{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,2,21]],"date-time":"2025-02-21T21:06:30Z","timestamp":1740171990539,"version":"3.37.3"},"reference-count":61,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"1","license":[{"start":{"date-parts":[[2021,1,1]],"date-time":"2021-01-01T00:00:00Z","timestamp":1609459200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2021,1,1]],"date-time":"2021-01-01T00:00:00Z","timestamp":1609459200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2021,1,1]],"date-time":"2021-01-01T00:00:00Z","timestamp":1609459200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"name":"ONR","award":["N00014-17-1-2485"],"award-info":[{"award-number":["N00014-17-1-2485"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans. Cloud Comput."],"published-print":{"date-parts":[[2021,1,1]]},"DOI":"10.1109\/tcc.2018.2855143","type":"journal-article","created":{"date-parts":[[2018,7,11]],"date-time":"2018-07-11T19:07:19Z","timestamp":1531336039000},"page":"401-413","source":"Crossref","is-referenced-by-count":2,"title":["Virtual Machine Extrospection: A Reverse Information Retrieval in Clouds"],"prefix":"10.1109","volume":"9","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-6807-9999","authenticated-orcid":false,"given":"Jidong","family":"Xiao","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-9204-0226","authenticated-orcid":false,"given":"Lei","family":"Lu","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Hai","family":"Huang","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-9665-7511","authenticated-orcid":false,"given":"Haining","family":"Wang","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"263","reference":[{"year":"0","key":"ref39"},{"year":"0","key":"ref38"},{"article-title":"KVM mailing list discussion","year":"0","author":"kleen","key":"ref33"},{"year":"0","key":"ref32","article-title":"Mistifying the debugger, ultimate stealthness"},{"article-title":"Dr linux 2.6 rootkit released","year":"0","author":"alberts","key":"ref31"},{"year":"2012","key":"ref30"},{"year":"0","key":"ref37"},{"article-title":"Debian google compute engine Kernel improvements, now and future","year":"0","author":"kaplowitz","key":"ref36"},{"key":"ref35","first-page":"105","article-title":"Live upgrading thousands of servers from an ancient red hat distribution to 10 year newer debian based one","author":"merlin","year":"2013","journal-title":"Proc 27th USENIX Int Conf Large Installation Syst Admin"},{"article-title":"KVM: x86: Report valid microcode update id","year":"0","author":"tosatti","key":"ref34"},{"key":"ref60","doi-asserted-by":"publisher","DOI":"10.1109\/SADFE.2011.9"},{"key":"ref61","first-page":"1","article-title":"Hyperprobe: Towards virtual machine extrospection","author":"xiao","year":"2015","journal-title":"Proc 29th USENIX Conf Large Installation Syst Admin"},{"key":"ref28","article-title":"Inside windows server 2008 Kernel changes","author":"russinovich","year":"2008","journal-title":"Microsoft TechNet Mag"},{"journal-title":"Hyper-V 2008 R2 Essentials","year":"2010","author":"smyth","key":"ref27"},{"year":"0","key":"ref29"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1145\/1315245.1315262"},{"key":"ref1","first-page":"191","article-title":"A virtual machine introspection based architecture for intrusion detection","author":"garfinkel","year":"2003","journal-title":"Proc 10th Annu Symp Netw Distrib Syst Security"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1145\/1168857.1168860"},{"key":"ref22","first-page":"19","article-title":"Increasing memory density by using KSM","author":"arcangeli","year":"2009","journal-title":"Proc Linux Symp"},{"key":"ref21","first-page":"423","article-title":"The turtles project: Design and implementation of nested virtualization","author":"ben-yehuda","year":"2010","journal-title":"Proc 9th USENIX Conf Operating Syst Des Implementation"},{"key":"ref24","article-title":"Software side channel attack on memory deduplication","author":"suzaki","year":"2011","journal-title":"Proc 23rd ACM Symp Operating Systems Principles"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1145\/1060289.1060307"},{"key":"ref26","article-title":"Performance evaluation of intel EPT hardware assist","author":"bhatia","year":"2009","journal-title":"VMWare Inc"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1109\/ISCA.2012.6237041"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.1145\/2484402.2484406"},{"year":"0","key":"ref51"},{"article-title":"Leveraging USB to establish host identity using commodity devices","year":"2013","author":"bates","key":"ref59"},{"key":"ref58","doi-asserted-by":"publisher","DOI":"10.1109\/PCCC.2011.6108094"},{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.1145\/2391229.2391234"},{"article-title":"Xprobe v2. 0: A fuzzy approach to remote active operating system fingerprinting","year":"2002","author":"arkin","key":"ref56"},{"journal-title":"Nmap In the Enterprise Your Guide to Network Scanning","year":"2011","author":"orebaugh","key":"ref55"},{"article-title":"Nmap Network Scanning: The Official Nmap Project Guide to Network Discovery and Security Scanning","year":"2009","author":"lyon","key":"ref54"},{"article-title":"An empirical study into the security exposure to hosts of hostile virtualized environments","year":"2007","author":"ormandy","key":"ref53"},{"year":"0","key":"ref52"},{"key":"ref10","article-title":"Compatibility is not transparency: VMM detection myths and realities","author":"garfinkel","year":"2007","journal-title":"Proc 9th USENIX Workshop Hot Topics Operating Syst"},{"key":"ref11","article-title":"Attacks on more virtual machine emulators","author":"ferrie","year":"2007","journal-title":"Symantec Technology Exchange"},{"year":"0","key":"ref40"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1145\/1368506.1368518"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1109\/DSN.2013.6575349"},{"year":"0","key":"ref14"},{"year":"0","key":"ref15"},{"year":"0","key":"ref16"},{"year":"0","key":"ref17"},{"year":"0","key":"ref18"},{"year":"0","key":"ref19"},{"key":"ref4","first-page":"15","article-title":"Collapsar: A VM-based architecture for network attack detention center","author":"jiang","year":"2004","journal-title":"Proc 13th Conf Usenix Security Symp"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1145\/1095809.1095825"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1145\/1315245.1315260"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-87403-4_1"},{"article-title":"Cloudburst: A vmware guest to host escape story","year":"2009","author":"kortchinsky","key":"ref8"},{"key":"ref7","first-page":"243","article-title":"Hypervisor support for identifying covertly executing binaries","author":"litty","year":"2008","journal-title":"Proc 17th Conf USENIX Security Symp"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.1007\/978-0-387-68768-1_5"},{"key":"ref9","article-title":"Virtunoid: Breaking out of KVM","author":"elhage","year":"2011","journal-title":"Black Hat USA"},{"article-title":"Red pill... or how to detect VMM using (almost) one CPU instruction","year":"2004","author":"rutkowska","key":"ref46"},{"key":"ref45","first-page":"4","article-title":"Towards scalable multiprocessor virtual machines","author":"uhlig","year":"2004","journal-title":"Proc 3rd Conf Virtual Mach Res Technol Symp"},{"article-title":"Detecting the presence of virtual machines using the local data table","year":"2006","author":"quist","key":"ref48"},{"article-title":"Scooby doo-vmware fingerprint suite","year":"2003","author":"klein","key":"ref47"},{"key":"ref42","article-title":"Experiences porting KVM to smartOS","author":"cantrill","year":"2011","journal-title":"KVM Forum"},{"year":"0","key":"ref41"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1145\/2451512.2451549"},{"article-title":"KVM: x86: MOV to CR3 can set bit 63","year":"2014","author":"amit","key":"ref43"}],"container-title":["IEEE Transactions on Cloud Computing"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/6245519\/9371451\/08410013.pdf?arnumber=8410013","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2022,5,10]],"date-time":"2022-05-10T14:53:49Z","timestamp":1652194429000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/8410013\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2021,1,1]]},"references-count":61,"journal-issue":{"issue":"1"},"URL":"https:\/\/doi.org\/10.1109\/tcc.2018.2855143","relation":{},"ISSN":["2168-7161","2372-0018"],"issn-type":[{"type":"electronic","value":"2168-7161"},{"type":"electronic","value":"2372-0018"}],"subject":[],"published":{"date-parts":[[2021,1,1]]}}}