{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,5]],"date-time":"2026-06-05T04:47:45Z","timestamp":1780634865556,"version":"3.54.1"},"publisher-location":"New York, NY, USA","reference-count":27,"publisher":"ACM","license":[{"start":{"date-parts":[[2011,3,22]],"date-time":"2011-03-22T00:00:00Z","timestamp":1300752000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"DOI":"10.13039\/100000001","name":"National Science Foundation","doi-asserted-by":"publisher","award":["716444"],"award-info":[{"award-number":["716444"]}],"id":[{"id":"10.13039\/100000001","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/100000181","name":"Air Force Office of Scientific Research","doi-asserted-by":"publisher","award":["FA9550-10-1-0099"],"award-info":[{"award-number":["FA9550-10-1-0099"]}],"id":[{"id":"10.13039\/100000181","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/100006602","name":"Air Force Research Laboratory","doi-asserted-by":"publisher","award":["FA8750-09-1-0224"],"award-info":[{"award-number":["FA8750-09-1-0224"]}],"id":[{"id":"10.13039\/100006602","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2011,3,22]]},"DOI":"10.1145\/1966913.1966940","type":"proceedings-article","created":{"date-parts":[[2011,4,7]],"date-time":"2011-04-07T09:36:11Z","timestamp":1302168971000},"page":"207-216","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":10,"title":["Characterizing kernel malware behavior with kernel data access patterns"],"prefix":"10.1145","author":[{"given":"Junghwan","family":"Rhee","sequence":"first","affiliation":[{"name":"Purdue University, West Lafayette, IN"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Zhiqiang","family":"Lin","sequence":"additional","affiliation":[{"name":"Purdue University, West Lafayette, IN"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Dongyan","family":"Xu","sequence":"additional","affiliation":[{"name":"Purdue University, West Lafayette, IN"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2011,3,22]]},"reference":[{"key":"e_1_3_2_1_1_1","doi-asserted-by":"publisher","DOI":"10.1109\/ACSAC.2008.29"},{"key":"e_1_3_2_1_2_1","volume-title":"Proceedings of the 17th Annual Network and Distributed System Security Symposium (NDSS'10)","author":"Balzarotti D.","year":"2010"},{"key":"e_1_3_2_1_3_1","volume-title":"Behavior-Based Malware Clustering. In 16th Symposium on Network and Distributed System Security (NDSS'09)","author":"Bayer U.","year":"2009"},{"key":"e_1_3_2_1_4_1","first-page":"41","volume-title":"QEMU: A Fast and Portable Dynamic Translator. In Proceedings of the USENIX Annual Technical Conference, FREENIX Track","author":"Bellard F.","year":"2005"},{"key":"e_1_3_2_1_5_1","doi-asserted-by":"publisher","DOI":"10.5555\/1875652.1875668"},{"key":"e_1_3_2_1_6_1","unstructured":"J. Butler. DKOM (Direct Kernel Object Manipulation). http:\/\/www.blackhat.com\/presentations\/win-usa-04\/bh-win-04-butler.pdf.  J. Butler. DKOM (Direct Kernel Object Manipulation). http:\/\/www.blackhat.com\/presentations\/win-usa-04\/bh-win-04-butler.pdf."},{"key":"e_1_3_2_1_7_1","doi-asserted-by":"publisher","DOI":"10.1145\/1653662.1653729"},{"key":"e_1_3_2_1_8_1","volume-title":"Proceedings of the 12th USENIX Security Symposium (Security'03)","author":"Christodorescu M."},{"key":"e_1_3_2_1_9_1","doi-asserted-by":"publisher","DOI":"10.1145\/1287624.1287628"},{"key":"e_1_3_2_1_10_1","doi-asserted-by":"publisher","DOI":"10.1145\/268946.268962"},{"key":"e_1_3_2_1_11_1","volume-title":"Proceedings of the 8th USENIX Symposium on Operating Systems Design and Implementation (OSDI'08)","author":"Cozzie A.","year":"2008"},{"key":"e_1_3_2_1_12_1","doi-asserted-by":"publisher","DOI":"10.1145\/1653662.1653730"},{"key":"e_1_3_2_1_13_1","volume-title":"Proceedings for the 18th USENIX Security Symposium (Security'09)","author":"Hund R.","year":"2009"},{"key":"e_1_3_2_1_14_1","volume-title":"18th USENIX Security Symposium (Security'09)","author":"Kolbitsch C.","year":"2009"},{"key":"e_1_3_2_1_15_1","doi-asserted-by":"publisher","DOI":"10.1109\/CSAC.2004.19"},{"key":"e_1_3_2_1_16_1","volume-title":"Proceedings of the 18th Annual Network and Distributed System Security Symposium (NDSS'11)","author":"Lin Z.","year":"2011"},{"key":"e_1_3_2_1_17_1","volume-title":"Proceedings for the 13th USENIX Security Symposium (Security'04)","author":"Petroni N. L.","year":"2004"},{"key":"e_1_3_2_1_18_1","doi-asserted-by":"publisher","DOI":"10.1145\/1315245.1315260"},{"key":"e_1_3_2_1_19_1","doi-asserted-by":"publisher","DOI":"10.5555\/1267336.1267356"},{"key":"e_1_3_2_1_20_1","unstructured":"Phrack Magazine. Linux on-the-fly kernel patching without LKM. http:\/\/www.phrack.com\/issues.html?issue=58&id=7.  Phrack Magazine. Linux on-the-fly kernel patching without LKM. http:\/\/www.phrack.com\/issues.html?issue=58&id=7."},{"key":"e_1_3_2_1_21_1","doi-asserted-by":"publisher","DOI":"10.5555\/1894166.1894179"},{"key":"e_1_3_2_1_22_1","doi-asserted-by":"publisher","DOI":"10.1145\/1519065.1519072"},{"key":"e_1_3_2_1_23_1","doi-asserted-by":"publisher","DOI":"10.5555\/1433006.1433008"},{"key":"e_1_3_2_1_24_1","doi-asserted-by":"publisher","DOI":"10.1145\/1294261.1294294"},{"key":"e_1_3_2_1_25_1","volume-title":"Proceedings of the 15th Annual Network and Distributed System Security Symposium (NDSS'08)","author":"Sharif M.","year":"2009"},{"key":"e_1_3_2_1_26_1","doi-asserted-by":"publisher","DOI":"10.5555\/647882.738073"},{"key":"e_1_3_2_1_27_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-04342-0_16"}],"event":{"name":"ASIA CCS '11: 6th ACM Symposium on Information, Compuer and Communications Security","location":"Hong Kong China","acronym":"ASIA CCS '11","sponsor":["SIGSAC ACM Special Interest Group on Security, Audit, and Control"]},"container-title":["Proceedings of the 6th ACM Symposium on Information, Computer and Communications Security"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/1966913.1966940","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/1966913.1966940","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,18]],"date-time":"2025-06-18T10:52:25Z","timestamp":1750243945000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/1966913.1966940"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2011,3,22]]},"references-count":27,"alternative-id":["10.1145\/1966913.1966940","10.1145\/1966913"],"URL":"https:\/\/doi.org\/10.1145\/1966913.1966940","relation":{},"subject":[],"published":{"date-parts":[[2011,3,22]]},"assertion":[{"value":"2011-03-22","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}