":"Conference URL","group":{"name":"ConferenceInfo","label":"Conference Information"}}]}}