{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,1,25]],"date-time":"2026-01-25T12:54:40Z","timestamp":1769345680657,"version":"3.49.0"},"reference-count":54,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"1","license":[{"start":{"date-parts":[[2014,1,1]],"date-time":"2014-01-01T00:00:00Z","timestamp":1388534400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans.Inform.Forensic Secur."],"published-print":{"date-parts":[[2014,1]]},"DOI":"10.1109\/tifs.2013.2291964","type":"journal-article","created":{"date-parts":[[2014,1,3]],"date-time":"2014-01-03T18:56:10Z","timestamp":1388775370000},"page":"72-87","source":"Crossref","is-referenced-by-count":17,"title":["Data-Centric OS Kernel Malware Characterization"],"prefix":"10.1109","volume":"9","author":[{"given":"Junghwan","family":"Rhee","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Ryan","family":"Riley","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Zhiqiang","family":"Lin","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Xuxian","family":"Jiang","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Dongyan","family":"Xu","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"263","reference":[{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-15512-3_10"},{"key":"ref38","first-page":"289","article-title":"An architecture for specification-based detection of semantic integrity violations in kernel dynamic data","author":"petroni","year":"2006","journal-title":"Proc 15th Conf USENIX Sec Symp"},{"key":"ref33","article-title":"The advanced return-into-lib(c) exploits: PaX case study","volume":"11","year":"2001","journal-title":"Phrack"},{"key":"ref32","article-title":"The magnificence of the disaster: Reconstructing the Sony BMG rootkit incident","author":"mulligan","year":"2007","journal-title":"22 Berkeley Tech L J 1157"},{"key":"ref31","year":"2013","journal-title":"Common Vulnerabilities and Exposures"},{"key":"ref30","year":"2007","journal-title":"Driver Signing Requirements for Windows"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1016\/j.diin.2006.10.001"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1145\/1315245.1315260"},{"key":"ref35","first-page":"179","article-title":"Copilot?A coprocessor-based kernel runtime integrity monitor","author":"petroni","year":"2004","journal-title":"Proc 13th USENIX Sec Symp"},{"key":"ref34","year":"2013","journal-title":"Parallels"},{"key":"ref28","first-page":"1","article-title":"SigGraph: Brute force scanning of kernel data structure instances using graph-based signatures","author":"lin","year":"2011","journal-title":"Proc 18th Annu NDSS"},{"key":"ref27","first-page":"1","article-title":"Defeating return-oriented rootkits with ?return-less? kernels","author":"li","year":"2010","journal-title":"Proc 5th ACM Eur Conf Comput Syst"},{"key":"ref29","first-page":"107","article-title":"Polymorphing software by randomizing data structure layout","author":"lin","year":"2009","journal-title":"Proc 6th Int Conf DIMVA"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1109\/ACSAC.2008.29"},{"key":"ref1","first-page":"1","article-title":"Control-flow integrity: Principles, implementations, and applications","author":"abadi","year":"2005","journal-title":"Proc 10th ACM Conf CCS"},{"key":"ref20","author":"etoh","year":"2011","journal-title":"GCC Extension for Protecting Applications From Stack-Smashing Attacksru"},{"key":"ref22","year":"2013","journal-title":"The GNU compiler collection"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1145\/1655077.1655083"},{"key":"ref24","year":"2011","journal-title":"Virtualbox"},{"key":"ref23","first-page":"383","article-title":"Return-oriented rootkits: Bypassing kernel code integrity protection mechanisms","author":"hund","year":"2009","journal-title":"Proc 18th USENIX Sec Symp"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1109\/CSAC.2004.19"},{"key":"ref25","first-page":"351","article-title":"Effective and efficient malware detection at the end host","author":"kolbitsch","year":"2009","journal-title":"Proc 18th USENIX Sec Symp"},{"key":"ref50","year":"2013","journal-title":"US-CERT Vulnerability Notes Database"},{"key":"ref51","year":"2011","journal-title":"Stack Shield A ?Stack Smashing? Technique Protection Tool for Linux"},{"key":"ref54","first-page":"304","article-title":"Toward revealing kernel malware behavior in virtual execution environments","author":"xuan","year":"2009","journal-title":"Proc 12th Int Symp RAID"},{"key":"ref53","first-page":"193","article-title":"Protection of software-based survivability mechanisms","author":"wang","year":"2001","journal-title":"Proc Int Conf DSN"},{"key":"ref52","year":"2013","journal-title":"VMware Workstation Run Multiple OS Linux Windows 8 & More"},{"key":"ref10","first-page":"163","article-title":"DROP: Detecting return-oriented programming malicious code","author":"chen","year":"2009","journal-title":"Proc 5th ICISS"},{"key":"ref11","first-page":"169","article-title":"Static analysis of executables to detect malicious patterns","author":"christodorescu","year":"2003","journal-title":"Proc 12th USENIX Sec Symp"},{"key":"ref40","author":"rhee","year":"2010","journal-title":"LiveDM Temporal mapping of dynamic kernel memory for dynamic kernel malware analysis and debugging"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1145\/1287624.1287628"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1145\/268946.268962"},{"key":"ref14","first-page":"63","article-title":"StackGuard: Automatic adaptive detection and prevention of buffer-overflow attacks","author":"cowan","year":"1998","journal-title":"Proc 7th USENIX Sec Conf"},{"key":"ref15","first-page":"1","article-title":"Digging for data structures","author":"cozzie","year":"2008","journal-title":"Proc USENIX OSDI Symp"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1145\/1655108.1655117"},{"key":"ref17","author":"davi","year":"2010","journal-title":"ROPdefender A Detection Tool to Defend Against Return-Oriented Programming Attacks"},{"key":"ref18","year":"2001","journal-title":"Linux On-the-fly Kernel Patching Without LKM"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1145\/1653662.1653730"},{"key":"ref4","first-page":"1","article-title":"Scalable, behavior-based malware clustering","author":"bayer","year":"2009","journal-title":"Proc 16th Symp NDSS"},{"key":"ref3","first-page":"1","article-title":"Efficient detection of split personalities in malware","author":"balzarotti","year":"2010","journal-title":"Proc 17th Annu NDSS"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1145\/1455770.1455776"},{"key":"ref5","first-page":"41","article-title":"QEMU: A fast and portable dynamic translator","author":"bellard","year":"2005","journal-title":"Proc USENIX Annu Tech Conf"},{"key":"ref8","year":"2010","journal-title":"Bypassing Non-Executable Stack during Exploitation Using Return-to-LibC"},{"key":"ref7","author":"butler","year":"2012","journal-title":"DKOM (Direct Kernel Object Manipulation)"},{"key":"ref49","year":"2006","journal-title":"The Month of Kernel Bugs (MoKB) Archive"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1145\/1653662.1653729"},{"key":"ref46","first-page":"1","article-title":"The geometry of innocent flesh on the bone: Return-into-libc without function calls (on the x86)","author":"shacham","year":"2007","journal-title":"Proc 10th ACM Conf CCS"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1145\/1294261.1294294"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2009.27"},{"key":"ref47","first-page":"65","article-title":"Impeding malware analysis using conditional code obfuscation","author":"sharif","year":"2008","journal-title":"Proc 15th Annu NDSS"},{"key":"ref42","first-page":"1","article-title":"Guest-transparent prevention of kernel rootkits with VMM-based memory shadowing","author":"riley","year":"2008","journal-title":"Proc 11th Int Symp RAID"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2013.04.006"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1145\/1519065.1519072"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2010.1"}],"container-title":["IEEE Transactions on Information Forensics and Security"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/10206\/6684617\/06671356.pdf?arnumber=6671356","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2021,11,29]],"date-time":"2021-11-29T20:45:14Z","timestamp":1638218714000},"score":1,"resource":{"primary":{"URL":"http:\/\/ieeexplore.ieee.org\/document\/6671356\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2014,1]]},"references-count":54,"journal-issue":{"issue":"1"},"URL":"https:\/\/doi.org\/10.1109\/tifs.2013.2291964","relation":{},"ISSN":["1556-6013","1556-6021"],"issn-type":[{"value":"1556-6013","type":"print"},{"value":"1556-6021","type":"electronic"}],"subject":[],"published":{"date-parts":[[2014,1]]}}}