{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2023,2,16]],"date-time":"2023-02-16T22:18:11Z","timestamp":1676585891003},"reference-count":38,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"4","license":[{"start":{"date-parts":[[2011,12,1]],"date-time":"2011-12-01T00:00:00Z","timestamp":1322697600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans.Inform.Forensic Secur."],"published-print":{"date-parts":[[2011,12]]},"DOI":"10.1109\/tifs.2011.2162062","type":"journal-article","created":{"date-parts":[[2011,7,20]],"date-time":"2011-07-20T20:23:07Z","timestamp":1311193387000},"page":"1323-1334","source":"Crossref","is-referenced-by-count":2,"title":["PEDA: Comprehensive Damage Assessment for Production Environment Server Systems"],"prefix":"10.1109","volume":"6","author":[{"given":"Shengzhi","family":"Zhang","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Xiaoqi","family":"Jia","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Peng","family":"Liu","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Jiwu","family":"Jing","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"263","reference":[{"key":"ref38","first-page":"2","article-title":"Optimizing network virtualization in Xen","author":"menon","year":"2006","journal-title":"Proc USENIX Annu Tech Conf"},{"key":"ref33","first-page":"80","author":"thomas","year":"1996","journal-title":"Hypervisor-Based Fault Tolerance"},{"key":"ref32","author":"tao","year":"2010","journal-title":"Strict Control Dependence and its Effect on Dynamic Information Flow Analyses"},{"key":"ref31","author":"min","year":"2011","journal-title":"DTA++ Dynamic Taint Analysis with Targeted Control-Flow Propagation"},{"key":"ref30","author":"chen","year":"2001","journal-title":"When virtual is Better Than Real"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1145\/1095810.1095824"},{"key":"ref36","first-page":"18","article-title":"Dynamic spyware analysis","author":"egele","year":"2007","journal-title":"Proc USENIX Annu Tech Conf"},{"key":"ref35","author":"asia","year":"2009","journal-title":"Pointless Tainting? Evaluating the Practicality of Pointer Tainting"},{"key":"ref34","year":"0","journal-title":"Intel 82093AA (I\/O APIC) Datasheet"},{"key":"ref10","year":"0","journal-title":"Intrusion Analysis Curriculum"},{"key":"ref11","first-page":"1","article-title":"Decoupling dynamic program analysis from execution in virtual environments","author":"chow","year":"2008","journal-title":"Proc USENIX Annu Tech Conf"},{"key":"ref12","author":"edward","year":"2004","journal-title":"Secure program execution via dynamic information flow tracking"},{"key":"ref13","author":"yin","year":"2008","journal-title":"HookFinder Identifying and Understanding Malware Hooking Behaviors"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1145\/1519065.1519072"},{"key":"ref15","author":"zhu","year":"2003","journal-title":"Design Implementation and Evaluation of Repairable File Service"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1145\/1920261.1920306"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1145\/1134760.1134765"},{"key":"ref18","author":"northcutt","year":"2001","journal-title":"Intrusion Signatures and Analysis"},{"key":"ref19","year":"0","journal-title":"Entercept Security Technologies System Call Interception Whitepaper"},{"key":"ref28","author":"xu","year":"2007","journal-title":"Retrace Collecting Execution Trace With Virtual Machine Deterministic Replay"},{"key":"ref4","author":"wang","year":"2008","journal-title":"Countering Persistent Kernel Rootkits Through Systematic Hook Discovery"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1109\/FITS.2003.1264947"},{"key":"ref3","first-page":"2","article-title":"Using valgrind to detect undefined value errors with bit-precision","author":"seward","year":"2005","journal-title":"Proc USENIX Annu Tech Conf"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1145\/1060289.1060309"},{"key":"ref29","year":"0","journal-title":"Linux NULL Pointer Dereference due to Incorrect Proto ops Initializations"},{"key":"ref5","first-page":"1","article-title":"A secure environment for untrusted helper applications","author":"goldberg","year":"1996","journal-title":"Proc Usenix Security Symp"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1145\/323647.323629"},{"key":"ref7","author":"jiang","year":"2007","journal-title":"Stealthy Malware Detection Through VMM-Based out-of-the-box Semantic View Reconstruction"},{"key":"ref2","year":"0","journal-title":"Enterprise Intrusion Analysis (SC-375)"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1145\/1217935.1217939"},{"key":"ref1","author":"trost","year":"2009","journal-title":"Practical Intrusion Analysis Prevention and Detection for the Twenty-First Century"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1109\/TPDS.2007.70765"},{"key":"ref22","author":"portokalidis","year":"2006","journal-title":"Argos An Emulator for Fingerprinting Zero-day Attacks"},{"key":"ref21","first-page":"1","article-title":"MAPbox: Using parameterized behavior classes to confine untrusted applications","author":"acharya","year":"2000","journal-title":"Proc Usenix Security Symp"},{"key":"ref24","author":"yin","year":"2007","journal-title":"Panorama Capturing System-Wide Information Flow for Malware Detection and Analysis"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1145\/945465.945467"},{"key":"ref26","year":"0","journal-title":"Explorations With Adore-ng"},{"key":"ref25","year":"0","journal-title":"Ark-1 0 1 tar gz"}],"container-title":["IEEE Transactions on Information Forensics and Security"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx5\/10206\/6069499\/05954181.pdf?arnumber=5954181","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2021,10,10]],"date-time":"2021-10-10T23:48:05Z","timestamp":1633909685000},"score":1,"resource":{"primary":{"URL":"http:\/\/ieeexplore.ieee.org\/document\/5954181\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2011,12]]},"references-count":38,"journal-issue":{"issue":"4"},"URL":"https:\/\/doi.org\/10.1109\/tifs.2011.2162062","relation":{},"ISSN":["1556-6013"],"issn-type":[{"value":"1556-6013","type":"print"}],"subject":[],"published":{"date-parts":[[2011,12]]}}}