{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,6,19]],"date-time":"2025-06-19T04:38:31Z","timestamp":1750307911170,"version":"3.41.0"},"publisher-location":"New York, NY, USA","reference-count":26,"publisher":"ACM","license":[{"start":{"date-parts":[[2007,3,11]],"date-time":"2007-03-11T00:00:00Z","timestamp":1173571200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2007,3,11]]},"DOI":"10.1145\/1244002.1244070","type":"proceedings-article","created":{"date-parts":[[2007,6,6]],"date-time":"2007-06-06T14:37:31Z","timestamp":1181140651000},"page":"276-283","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":32,"title":["Towards a tamper-resistant kernel rootkit detector"],"prefix":"10.1145","author":[{"given":"Nguyen Anh","family":"Quynh","sequence":"first","affiliation":[{"name":"Keio university, Fujisawa, Japan"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Yoshiyasu","family":"Takefuji","sequence":"additional","affiliation":[{"name":"Keio university, Fujisawa, Japan"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"320","published-online":{"date-parts":[[2007,3,11]]},"reference":[{"key":"e_1_3_2_1_1_1","unstructured":"buffer. Hijacking Linux Page Fault Handler Exception Table. http:\/\/www.phrack.org\/show.php?p=61&a=7 August 2003.  buffer. Hijacking Linux Page Fault Handler Exception Table. http:\/\/www.phrack.org\/show.php?p=61&a=7 August 2003."},{"key":"e_1_3_2_1_2_1","doi-asserted-by":"publisher","DOI":"10.1145\/945445.945462"},{"key":"e_1_3_2_1_3_1","unstructured":"DWARF Workgroup. DWARF Debugging Format Standard. http:\/\/dwarf.freestandards.org\/Home.php January 2006.  DWARF Workgroup. DWARF Debugging Format Standard. http:\/\/dwarf.freestandards.org\/Home.php January 2006."},{"volume-title":"University of Maryland Institute for Advanced Computer Studies","year":"2004","author":"Fraser T.","key":"e_1_3_2_1_4_1"},{"key":"e_1_3_2_1_5_1","unstructured":"FuSyS. KSTAT: Kernel Security Therapy Anti-Trolls. http:\/\/www.s0ftpj.org\/tools\/kstat.tgz February 2002.  FuSyS. KSTAT: Kernel Security Therapy Anti-Trolls. http:\/\/www.s0ftpj.org\/tools\/kstat.tgz February 2002."},{"volume-title":"Network and Distributed Systems Security Symposium","year":"2003","author":"Garfinkel T.","key":"e_1_3_2_1_6_1"},{"key":"e_1_3_2_1_7_1","doi-asserted-by":"publisher","DOI":"10.1109\/IAW.2005.1495930"},{"key":"e_1_3_2_1_8_1","unstructured":"S. Inc. W32\/Sdbot-ADD Worm. http:\/\/www.sophos.com\/virusinfo\/analyses\/w32sdbotadd.html September 2005.  S. Inc. W32\/Sdbot-ADD Worm. http:\/\/www.sophos.com\/virusinfo\/analyses\/w32sdbotadd.html September 2005."},{"key":"e_1_3_2_1_9_1","unstructured":"Joris Evers. Rootkits get better at hiding. http:\/\/news.com.com\/2100-7355_3-6095762. html?part=rss&tag=6095762&subj=news July 2006.  Joris Evers. Rootkits get better at hiding. http:\/\/news.com.com\/2100-7355_3-6095762. html?part=rss&tag=6095762&subj=news July 2006."},{"key":"e_1_3_2_1_10_1","first-page":"179","volume-title":"USENIX Security Symposium","author":"Fraser N. L. P. Jr., T.","year":"2004"},{"key":"e_1_3_2_1_11_1","unstructured":"kad. Handling Interrupt Descriptor Table for fun and profit. http:\/\/www.phrack.org\/phrack\/59\/p59-0x04.txt December 2002.  kad. Handling Interrupt Descriptor Table for fun and profit. http:\/\/www.phrack.org\/phrack\/59\/p59-0x04.txt December 2002."},{"key":"e_1_3_2_1_12_1","doi-asserted-by":"publisher","DOI":"10.5555\/1018420.1019724"},{"key":"e_1_3_2_1_13_1","unstructured":"McAfee Avert Labs. Rootkits Part 1 of 3: The Growing Threat. http:\/\/www.mcafee.com\/us\/local_content\/white_papers\/threat_center\/wp_newappleofmalwareseye_en.pdf April 2006.  McAfee Avert Labs. Rootkits Part 1 of 3: The Growing Threat. http:\/\/www.mcafee.com\/us\/local_content\/white_papers\/threat_center\/wp_newappleofmalwareseye_en.pdf April 2006."},{"key":"e_1_3_2_1_14_1","unstructured":"T. Miller. Analysis of the Knark rootkit. www.ossec.net\/rootkits\/studies\/knark.txt 2001.  T. Miller. Analysis of the Knark rootkit. www.ossec.net\/rootkits\/studies\/knark.txt 2001."},{"key":"e_1_3_2_1_15_1","unstructured":"rd. Writing Linux kernel keylogger. http:\/\/www.phrack.org\/phrack\/59\/p59-0x0e.txt July 2002.  rd. Writing Linux kernel keylogger. http:\/\/www.phrack.org\/phrack\/59\/p59-0x0e.txt July 2002."},{"key":"e_1_3_2_1_16_1","unstructured":"Redhat Inc. Crash-util. http:\/\/people.redhat.com\/anderson\/ July 2006.  Redhat Inc. Crash-util. http:\/\/people.redhat.com\/anderson\/ July 2006."},{"key":"e_1_3_2_1_17_1","unstructured":"sd. Linux on-the-fly kernel patching. http:\/\/www.phrack.org\/show.php?p=58&a=7 July 2002.  sd. Linux on-the-fly kernel patching. http:\/\/www.phrack.org\/show.php?p=58&a=7 July 2002."},{"key":"e_1_3_2_1_18_1","unstructured":"SGI Inc. LKCD - Linux Kernel Crash Dump. http:\/\/lkcd.sf.net April 2006.  SGI Inc. LKCD - Linux Kernel Crash Dump. http:\/\/lkcd.sf.net April 2006."},{"key":"e_1_3_2_1_19_1","unstructured":"Silvio Cesare. SysCall redirection without modifying the SysCall table. http:\/\/vx.netlux.org\/lib\/vsc05.html 1999.  Silvio Cesare. SysCall redirection without modifying the SysCall table. http:\/\/vx.netlux.org\/lib\/vsc05.html 1999."},{"key":"e_1_3_2_1_20_1","unstructured":"stealth. adore-ng rootkit. http:\/\/stealth.7530.org\/rootkits\/ March 2004.  stealth. adore-ng rootkit. http:\/\/stealth.7530.org\/rootkits\/ March 2004."},{"key":"e_1_3_2_1_21_1","unstructured":"The Honeynet Project. Know your enemy: Sebek. http:\/\/www.honeynet.org\/papers\/sebek.pdf November 2003.  The Honeynet Project. Know your enemy: Sebek. http:\/\/www.honeynet.org\/papers\/sebek.pdf November 2003."},{"key":"e_1_3_2_1_22_1","unstructured":"Tim Lawless. StMichael: Kernel-level IDS. http:\/\/sourceforge.net\/projects\/stjude December 2005.  Tim Lawless. StMichael: Kernel-level IDS. http:\/\/sourceforge.net\/projects\/stjude December 2005."},{"key":"e_1_3_2_1_23_1","unstructured":"ubra. Process hiding and the Linux scheduler. http:\/\/www.phrack.org\/show.php?p=63&a=12 August 2005.  ubra. Process hiding and the Linux scheduler. http:\/\/www.phrack.org\/show.php?p=63&a=12 August 2005."},{"key":"e_1_3_2_1_24_1","unstructured":"Wojciech Purczynski. Linux kernel ptrace\/kmod local root exploit http:\/\/www.securiteam.com\/exploits\/5CPOQOU9FY.html March 2003.  Wojciech Purczynski. Linux kernel ptrace\/kmod local root exploit http:\/\/www.securiteam.com\/exploits\/5CPOQOU9FY.html March 2003."},{"key":"e_1_3_2_1_25_1","unstructured":"Xen project. Xen interface manual http:\/\/www.cl.cam.ac.uk\/Research\/SRG\/netos\/xen\/readmes\/interface\/interface.html August 2006.  Xen project. Xen interface manual http:\/\/www.cl.cam.ac.uk\/Research\/SRG\/netos\/xen\/readmes\/interface\/interface.html August 2006."},{"key":"e_1_3_2_1_26_1","doi-asserted-by":"publisher","DOI":"10.1145\/1133373.1133423"}],"event":{"name":"SAC07: The 2007 ACM Symposium on Applied Computing","sponsor":["SIGAPP ACM Special Interest Group on Applied Computing"],"location":"Seoul Korea","acronym":"SAC07"},"container-title":["Proceedings of the 2007 ACM symposium on Applied computing"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/1244002.1244070","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/1244002.1244070","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,18]],"date-time":"2025-06-18T14:47:50Z","timestamp":1750258070000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/1244002.1244070"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2007,3,11]]},"references-count":26,"alternative-id":["10.1145\/1244002.1244070","10.1145\/1244002"],"URL":"https:\/\/doi.org\/10.1145\/1244002.1244070","relation":{},"subject":[],"published":{"date-parts":[[2007,3,11]]},"assertion":[{"value":"2007-03-11","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}