{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,9,28]],"date-time":"2025-09-28T20:32:35Z","timestamp":1759091555044,"version":"3.40.3"},"publisher-location":"Berlin, Heidelberg","reference-count":29,"publisher":"Springer Berlin Heidelberg","isbn-type":[{"type":"print","value":"9783642333378"},{"type":"electronic","value":"9783642333385"}],"license":[{"start":{"date-parts":[[2012,1,1]],"date-time":"2012-01-01T00:00:00Z","timestamp":1325376000000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springer.com\/tdm"},{"start":{"date-parts":[[2012,1,1]],"date-time":"2012-01-01T00:00:00Z","timestamp":1325376000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springer.com\/tdm"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2012]]},"DOI":"10.1007\/978-3-642-33338-5_7","type":"book-chapter","created":{"date-parts":[[2012,9,26]],"date-time":"2012-09-26T01:17:07Z","timestamp":1348622227000},"page":"127-146","source":"Crossref","is-referenced-by-count":4,"title":["Dione: A Flexible Disk Monitoring and Analysis Framework"],"prefix":"10.1007","author":[{"given":"Jennifer","family":"Mankin","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"David","family":"Kaeli","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"297","reference":[{"key":"7_CR1","doi-asserted-by":"crossref","unstructured":"Azmandian, F., Moffie, M., Alshawabkeh, M., Dy, J., Aslam, J., Kaeli, D.: Virtual machine monitor-based lightweight intrusion detection. SIGOPS Operating Systems Review\u00a045 (July 2011)","DOI":"10.1145\/2007183.2007189"},{"key":"7_CR2","unstructured":"Virus profile: Generic backdoor!68a521cd1d46., \n                      http:\/\/home.glb.mcafee.com\/virusinfo\/VirusProfile.aspx?key=199638\n                     (accessed on December 11, 2011)"},{"key":"7_CR3","unstructured":"Balzarotti, D., Cova, M., Karlberger, C., Kruegel, C., Kirda, E., Vigna, G.: Efficient detection of split personalities in malware. In: Network and Distributed System Security Symposium, NDSS (2010)"},{"key":"7_CR4","doi-asserted-by":"crossref","unstructured":"Butler, K.R., McLaughlin, S., McDaniel, P.D.: Rootkit-resistant disks. In: Computer and Communications Security (CCS), pp. 403\u2013416. ACM (2008)","DOI":"10.1145\/1455770.1455821"},{"key":"7_CR5","unstructured":"Cantrill, B.M., Shapiro, M.W., Leventhal, A.H.: Dynamic instrumentation of production systems. In: USENIX Annual Technical Conference, ATEC 2004. USENIX Association (2004)"},{"key":"7_CR6","unstructured":"Carrier, B. The Sleuth Kit (TSK), \n                      http:\/\/www.sleuthkit.org\n                     (accessed on October 1, 2011)"},{"key":"7_CR7","doi-asserted-by":"crossref","unstructured":"Case, A., Marziale, L., Richard III, G.G.: Dynamic recreation of kernel data structures for live forensics. Digital Investigation\u00a07(suppl. 1) (2010); The Proceedings of the Tenth Annual DFRWS Conference","DOI":"10.1016\/j.diin.2010.05.005"},{"key":"7_CR8","unstructured":"Chen, X., Andersen, J., Mao, Z., Bailey, M., Nazario, J.: Towards an understanding of anti-virtualization and anti-debugging behavior in modern malware. In: Dependable Systems and Networks (DSN), pp. 177\u2013186 (2008)"},{"key":"7_CR9","doi-asserted-by":"crossref","unstructured":"Chubachi, Y., Shinagawa, T., Kato, K.: Hypervisor-based prevention of persistent rootkits. In: Symposium on Applied Computing (SAC). ACM (2010)","DOI":"10.1145\/1774088.1774131"},{"key":"7_CR10","unstructured":"Mcafee labs thread advisory: Fakealert system defender. White-Paper, McAfee Inc. (June 2011)"},{"key":"7_CR11","unstructured":"Goldberg, I., Wagner, D., Thomas, R., Brewer, E.A.: A secure environment for untrusted helper applications: Confining the wily hacker. In: USENIX Security Symposium. USENIX Association (1996)"},{"key":"7_CR12","doi-asserted-by":"crossref","unstructured":"Jiang, X., Wang, X., Xu, D.: Stealthy malware detection through VMM-based \u201cout-of-the-box\u201d semantic view reconstruction. In: Computer and Communications Security (CCS), pp. 128\u2013138. ACM (2007)","DOI":"10.1145\/1315245.1315262"},{"key":"7_CR13","doi-asserted-by":"crossref","unstructured":"Joshi, A., King, S.T., Dunlap, G.W., Chen, P.M.: Detecting past and present intrusions through vulnerability-specific predicates. In: ACM Symposium on Operating Systems Principles (SOSP 2005), pp. 91\u2013104 (2005)","DOI":"10.1145\/1095809.1095820"},{"key":"7_CR14","unstructured":"Kapoor, A., Mathur, R.: Predicting the future of stealth attacks. In: Proceedings of the Virus Bulletin Conference (October 2011)"},{"key":"7_CR15","doi-asserted-by":"crossref","unstructured":"Kim, G.H., Spafford, E.H.: The design and implementation of tripwire: a file system integrity checker. In: Computer and Communications Security (CCS), pp. 18\u201329. ACM (1994)","DOI":"10.1145\/191177.191183"},{"key":"7_CR16","doi-asserted-by":"crossref","unstructured":"King, S.T., Chen, P.M.: Backtracking intrusions. In: Symposium on Operating Systems Principles (SOSP). ACM (2003)","DOI":"10.1145\/945445.945467"},{"key":"7_CR17","doi-asserted-by":"crossref","unstructured":"Krishnan, S., Snow, K.Z., Monrose, F.: Trail of bytes: efficient support for forensic analysis. In: Computer and Communications Security. ACM (2010)","DOI":"10.1145\/1866307.1866314"},{"key":"7_CR18","unstructured":"Kruegel, C., Kirda, E., Bayer, U.: TTAnalyze: A tool for analyzing malware. In: European Institute for Computer Antivirus Research, EICAR (2006)"},{"key":"7_CR19","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"338","DOI":"10.1007\/978-3-642-23644-0_18","volume-title":"Recent Advances in Intrusion Detection","author":"M. Lindorfer","year":"2011","unstructured":"Lindorfer, M., Kolbitsch, C., Comparetti, P.M.: Detecting Environment-Sensitive Malware. In: Sommer, R., Balzarotti, D., Maier, G. (eds.) RAID 2011. LNCS, vol.\u00a06961, pp. 338\u2013357. Springer, Heidelberg (2011)"},{"key":"7_CR20","doi-asserted-by":"crossref","unstructured":"Payne, B.D., de, A., Carbone, M.D.P., Lee, W.: Secure and flexible monitoring of virtual machines. In: Annual Computer Security Applications Conference, ACSAC (2007)","DOI":"10.1109\/ACSAC.2007.4413005"},{"key":"7_CR21","doi-asserted-by":"crossref","unstructured":"Pennington, A.G., Strunk, J.D., Griffin, J.L., Soules, C.A.N., Goodson, G.R., Ganger, G.R.: Storage-based intrusion detection: Watching storage activity for suspicious behavior. In: USENIX Security Symposium (2003)","DOI":"10.21236\/ADA461142"},{"key":"7_CR22","unstructured":"Petroni Jr., N.L., Fraser, T., Molina, J., Arbaugh, W.A.: Copilot - a coprocessor-based kernel runtime integrity monitor. In: USENIX Security Symposium. USENIX Assoc. (2004)"},{"key":"7_CR23","unstructured":"Provos, N.: Improving host security with system call policies. In: USENIX Security Symposium, Berkeley, CA, USA. USENIX Association (2003)"},{"key":"7_CR24","unstructured":"Russinovich, M.: DiskMon for Windows v2.01, \n                      http:\/\/technet.microsoft.com\/en-us\/sysinternals\/bb896646\n                     (accessed on November 24, 2011)"},{"key":"7_CR25","unstructured":"Russinovich, M.E., Solomon, D.A.: Microsoft Windows Internals, 4th edn. Microsoft Press (2005)"},{"key":"7_CR26","unstructured":"Russon, R., Fledel, Y.: NTFS documentation. Tech. rep., Linux NTFS (2004)"},{"key":"7_CR27","series-title":"Lecture Notes in Artificial Intelligence","doi-asserted-by":"publisher","first-page":"14","DOI":"10.1007\/11425274_2","volume-title":"Foundations of Intelligent Systems","author":"S.J. Stolfo","year":"2005","unstructured":"Stolfo, S.J., Hershkop, S., Bui, L.H., Ferster, R., Wang, K.: Anomaly Detection in Computer Security and an Application to File System Accesses. In: Hacid, M.-S., Murray, N.V., Ra\u015b, Z.W., Tsumoto, S. (eds.) ISMIS 2005. LNCS (LNAI), vol.\u00a03488, pp. 14\u201328. Springer, Heidelberg (2005)"},{"key":"7_CR28","doi-asserted-by":"crossref","unstructured":"Willems, C., Holz, T., Freiling, F.: Toward automated dynamic malware analysis using CWSandbox. IEEE Security Privacy\u00a05(2) (March-April 2007)","DOI":"10.1109\/MSP.2007.45"},{"key":"7_CR29","doi-asserted-by":"crossref","unstructured":"Zhang, Y., Gu, Y., Wang, H., Wang, D.: Virtual-machine-based intrusion detection on file-aware block level storage. In: Symposium on Computer Architecture and High Performance Computing. IEEE Computer Society (2006)","DOI":"10.1109\/SBAC-PAD.2006.32"}],"container-title":["Lecture Notes in Computer Science","Research in Attacks, Intrusions, and Defenses"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/978-3-642-33338-5_7","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2021,8,9]],"date-time":"2021-08-09T19:05:39Z","timestamp":1628535939000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/978-3-642-33338-5_7"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2012]]},"ISBN":["9783642333378","9783642333385"],"references-count":29,"URL":"https:\/\/doi.org\/10.1007\/978-3-642-33338-5_7","relation":{},"ISSN":["0302-9743","1611-3349"],"issn-type":[{"type":"print","value":"0302-9743"},{"type":"electronic","value":"1611-3349"}],"subject":[],"published":{"date-parts":[[2012]]}}}