{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2024,9,7]],"date-time":"2024-09-07T10:48:09Z","timestamp":1725706089815},"publisher-location":"Berlin, Heidelberg","reference-count":21,"publisher":"Springer Berlin Heidelberg","isbn-type":[{"type":"print","value":"9783642346002"},{"type":"electronic","value":"9783642346019"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2012]]},"DOI":"10.1007\/978-3-642-34601-9_6","type":"book-chapter","created":{"date-parts":[[2012,11,15]],"date-time":"2012-11-15T21:04:18Z","timestamp":1353013458000},"page":"72-85","source":"Crossref","is-referenced-by-count":0,"title":["Identifying OS Kernel Objects for Run-Time Security Analysis"],"prefix":"10.1007","author":[{"given":"Amani S.","family":"Ibrahim","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"James","family":"Hamlyn-Harris","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"John","family":"Grundy","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Mohamed","family":"Almorsy","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"297","reference":[{"key":"6_CR1","doi-asserted-by":"crossref","unstructured":"Ibrahim, A.S., Hamlyn-Harris, J., Grundy, J., Almorsy, M.: Supporting Virtualization-Aware Security Solutions using a Systematic Approach to Overcome the Semantic Gap. In: Proc. of 5th IEEE International Conference on Cloud Computing, Hawaii, USA (2012)","DOI":"10.1109\/CLOUD.2012.129"},{"key":"6_CR2","doi-asserted-by":"crossref","unstructured":"Baliga, A., Ganapathy, V., Iftode, L.: Automatic Inference and Enforcement of Kernel Data Structure Invariants. In: Proc. of 2008 Annual Computer Security Applications Conference, pp. 77\u201386 (2008)","DOI":"10.1109\/ACSAC.2008.29"},{"issue":"1","key":"6_CR3","first-page":"10","volume":"3","author":"S. Andreas","year":"2006","unstructured":"Andreas, S.: Searching for processes and threads in Microsoft Windows memory dumps. Digital Investigation\u00a03(1), 10\u201316 (2006)","journal-title":"Digital Investigation"},{"key":"6_CR4","unstructured":"Lin, Z., Rhee, J., Zhang, X.: SigGraph: Brute Force Scanning of Kernel Data Structure Instances Using Graph-based Signatures. In: Proc. of 18th Network and Distributed System Security Symposium, San Diego, CA (2011)"},{"key":"6_CR5","doi-asserted-by":"crossref","unstructured":"Ibrahim, A.S., Hamlyn-Harris, J., Grundy, J., Almorsy, M.: CloudSec: A Security Monitoring Appliance for Virtual Machines in the IaaS Cloud Model. In: Proc. of 2011 International Conference on Network and System Security (NSS 2011), Milan, Italy (2011)","DOI":"10.1109\/ICNSS.2011.6059967"},{"key":"6_CR6","unstructured":"Yin, H., Liang, Z., Song, D.: HookFinder: Identifying and understanding malware hooking behaviors. In: Network and Distributed Systems Security Symposium, NDSS (2008)"},{"key":"6_CR7","doi-asserted-by":"crossref","unstructured":"Carbone, M., Cui, W., Lu, L., Lee, W.: Mapping kernel objects to enable systematic integrity checking. In: Proc. of 16th ACM Conference on Computer and Communications Security, Chicago, USA, pp. 555\u2013565 (2009)","DOI":"10.1145\/1653662.1653729"},{"key":"6_CR8","doi-asserted-by":"crossref","unstructured":"Hofmann, O.S., Dunn, A.M., Kim, S.: Ensuring operating system kernel integrity with OSck. In: Proc. of 16th International Conference on Architectural Support for Programming Languages and Operating Systems, California, USA, pp. 279\u2013290 (2011)","DOI":"10.1145\/1950365.1950398"},{"key":"6_CR9","doi-asserted-by":"crossref","unstructured":"Liang, B., You, W., Shi, W., Liang, Z.: Detecting stealthy malware with inter-structure and imported signatures. In: Proc. of the 6th ACM Symposium on Information, Computer and Communications Security, Hong Kong, China, pp. 217\u2013227 (2011)","DOI":"10.1145\/1966913.1966941"},{"key":"6_CR10","unstructured":"Lin, Z., Rhee, J., Wu, C., Zhang, X., Xu, D.: Discovering Semantic Data of Interest from Un-mappable Memory with Confidence. In: Proc. of the 19th Network and Distributed System Security Symposium, San Diego, CA (2012)"},{"key":"6_CR11","unstructured":"Ibrahim, A.S., Hamlyn-Harris, J., Grundy, J.: Emerging Security Challenges of Cloud Virtual Infrastructure. In: Proc. of 2010 Asia Pacific Cloud Workshop Co-located with APSEC 2010, Sydney, Australia (2010)"},{"key":"6_CR12","unstructured":"Petroni, N.L., Fraser, T., Walters, A., Arbaugh, W.A.: An architecture for specification-based detection of semantic integrity violations in kernel dynamic data. In: Proc. of 15th Conference on USENIX Security Symposium, Canada, vol.\u00a015 (2006)"},{"key":"6_CR13","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"178","DOI":"10.1007\/978-3-642-15512-3_10","volume-title":"Recent Advances in Intrusion Detection","author":"J. Rhee","year":"2010","unstructured":"Rhee, J., Riley, R., Xu, D., Jiang, X.: Kernel Malware Analysis with Un-tampered and Temporal Views of Dynamic Kernel Memory. In: Jha, S., Sommer, R., Kreibich, C. (eds.) RAID 2010. LNCS, vol.\u00a06307, pp. 178\u2013197. Springer, Heidelberg (2010)"},{"key":"6_CR14","doi-asserted-by":"crossref","unstructured":"Ibrahim, A.S., Grundy, J.C., Hamlyn-Harris, J., Almorsy, M.: Supporting Operating System Kernel Data Disambiguation using Points-to Analysis. In: Proc. of 27th IEEE\/ACM International Conference on Automated Software Engineering, Essen, Germany (2012)","DOI":"10.1145\/2351676.2351710"},{"key":"6_CR15","doi-asserted-by":"crossref","unstructured":"Ibrahim, A.S., Hamlyn-Harris, J., Grundy, J., Almorsy, M.: Operating System Kernel Data Disambiguation to Support Security Analysis\u201d. In: Proc. of 6th International Conference on Network and System Security (NSS 2012), Fujian, China. Springer (2012)","DOI":"10.1007\/978-3-642-34601-9_20"},{"key":"6_CR16","unstructured":"Russinovich, M., Solomon, D., Ionescu, A.: Windows Internals, 5th edn. Microsoft Press (2009)"},{"key":"6_CR17","unstructured":"Nanavati, M., Kothari, B.: Hidden Processes Detection using the PspCidTable. In: MIEL Labs (2010) (accessed November 2010)"},{"key":"6_CR18","doi-asserted-by":"crossref","unstructured":"Riley, R., Jiang, X., Xu, D.: Multi-aspect profiling of kernel rootkit behavior. In: Proc. of the 4th ACM European Conference on Computer Systems, Germany, pp. 47\u201360 (2009)","DOI":"10.1145\/1519065.1519072"},{"key":"6_CR19","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"crossref","first-page":"304","DOI":"10.1007\/978-3-642-04342-0_16","volume-title":"RAID 2009","author":"C. Xuan","year":"2009","unstructured":"Xuan, C., Copeland, J., Beyah, R.: Toward Revealing Kernel Malware Behavior in Virtual Execution Environments. In: Kirda, E., Jha, S., Balzarotti, D. (eds.) RAID 2009. LNCS, vol.\u00a05758, pp. 304\u2013325. Springer, Heidelberg (2009)"},{"key":"6_CR20","unstructured":"Jones, S., Arpaci-Dusseau, A., Arpaci, R.: Antfarm: tracking processes in a virtual machine environment. In: Proc. of USENIX 2006 Annual Technical Conference, Boston (2006)"},{"key":"6_CR21","doi-asserted-by":"crossref","unstructured":"Jones, S.T., Arpaci-Dusseau, A.C., Arpaci-Dusseau, R.H.: VMM-based hidden process detection and identification using Lycosid. In: Proc. of the Fourth ACM SIGPLAN\/SIGOPS International Conference on Virtual Execution Environments, USA, pp. 91\u2013100 (2008)","DOI":"10.1145\/1346256.1346269"}],"container-title":["Lecture Notes in Computer Science","Network and System Security"],"original-title":[],"link":[{"URL":"http:\/\/link.springer.com\/content\/pdf\/10.1007\/978-3-642-34601-9_6.pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2021,5,4]],"date-time":"2021-05-04T09:00:35Z","timestamp":1620118835000},"score":1,"resource":{"primary":{"URL":"http:\/\/link.springer.com\/10.1007\/978-3-642-34601-9_6"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2012]]},"ISBN":["9783642346002","9783642346019"],"references-count":21,"URL":"https:\/\/doi.org\/10.1007\/978-3-642-34601-9_6","relation":{},"ISSN":["0302-9743","1611-3349"],"issn-type":[{"type":"print","value":"0302-9743"},{"type":"electronic","value":"1611-3349"}],"subject":[],"published":{"date-parts":[[2012]]}}}