{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,25]],"date-time":"2026-03-25T14:29:58Z","timestamp":1774448998194,"version":"3.50.1"},"reference-count":35,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","license":[{"start":{"date-parts":[[2019,1,1]],"date-time":"2019-01-01T00:00:00Z","timestamp":1546300800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/legalcode"}],"funder":[{"DOI":"10.13039\/501100012166","name":"National Basic Research Program of China","doi-asserted-by":"publisher","award":["2016QY07X1404"],"award-info":[{"award-number":["2016QY07X1404"]}],"id":[{"id":"10.13039\/501100012166","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["61602035"],"award-info":[{"award-number":["61602035"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["61772078"],"award-info":[{"award-number":["61772078"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100002367","name":"Chinese Academy of Sciences","doi-asserted-by":"publisher","id":[{"id":"10.13039\/501100002367","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Access"],"published-print":{"date-parts":[[2019]]},"DOI":"10.1109\/access.2019.2928060","type":"journal-article","created":{"date-parts":[[2019,7,10]],"date-time":"2019-07-10T20:08:57Z","timestamp":1562789337000},"page":"91657-91666","source":"Crossref","is-referenced-by-count":25,"title":["A Kernel Rootkit Detection Approach Based on Virtualization and Machine Learning"],"prefix":"10.1109","volume":"7","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-2217-4514","authenticated-orcid":false,"given":"Donghai","family":"Tian","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Rui","family":"Ma","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Xiaoqi","family":"Jia","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Changzhen","family":"Hu","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"263","reference":[{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-04342-0_16"},{"key":"ref32","author":"wyke","year":"2012","journal-title":"The ZeroAccess Rootkit"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-74320-0_12"},{"key":"ref30","first-page":"455","article-title":"MrKIP: Rootkit recognition with kernel function invocation pattern","volume":"31","author":"wang","year":"2015","journal-title":"J Inf Sci Eng"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-11212-1_27"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1002\/sec.1282"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-93563-8_12"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.2016.2589242"},{"key":"ref12","year":"0","journal-title":"64 and IA-32 Architectures Software Developer's Manual"},{"key":"ref13","first-page":"287","article-title":"BareCloud: Bare-metal analysis-based evasive malware detection","author":"kirat","year":"2014","journal-title":"Proc 23rd USENIX Secur Symp"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1109\/CSAC.2004.19"},{"key":"ref15","first-page":"255","article-title":"K-tracer: A system for extracting kernel malware behavior","author":"lanzi","year":"2009","journal-title":"Proc 16th Annu Netw Distrib Syst Secur Symp (NDSS)"},{"key":"ref16","first-page":"511","article-title":"KI-Mon: A hardware-assisted event-triggered monitoring platform for mutable kernel object","author":"lee","year":"2013","journal-title":"Proc 22nd USENIX Secur Symp"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1145\/2664243.2664252"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2015.2443803"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1109\/ACSAC.2007.21"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1002\/spe.2576"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1109\/HOTOS.2001.990073"},{"key":"ref27","article-title":"Detect kernel-mode rootkits via real time logging & controlling memory access","author":"tanda","year":"2017","journal-title":"Proc ADFSL Conf Digit Forensics Secur Law"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1145\/1653662.1653729"},{"key":"ref6","first-page":"601","article-title":"Tracking rootkit footprints with a practical memory analysis system","author":"cui","year":"2012","journal-title":"Proc 21st USENIX Security Symp"},{"key":"ref29","first-page":"1","article-title":"Kruiser: Semi-synchronized non-blocking concurrent kernel heap buffer overflow monitoring","author":"tian","year":"2012","journal-title":"Proc 19th Netw Distrib Syst Secur Symp"},{"key":"ref5","year":"2017","journal-title":"Intel 64 and IA-32 Architectures Software Developer’s Manuals (Volume 3 Charpter 24)"},{"key":"ref8","author":"ferrie","year":"2006","journal-title":"Attacks on more virtual machine emulators"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1145\/1858996.1859085"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-40667-1_11"},{"key":"ref9","first-page":"191","article-title":"A virtual machine introspection based architecture for intrusion detection","author":"garfinkel","year":"2003","journal-title":"Proc 10th Annu Netw Distrib Syst Secur Symp (NDSS)"},{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1145\/945461.945462"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2014.2337256"},{"key":"ref22","first-page":"179","article-title":"Copilot—A coprocessor-based kernel runtime integrity monitor","author":"petroni","year":"2004","journal-title":"Proc 13th Conf USENIX Security Symp (SSYM '04)"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-14215-4_3"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2013.2291964"},{"key":"ref23","first-page":"1","article-title":"Binary rewriting of an operating system kernel","author":"rajagopalan","year":"2006","journal-title":"Proc Workshop Binary Instrum Appl"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1145\/3052973.3052999"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-00470-5_31"}],"container-title":["IEEE Access"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/6287639\/8600701\/08759003.pdf?arnumber=8759003","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2021,8,10]],"date-time":"2021-08-10T19:40:06Z","timestamp":1628624406000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/8759003\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2019]]},"references-count":35,"URL":"https:\/\/doi.org\/10.1109\/access.2019.2928060","relation":{},"ISSN":["2169-3536"],"issn-type":[{"value":"2169-3536","type":"electronic"}],"subject":[],"published":{"date-parts":[[2019]]}}}