{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,1,25]],"date-time":"2026-01-25T15:47:56Z","timestamp":1769356076933,"version":"3.49.0"},"publisher-location":"New York, NY, USA","reference-count":30,"publisher":"ACM","license":[{"start":{"date-parts":[[2008,3,5]],"date-time":"2008-03-05T00:00:00Z","timestamp":1204675200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2008,3,5]]},"DOI":"10.1145\/1346256.1346269","type":"proceedings-article","created":{"date-parts":[[2008,3,12]],"date-time":"2008-03-12T22:35:48Z","timestamp":1205361348000},"page":"91-100","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":124,"title":["VMM-based hidden process detection and identification using Lycosid"],"prefix":"10.1145","author":[{"given":"Stephen T.","family":"Jones","sequence":"first","affiliation":[{"name":"University of Wisconsin-Madison, Madison, WI"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Andrea C.","family":"Arpaci-Dusseau","sequence":"additional","affiliation":[{"name":"University of Wisconsin-Madison, Madison, WI"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Remzi H.","family":"Arpaci-Dusseau","sequence":"additional","affiliation":[{"name":"University of Wisconsin-Madison, Madison, WI"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"320","published-online":{"date-parts":[[2008,3,5]]},"reference":[{"key":"e_1_3_2_1_1_1","unstructured":"90210. Bypassing klister 0.4 with no hooks or running a controlled thread scheduler. hi-tech.nsys.by\/33\/.  90210. Bypassing klister 0.4 with no hooks or running a controlled thread scheduler. hi-tech.nsys.by\/33\/."},{"key":"e_1_3_2_1_2_1","doi-asserted-by":"publisher","DOI":"10.1109\/SMCSIA.2003.1232409"},{"key":"e_1_3_2_1_3_1","unstructured":"J. Clemens. Knark: Linux kernel subversion. www.sans.org\/ resources\/ idfaq\/ knark.php.  J. Clemens. Knark: Linux kernel subversion. www.sans.org\/ resources\/ idfaq\/ knark.php."},{"key":"e_1_3_2_1_4_1","unstructured":"B. Cogswell and M. Russinovich. Pslist. www.sysinternals.com.  B. Cogswell and M. Russinovich. Pslist. www.sysinternals.com."},{"key":"e_1_3_2_1_5_1","unstructured":"B. Cogswell and M. Russinovich. Rootkit revealer. www.sysinternals.com.  B. Cogswell and M. Russinovich. Rootkit revealer. www.sysinternals.com."},{"key":"e_1_3_2_1_6_1","doi-asserted-by":"publisher","DOI":"10.1145\/319151.319168"},{"key":"e_1_3_2_1_7_1","doi-asserted-by":"publisher","DOI":"10.1145\/945445.945462"},{"key":"e_1_3_2_1_8_1","doi-asserted-by":"publisher","DOI":"10.5555\/1060289.1060309"},{"key":"e_1_3_2_1_9_1","unstructured":"fuzen_op. fu.exe and msdirectx.sys. www.rootkit.com\/.  fuzen_op. fu.exe and msdirectx.sys. www.rootkit.com\/."},{"key":"e_1_3_2_1_10_1","volume-title":"Proc. Network and Distributed Systems Security Symposium","author":"Garfinkel T.","year":"2003","unstructured":"T. Garfinkel and M. Rosenblum . A virtual machine introspection based architecture for intrusion detection . In Proc. Network and Distributed Systems Security Symposium , February 2003 . T. Garfinkel and M. Rosenblum. A virtual machine introspection based architecture for intrusion detection. In Proc. Network and Distributed Systems Security Symposium, February 2003."},{"key":"e_1_3_2_1_11_1","doi-asserted-by":"publisher","DOI":"10.1145\/263326.263344"},{"key":"e_1_3_2_1_12_1","unstructured":"Holy Father. HackerDefender. hxdef.org.  Holy Father. HackerDefender. hxdef.org."},{"key":"e_1_3_2_1_13_1","unstructured":"Intel and Symantec Corp. Symantec virtual security solution and pcs with intel vpro technology. http:\/\/www.intel.com\/business\/casestudies\/symantec\\_solutions\\_brief.pdf.  Intel and Symantec Corp. Symantec virtual security solution and pcs with intel vpro technology. http:\/\/www.intel.com\/business\/casestudies\/symantec\\_solutions\\_brief.pdf."},{"key":"e_1_3_2_1_14_1","volume-title":"Vtx specification. developer.intel.com","author":"Intel Corporation","year":"2005","unstructured":"Intel Corporation . Vtx specification. developer.intel.com , 2005 . Intel Corporation. Vtx specification. developer.intel.com, 2005."},{"key":"e_1_3_2_1_15_1","volume-title":"Proceedings of the USENIX Annual Technical Conference (USENIX'06)","author":"Jones S.T.","year":"2006","unstructured":"S.T. Jones , A.C. Arpaci-Dusseau , and R.H. Arpaci-Dusseau . Antfarm: Tracking Processes in a Virtual Machine Environment . In Proceedings of the USENIX Annual Technical Conference (USENIX'06) , Boston, Massachusetts , June 2006 . S.T. Jones, A.C. Arpaci-Dusseau, and R.H. Arpaci-Dusseau. Antfarm: Tracking Processes in a Virtual Machine Environment. In Proceedings of the USENIX Annual Technical Conference (USENIX'06), Boston, Massachusetts, June 2006."},{"key":"e_1_3_2_1_16_1","doi-asserted-by":"publisher","DOI":"10.1145\/1168857.1168861"},{"key":"e_1_3_2_1_17_1","doi-asserted-by":"publisher","DOI":"10.1145\/1095810.1095820"},{"key":"e_1_3_2_1_18_1","volume-title":"Fast Portscan Detection Using Sequential Hypothesis Testing. In IEEE Symposium on Security and Privacy 2004","author":"Jung J.","year":"2004","unstructured":"J. Jung , V. Paxson , A.W. Berger , and H. Balakrishnan . Fast Portscan Detection Using Sequential Hypothesis Testing. In IEEE Symposium on Security and Privacy 2004 , Oakland, CA , May 2004 . J. Jung, V. Paxson, A.W. Berger, and H. Balakrishnan. Fast Portscan Detection Using Sequential Hypothesis Testing. In IEEE Symposium on Security and Privacy 2004, Oakland, CA, May 2004."},{"key":"e_1_3_2_1_19_1","doi-asserted-by":"publisher","DOI":"10.1109\/32.106971"},{"key":"e_1_3_2_1_20_1","unstructured":"Microsoft. Windows malicious software removal tool. www.microsoft.com.  Microsoft. Windows malicious software removal tool. www.microsoft.com."},{"key":"e_1_3_2_1_21_1","unstructured":"T. Miller. t0rn rootkit. www.ossec.net\/rootkits\/studies\/t0rn.txt.  T. Miller. t0rn rootkit. www.ossec.net\/rootkits\/studies\/t0rn.txt."},{"key":"e_1_3_2_1_22_1","unstructured":"R. Naraine. Microsoft: Stealth Rootkits Are Bombarding XP SP2 Boxes. www.eweek.com\/article2\/0 1895 1896605 00.asp.  R. Naraine. Microsoft: Stealth Rootkits Are Bombarding XP SP2 Boxes. www.eweek.com\/article2\/0 1895 1896605 00.asp."},{"key":"e_1_3_2_1_23_1","first-page":"179","volume-title":"Proceedings of the 13th USENIX Security Symposium","author":"Petroni N.L.","year":"2004","unstructured":"N.L. Petroni , T. Fraser , J. Molina , and W.A. Arbaugh . Copilot -- a coprocessor-based kernel runtime integrity monitor . In Proceedings of the 13th USENIX Security Symposium , pages 179 -- 194 , August 2004 . N.L. Petroni, T. Fraser, J. Molina, and W.A. Arbaugh. Copilot -- a coprocessor-based kernel runtime integrity monitor. In Proceedings of the 13th USENIX Security Symposium, pages 179--194, August 2004."},{"key":"e_1_3_2_1_24_1","volume-title":"R: A Language and Environment for Statistical Computing","author":"Development Core Team R","year":"2006","unstructured":"R Development Core Team . R: A Language and Environment for Statistical Computing . R Foundation for Statistical Computing, Vienna, Austria , 2006 . ISBN 3-900051-07-0. R Development Core Team. R: A Language and Environment for Statistical Computing. R Foundation for Statistical Computing, Vienna, Austria, 2006. ISBN 3-900051-07-0."},{"key":"e_1_3_2_1_25_1","volume-title":"The Statistical Sleuth: A Course in Methods of Data Analysis","author":"Ramsey F.L.","year":"2002","unstructured":"F.L. Ramsey and D.W. Schafer . The Statistical Sleuth: A Course in Methods of Data Analysis . Duxbury Press , Boston, MA , 2 nd edition, 2002 . F.L. Ramsey and D.W. Schafer. The Statistical Sleuth: A Course in Methods of Data Analysis. Duxbury Press, Boston, MA, 2nd edition, 2002.","edition":"2"},{"key":"e_1_3_2_1_26_1","unstructured":"J. Rutkowska. klister. www.invisiblethings.org\/tools\/klister-0.4.zip.  J. Rutkowska. klister. www.invisiblethings.org\/tools\/klister-0.4.zip."},{"key":"e_1_3_2_1_27_1","unstructured":"SANS Institute. Subseven trojan v 1.1. www.sans.org\/resources\/idfaq\/subseven.php.  SANS Institute. Subseven trojan v 1.1. www.sans.org\/resources\/idfaq\/subseven.php."},{"key":"e_1_3_2_1_28_1","unstructured":"sd and devik. Suckit. Phrack #58 article 0x07.  sd and devik. Suckit. Phrack #58 article 0x07."},{"key":"e_1_3_2_1_29_1","volume-title":"Sequential Analysis","author":"Wald A.","year":"1952","unstructured":"A. Wald . Sequential Analysis . John Wiley & amp; Sons, Inc., New York, NY, 3 rd edition, September 1952 . A. Wald. Sequential Analysis. John Wiley & Sons, Inc., New York, NY, 3rd edition, September 1952.","edition":"3"},{"key":"e_1_3_2_1_30_1","doi-asserted-by":"publisher","DOI":"10.1109\/DSN.2005.39"}],"event":{"name":"VEE '08: International Conference on Virtual Execution Environments","location":"Seattle WA USA","acronym":"VEE '08","sponsor":["SIGPLAN ACM Special Interest Group on Programming Languages","SIGOPS ACM Special Interest Group on Operating Systems","ACM Association for Computing Machinery"]},"container-title":["Proceedings of the fourth ACM SIGPLAN\/SIGOPS international conference on Virtual execution environments"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/1346256.1346269","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/1346256.1346269","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,18]],"date-time":"2025-06-18T20:22:21Z","timestamp":1750278141000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/1346256.1346269"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2008,3,5]]},"references-count":30,"alternative-id":["10.1145\/1346256.1346269","10.1145\/1346256"],"URL":"https:\/\/doi.org\/10.1145\/1346256.1346269","relation":{},"subject":[],"published":{"date-parts":[[2008,3,5]]},"assertion":[{"value":"2008-03-05","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}