{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,18]],"date-time":"2026-10-18T13:52:57Z","timestamp":1792331577375,"version":"4.4.0"},"publisher-location":"New York, NY, USA","reference-count":57,"publisher":"ACM","license":[{"start":{"date-parts":[[2007,10,28]],"date-time":"2007-10-28T00:00:00Z","timestamp":1193529600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2007,10,28]]},"DOI":"10.1145\/1315245.1315262","type":"proceedings-article","created":{"date-parts":[[2007,11,15]],"date-time":"2007-11-15T14:30:20Z","timestamp":1195137020000},"page":"128-138","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":283,"title":["Stealthy malware detection through vmm-based \"out-of-the-box\" semantic view reconstruction"],"prefix":"10.1145","author":[{"given":"Xuxian","family":"Jiang","sequence":"first","affiliation":[{"name":"George Mason University, Fairfax, VA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Xinyuan","family":"Wang","sequence":"additional","affiliation":[{"name":"George Mason University, Fairfax, VA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Dongyan","family":"Xu","sequence":"additional","affiliation":[{"name":"Purdue University, West Lafayette, IN"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2007,10,28]]},"reference":[{"key":"e_1_3_2_1_1_1","unstructured":"Agobot. http:\/\/www.f-secure.com\/v-descs\/agobot.shtml.  Agobot. http:\/\/www.f-secure.com\/v-descs\/agobot.shtml."},{"key":"e_1_3_2_1_2_1","unstructured":"F-Secure Blacklight. http:\/\/www.f-secure.com\/blacklight\/.  F-Secure Blacklight. http:\/\/www.f-secure.com\/blacklight\/."},{"key":"e_1_3_2_1_3_1","unstructured":"FU Rootkit. http:\/\/www.rootkit.com\/project.php?id=12.  FU Rootkit. http:\/\/www.rootkit.com\/project.php?id=12."},{"key":"e_1_3_2_1_4_1","unstructured":"hxdef. http:\/\/hxdef.czweb.org.  hxdef. http:\/\/hxdef.czweb.org."},{"key":"e_1_3_2_1_5_1","unstructured":"KVM\n  : Kernel-based Virtual Machine. http:\/\/kvm.sourceforge.net\/.  KVM: Kernel-based Virtual Machine. http:\/\/kvm.sourceforge.net\/."},{"key":"e_1_3_2_1_6_1","unstructured":"McAfee VirusScan. http:\/\/www.mcafee.com\/us\/enterprise\/products\/anti_virus\/.  McAfee VirusScan. http:\/\/www.mcafee.com\/us\/enterprise\/products\/anti_virus\/."},{"key":"e_1_3_2_1_7_1","unstructured":"Microsoft Windows Defender. http:\/\/www.microsoft.com\/athome\/security\/spyware\/software\/default.mspx.  Microsoft Windows Defender. http:\/\/www.microsoft.com\/athome\/security\/spyware\/software\/default.mspx."},{"key":"e_1_3_2_1_8_1","unstructured":"NTRootkit. http:\/\/www.megasecurity.org\/Tools\/Nt_rootkit_all.html.  NTRootkit. http:\/\/www.megasecurity.org\/Tools\/Nt_rootkit_all.html."},{"key":"e_1_3_2_1_9_1","unstructured":"Rbot. http:\/\/research.sunbelt-software.com\/threatdisplay.aspx?name=Rbot&threatid=14953.  Rbot. http:\/\/research.sunbelt-software.com\/threatdisplay.aspx?name=Rbot&threatid=14953."},{"key":"e_1_3_2_1_10_1","unstructured":"Snort. http:\/\/www.snort.org.  Snort. http:\/\/www.snort.org."},{"key":"e_1_3_2_1_11_1","unstructured":"RootkitRevealer. http:\/\/www.sysinternals.com\/.  RootkitRevealer. http:\/\/www.sysinternals.com\/."},{"key":"e_1_3_2_1_12_1","unstructured":"Symantec AntiVirus. http:\/\/www.symantec.com\/home_homeoffice\/products\/overview.jsp?pcid=is&pvid=nav2007.  Symantec AntiVirus. http:\/\/www.symantec.com\/home_homeoffice\/products\/overview.jsp?pcid=is&pvid=nav2007."},{"key":"e_1_3_2_1_13_1","unstructured":"The adore-ng Rootkit. http:\/\/stealth.openwall.net\/rootkits\/.  The adore-ng Rootkit. http:\/\/stealth.openwall.net\/rootkits\/."},{"key":"e_1_3_2_1_14_1","unstructured":"The Honeynet Project. http:\/\/www.honeynet.org.  The Honeynet Project. http:\/\/www.honeynet.org."},{"key":"e_1_3_2_1_15_1","unstructured":"TRANGO the Real-Time Embedded Hypervisor. http:\/\/www.trango-systems.com\/.  TRANGO the Real-Time Embedded Hypervisor. http:\/\/www.trango-systems.com\/."},{"key":"e_1_3_2_1_16_1","unstructured":"VirtualBox. http:\/\/www.virtualbox.org\/.  VirtualBox. http:\/\/www.virtualbox.org\/."},{"key":"e_1_3_2_1_17_1","unstructured":"VMware. http:\/\/www.vmware.com\/.  VMware. http:\/\/www.vmware.com\/."},{"key":"e_1_3_2_1_18_1","unstructured":"Volume Shadow Copy Service. http:\/\/technet2.microsoft.com\/WindowsServer\/en\/library\/2b0d2457-b7d8-42c3-b6c9-59c145b7765f1033.mspx?mfr=true.  Volume Shadow Copy Service. http:\/\/technet2.microsoft.com\/WindowsServer\/en\/library\/2b0d2457-b7d8-42c3-b6c9-59c145b7765f1033.mspx?mfr=true."},{"key":"e_1_3_2_1_19_1","unstructured":"Wikipedia: File Locking. http:\/\/en.wikipedia.org\/wiki\/File_locking.  Wikipedia: File Locking. http:\/\/en.wikipedia.org\/wiki\/File_locking."},{"key":"e_1_3_2_1_20_1","volume-title":"Mar.","author":"Apache Web Server Chunk CERT","year":"2003","unstructured":"CERT Advisory CA-2002-17 Apache Web Server Chunk Handling Vulnerability . http:\/\/www.cert.org\/advisories\/CA-2002-17.html , Mar. 2003 . CERT Advisory CA-2002-17 Apache Web Server Chunk Handling Vulnerability. http:\/\/www.cert.org\/advisories\/CA-2002-17.html, Mar. 2003."},{"key":"e_1_3_2_1_21_1","volume-title":"Mar.","author":"Ptrace Privilege Escalation Vulnerability Linux Kernel","year":"2003","unstructured":"Linux Kernel Ptrace Privilege Escalation Vulnerability . http:\/\/www.secunia.com\/advisories\/8337\/ , Mar. 2003 . Linux Kernel Ptrace Privilege Escalation Vulnerability. http:\/\/www.secunia.com\/advisories\/8337\/, Mar. 2003."},{"key":"e_1_3_2_1_22_1","volume-title":"http:\/\/www.xensource.com\/files\/xen_interface.pdf","author":"Manual Xen Interface","year":"2004","unstructured":"Xen Interface Manual . http:\/\/www.xensource.com\/files\/xen_interface.pdf , 2004 . Xen Interface Manual. http:\/\/www.xensource.com\/files\/xen_interface.pdf, 2004."},{"key":"e_1_3_2_1_23_1","volume-title":"Proc. of the 14th USENIX Security Symposium","author":"Anagnostakis K. G.","year":"2005","unstructured":"K. G. Anagnostakis , S. Sidiroglou , P. Akritidis , K. Xinidis , E. Markatos , and A. D. Keromytis . Detecting Targeted Attacks Using Shadow Honeypots . Proc. of the 14th USENIX Security Symposium , Aug. 2005 . K. G. Anagnostakis, S. Sidiroglou, P. Akritidis, K. Xinidis, E. Markatos, and A. D. Keromytis. Detecting Targeted Attacks Using Shadow Honeypots. Proc. of the 14th USENIX Security Symposium, Aug. 2005."},{"key":"e_1_3_2_1_24_1","unstructured":"bugcheck. GREPEXEC: Grepping Executive Objects from Pool Memory. http:\/\/www.uninformed.org\/?v=4&a=2&t=sumry June 2006.  bugcheck. GREPEXEC: Grepping Executive Objects from Pool Memory. http:\/\/www.uninformed.org\/?v=4&a=2&t=sumry June 2006."},{"key":"e_1_3_2_1_25_1","doi-asserted-by":"publisher","DOI":"10.5555\/882493.884371"},{"key":"e_1_3_2_1_26_1","doi-asserted-by":"publisher","DOI":"10.1145\/945445.945462"},{"key":"e_1_3_2_1_27_1","volume-title":"Fast and Portable Dynamic Translator. Proc. of USENIX Annual Technical Conference 2005 (FREENIX Track)","author":"Bellard F.","year":"2005","unstructured":"F. Bellard . QEMU , a Fast and Portable Dynamic Translator. Proc. of USENIX Annual Technical Conference 2005 (FREENIX Track) , July 2005 . F. Bellard. QEMU, a Fast and Portable Dynamic Translator. Proc. of USENIX Annual Technical Conference 2005 (FREENIX Track), July 2005."},{"key":"e_1_3_2_1_28_1","unstructured":"F. Bellard. QEMU Accelerator User Documentation. http:\/\/fabrice.bellard.free.fr\/qemu\/kqemu-doc.html 2006.  F. Bellard. QEMU Accelerator User Documentation. http:\/\/fabrice.bellard.free.fr\/qemu\/kqemu-doc.html 2006."},{"key":"e_1_3_2_1_29_1","volume-title":"Schoss Elmau","author":"Peter","year":"2001","unstructured":"Peter M. Chen and Brian D. Noble. When Virtual is Better Than Real. HotOS VIII , Schoss Elmau , Germany , May 2001 . Peter M. Chen and Brian D. Noble. When Virtual is Better Than Real. HotOS VIII, Schoss Elmau, Germany, May 2001."},{"key":"e_1_3_2_1_30_1","doi-asserted-by":"publisher","DOI":"10.5555\/956415.956460"},{"key":"e_1_3_2_1_31_1","unstructured":"J. Dike. User Mode Linux. http:\/\/user-mode-linux.sourceforge.net.  J. Dike. User Mode Linux. http:\/\/user-mode-linux.sourceforge.net."},{"key":"e_1_3_2_1_32_1","doi-asserted-by":"publisher","DOI":"10.5555\/1060289.1060309"},{"key":"e_1_3_2_1_33_1","doi-asserted-by":"publisher","DOI":"10.1145\/945445.945464"},{"key":"e_1_3_2_1_34_1","volume-title":"Proc. of the 2003 Network and Distributed System Security Symposium","author":"Garfinkel T.","year":"2003","unstructured":"T. Garfinkel and M. Rosenblum . A Virtual Machine Introspection Based Architecture for Intrusion Detection . Proc. of the 2003 Network and Distributed System Security Symposium , Feb. 2003 . T. Garfinkel and M. Rosenblum. A Virtual Machine Introspection Based Architecture for Intrusion Detection. Proc. of the 2003 Network and Distributed System Security Symposium, Feb. 2003."},{"key":"e_1_3_2_1_35_1","volume-title":"Proc. of the 13th USENIX Security Symposium","author":"Jiang X.","year":"2004","unstructured":"X. Jiang and D. Xu . Collapsar: A VM-Based Architecture for Network Attack Detention Center . Proc. of the 13th USENIX Security Symposium , Aug. 2004 . X. Jiang and D. Xu. Collapsar: A VM-Based Architecture for Network Attack Detention Center. Proc. of the 13th USENIX Security Symposium, Aug. 2004."},{"key":"e_1_3_2_1_36_1","doi-asserted-by":"publisher","DOI":"10.1007\/11663812_1"},{"key":"e_1_3_2_1_37_1","doi-asserted-by":"publisher","DOI":"10.1145\/1095810.1095820"},{"key":"e_1_3_2_1_38_1","volume-title":"Networking and Security Conference III, USENIX","author":"Kim G. H.","year":"1994","unstructured":"G. H. Kim and E. H. Spafford . Experiences with Tripwire: Using Integrity Checkers for Intrusion Detection. In Systems Administration , Networking and Security Conference III, USENIX , 1994 . G. H. Kim and E. H. Spafford. Experiences with Tripwire: Using Integrity Checkers for Intrusion Detection. In Systems Administration, Networking and Security Conference III, USENIX, 1994."},{"key":"e_1_3_2_1_39_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2006.38"},{"key":"e_1_3_2_1_40_1","volume-title":"Proc. of the 2005 Annual USENIX Technical Conference","author":"King S. T.","year":"2005","unstructured":"S. T. King , G. W. Dunlap , and P. M. Chen . Debugging Operating Systems with Time-Traveling Virtual Machines . Proc. of the 2005 Annual USENIX Technical Conference , Apr. 2005 . S. T. King, G. W. Dunlap, and P. M. Chen. Debugging Operating Systems with Time-Traveling Virtual Machines. Proc. of the 2005 Annual USENIX Technical Conference, Apr. 2005."},{"key":"e_1_3_2_1_41_1","volume-title":"http:\/\/www.trapkit.de\/research\/vmm\/scoopydoo\/index.html","author":"Klein T.","year":"2003","unstructured":"T. Klein . Scooby Doo - V Mware Fingerprint Suite . http:\/\/www.trapkit.de\/research\/vmm\/scoopydoo\/index.html , 2003 . T. Klein. Scooby Doo - VMware Fingerprint Suite. http:\/\/www.trapkit.de\/research\/vmm\/scoopydoo\/index.html, 2003."},{"key":"e_1_3_2_1_42_1","doi-asserted-by":"publisher","DOI":"10.1145\/1064979.1064992"},{"key":"e_1_3_2_1_43_1","unstructured":"K. Kortchinsky. Honeypots: Counter measures to VMware fingerprinting. http:\/\/seclists.org\/lists\/honeypots\/2004\/Jan-Mar\/0015.html Jan. 2004.  K. Kortchinsky. Honeypots: Counter measures to VMware fingerprinting. http:\/\/seclists.org\/lists\/honeypots\/2004\/Jan-Mar\/0015.html Jan. 2004."},{"key":"e_1_3_2_1_44_1","doi-asserted-by":"publisher","DOI":"10.1145\/1064979.1065006"},{"key":"e_1_3_2_1_45_1","unstructured":"T. Liston and E. Skoudis. On the Cutting Edge: Thwarting Virtual Machine Detection. http:\/\/handlers.sans.org\/tliston\/ThwartingVMDetection_Liston_Skoudis.pdf 2006.  T. Liston and E. Skoudis. On the Cutting Edge: Thwarting Virtual Machine Detection. http:\/\/handlers.sans.org\/tliston\/ThwartingVMDetection_Liston_Skoudis.pdf 2006."},{"key":"e_1_3_2_1_46_1","volume-title":"Sept.","author":"Meushaw R.","year":"2000","unstructured":"R. Meushaw and D. Simard . NetTop: Commercial Technology in High Assurance Applications. Tech Trend Notes: Preview of Tomorrow's Information Technologies , Sept. 2000 . R. Meushaw and D. Simard. NetTop: Commercial Technology in High Assurance Applications. Tech Trend Notes: Preview of Tomorrow's Information Technologies, Sept. 2000."},{"key":"e_1_3_2_1_47_1","unstructured":"J. V. Miller. SHV4 Rootkit Analysis. https:\/\/tms.symantec.com\/members\/AnalystReports\/030929-Analysis-SHV4Rootkit.pdf.  J. V. Miller. SHV4 Rootkit Analysis. https:\/\/tms.symantec.com\/members\/AnalystReports\/030929-Analysis-SHV4Rootkit.pdf."},{"key":"e_1_3_2_1_48_1","doi-asserted-by":"publisher","DOI":"10.1016\/S1389-1286(99)00112-7"},{"key":"e_1_3_2_1_49_1","volume-title":"Proc. of the 12th USENIX Security Symposium","author":"Pennington A. G.","year":"2003","unstructured":"A. G. Pennington , J. D. Strunk , J. L. Griffin , C. A. N. Soules , G. R. Goodson , and G. R. Ganger . Storage-based Intrusion Detection: Watching Storage Activity for Suspicious Behavior . Proc. of the 12th USENIX Security Symposium , Aug. 2003 . A. G. Pennington, J. D. Strunk, J. L. Griffin, C. A. N. Soules, G. R. Goodson, and G. R. Ganger. Storage-based Intrusion Detection: Watching Storage Activity for Suspicious Behavior. Proc. of the 12th USENIX Security Symposium, Aug. 2003."},{"key":"e_1_3_2_1_50_1","volume-title":"Proc. of the 15th USENIX Security Symposium","author":"Petroni N.","year":"2006","unstructured":"N. Petroni , T. Fraser , A. Walters , and W. Arbaugh . An Architecture for Specification-Based Detection of Semantic Integrity Violations in Kernel Dynamic Data . Proc. of the 15th USENIX Security Symposium , Aug. 2006 . N. Petroni, T. Fraser, A. Walters, and W. Arbaugh. An Architecture for Specification-Based Detection of Semantic Integrity Violations in Kernel Dynamic Data. Proc. of the 15th USENIX Security Symposium, Aug. 2006."},{"key":"e_1_3_2_1_51_1","volume-title":"Proc. of the 13th USENIX Security Symposium","author":"Petroni N. L.","year":"2004","unstructured":"N. L. Petroni , T. Fraser , J. Molina , and W. A. Arbaugh . Copilot - a Coprocessor-based Kernel Runtime Integrity Monitor . Proc. of the 13th USENIX Security Symposium , Aug. 2004 . N. L. Petroni, T. Fraser, J. Molina, and W. A. Arbaugh. Copilot - a Coprocessor-based Kernel Runtime Integrity Monitor. Proc. of the 13th USENIX Security Symposium, Aug. 2004."},{"key":"e_1_3_2_1_52_1","unstructured":"J. Rutkowska. Red Pill: Detect VMM using (almost) One CPU Instruction. http:\/\/invisiblethings.org\/papers\/redpill.html Nov. 2004.  J. Rutkowska. Red Pill: Detect VMM using (almost) One CPU Instruction. http:\/\/invisiblethings.org\/papers\/redpill.html Nov. 2004."},{"key":"e_1_3_2_1_53_1","unstructured":"J. Rutkowska. Subverting Vista Kernel For Fun And Profit. Blackhat 2006 2006"},{"key":"e_1_3_2_1_55_1","doi-asserted-by":"publisher","DOI":"10.1109\/DSN.2005.39"},{"key":"e_1_3_2_1_56_1","doi-asserted-by":"publisher","DOI":"10.1145\/1216919.1216952"},{"key":"e_1_3_2_1_57_1","volume-title":"Proc. of USENIX OSDI 2004","author":"Whitaker A.","year":"2004","unstructured":"A. Whitaker , R. S. Cox , and S. D. Gribble . Configuration Debugging as Search: Finding the Needle in the Haystack . Proc. of USENIX OSDI 2004 , Dec. 2004 . A. Whitaker, R. S. Cox, and S. D. Gribble. Configuration Debugging as Search: Finding the Needle in the Haystack. Proc. of USENIX OSDI 2004, Dec. 2004."},{"key":"e_1_3_2_1_58_1","unstructured":"D. D. Zovi. Hardware Virtualization Based Rootkits. Blackhat 2006.  D. D. Zovi. Hardware Virtualization Based Rootkits. Blackhat 2006."}],"event":{"name":"CCS07: 14th ACM Conference on Computer and Communications Security 2007","location":"Alexandria Virginia USA","acronym":"CCS07","sponsor":["SIGSAC ACM Special Interest Group on Security, Audit, and Control","ACM Association for Computing Machinery"]},"container-title":["Proceedings of the 14th ACM conference on Computer and communications security"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/1315245.1315262","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/1315245.1315262","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,18]],"date-time":"2025-06-18T13:56:12Z","timestamp":1750254972000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/1315245.1315262"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2007,10,28]]},"references-count":57,"alternative-id":["10.1145\/1315245.1315262","10.1145\/1315245"],"URL":"https:\/\/doi.org\/10.1145\/1315245.1315262","relation":{},"subject":[],"published":{"date-parts":[[2007,10,28]]},"assertion":[{"value":"2007-10-28","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}