{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,2,21]],"date-time":"2025-02-21T14:43:42Z","timestamp":1740149022179,"version":"3.37.3"},"reference-count":34,"publisher":"Wiley","license":[{"start":{"date-parts":[[2018,1,1]],"date-time":"2018-01-01T00:00:00Z","timestamp":1514764800000},"content-version":"unspecified","delay-in-days":0,"URL":"http:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["61572297","61602281","ZR2016YL014","ZR2016YL011","ZR2014FM003","ZY2015YL018","BS2015DX006","BS2014DX007","2017CXGC0706","2015QN003"],"award-info":[{"award-number":["61572297","61602281","ZR2016YL014","ZR2016YL011","ZR2014FM003","ZY2015YL018","BS2015DX006","BS2014DX007","2017CXGC0706","2015QN003"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["61572297","61602281","ZR2016YL014","ZR2016YL011","ZR2014FM003","ZY2015YL018","BS2015DX006","BS2014DX007","2017CXGC0706","2015QN003"],"award-info":[{"award-number":["61572297","61602281","ZR2016YL014","ZR2016YL011","ZR2014FM003","ZY2015YL018","BS2015DX006","BS2014DX007","2017CXGC0706","2015QN003"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100007129","name":"Natural Science Foundation of Shandong Province","doi-asserted-by":"publisher","award":["61572297","61602281","ZR2016YL014","ZR2016YL011","ZR2014FM003","ZY2015YL018","BS2015DX006","BS2014DX007","2017CXGC0706","2015QN003"],"award-info":[{"award-number":["61572297","61602281","ZR2016YL014","ZR2016YL011","ZR2014FM003","ZY2015YL018","BS2015DX006","BS2014DX007","2017CXGC0706","2015QN003"]}],"id":[{"id":"10.13039\/501100007129","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100007129","name":"Natural Science Foundation of Shandong Province","doi-asserted-by":"publisher","award":["61572297","61602281","ZR2016YL014","ZR2016YL011","ZR2014FM003","ZY2015YL018","BS2015DX006","BS2014DX007","2017CXGC0706","2015QN003"],"award-info":[{"award-number":["61572297","61602281","ZR2016YL014","ZR2016YL011","ZR2014FM003","ZY2015YL018","BS2015DX006","BS2014DX007","2017CXGC0706","2015QN003"]}],"id":[{"id":"10.13039\/501100007129","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100007129","name":"Natural Science Foundation of Shandong Province","doi-asserted-by":"publisher","award":["61572297","61602281","ZR2016YL014","ZR2016YL011","ZR2014FM003","ZY2015YL018","BS2015DX006","BS2014DX007","2017CXGC0706","2015QN003"],"award-info":[{"award-number":["61572297","61602281","ZR2016YL014","ZR2016YL011","ZR2014FM003","ZY2015YL018","BS2015DX006","BS2014DX007","2017CXGC0706","2015QN003"]}],"id":[{"id":"10.13039\/501100007129","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100007129","name":"Natural Science Foundation of Shandong Province","doi-asserted-by":"publisher","award":["61572297","61602281","ZR2016YL014","ZR2016YL011","ZR2014FM003","ZY2015YL018","BS2015DX006","BS2014DX007","2017CXGC0706","2015QN003"],"award-info":[{"award-number":["61572297","61602281","ZR2016YL014","ZR2016YL011","ZR2014FM003","ZY2015YL018","BS2015DX006","BS2014DX007","2017CXGC0706","2015QN003"]}],"id":[{"id":"10.13039\/501100007129","id-type":"DOI","asserted-by":"publisher"}]},{"name":"Shandong Provincial Outstanding Research Award Fund for Young Scientists of China","award":["61572297","61602281","ZR2016YL014","ZR2016YL011","ZR2014FM003","ZY2015YL018","BS2015DX006","BS2014DX007","2017CXGC0706","2015QN003"],"award-info":[{"award-number":["61572297","61602281","ZR2016YL014","ZR2016YL011","ZR2014FM003","ZY2015YL018","BS2015DX006","BS2014DX007","2017CXGC0706","2015QN003"]}]},{"name":"Shandong Provincial Outstanding Research Award Fund for Young Scientists of China","award":["61572297","61602281","ZR2016YL014","ZR2016YL011","ZR2014FM003","ZY2015YL018","BS2015DX006","BS2014DX007","2017CXGC0706","2015QN003"],"award-info":[{"award-number":["61572297","61602281","ZR2016YL014","ZR2016YL011","ZR2014FM003","ZY2015YL018","BS2015DX006","BS2014DX007","2017CXGC0706","2015QN003"]}]},{"name":"Shandong Provincial Key Research and Development Program of China","award":["61572297","61602281","ZR2016YL014","ZR2016YL011","ZR2014FM003","ZY2015YL018","BS2015DX006","BS2014DX007","2017CXGC0706","2015QN003"],"award-info":[{"award-number":["61572297","61602281","ZR2016YL014","ZR2016YL011","ZR2014FM003","ZY2015YL018","BS2015DX006","BS2014DX007","2017CXGC0706","2015QN003"]}]},{"DOI":"10.13039\/501100008118","name":"Shandong Academy of Sciences","doi-asserted-by":"publisher","award":["61572297","61602281","ZR2016YL014","ZR2016YL011","ZR2014FM003","ZY2015YL018","BS2015DX006","BS2014DX007","2017CXGC0706","2015QN003"],"award-info":[{"award-number":["61572297","61602281","ZR2016YL014","ZR2016YL011","ZR2014FM003","ZY2015YL018","BS2015DX006","BS2014DX007","2017CXGC0706","2015QN003"]}],"id":[{"id":"10.13039\/501100008118","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Security and Communication Networks"],"published-print":{"date-parts":[[2018]]},"abstract":"<jats:p>Most existing virtual machine introspection (VMI) technologies analyze the status of a target virtual machine under the assumption that the operating system (OS) version and kernel structure information are known at the hypervisor level. In this paper, we propose a model of virtual machine (VM) security monitoring based on memory introspection. Using a hardware-based approach to acquire the physical memory of the host machine in real time, the security of the host machine and VM can be diagnosed. Furthermore, a novel approach for VM memory forensics based on the<jats:italic> virtual machine control structure<\/jats:italic> (VMCS) is put forward. By analyzing the memory of the host machine, the running VMs can be detected and their high-level semantic information can be reconstructed. Then, malicious activity in the VMs can be identified in a timely manner. Moreover, by mutually analyzing the memory content of the host machine and VMs, VM escape may be detected. Compared with previous memory introspection technologies, our solution can automatically reconstruct the comprehensive running state of a target VM without any prior knowledge and is strongly resistant to attacks with high reliability. We developed a prototype system called the VEDefender. Experimental results indicate that our system can handle the VMs of mainstream Linux and Windows OS versions with high efficiency and does not influence the performance of the host machine and VMs.<\/jats:p>","DOI":"10.1155\/2018\/9410278","type":"journal-article","created":{"date-parts":[[2018,3,20]],"date-time":"2018-03-20T19:33:34Z","timestamp":1521574414000},"page":"1-16","source":"Crossref","is-referenced-by-count":4,"title":["Secure Virtualization Environment Based on Advanced Memory Introspection"],"prefix":"10.1155","volume":"2018","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-5017-3207","authenticated-orcid":true,"given":"Shuhui","family":"Zhang","sequence":"first","affiliation":[{"name":"School of Computer Science and Technology, Shandong University, Jinan 250101, China"},{"name":"Shandong Provincial Key Laboratory of Computer Networks, Shandong Computer Science Center (National Supercomputer Center in Jinan), Qilu University of Technology (Shandong Academy of Sciences), Jinan 250014, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7290-5659","authenticated-orcid":true,"given":"Xiangxu","family":"Meng","sequence":"additional","affiliation":[{"name":"School of Computer Science and Technology, Shandong University, Jinan 250101, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Lianhai","family":"Wang","sequence":"additional","affiliation":[{"name":"Shandong Provincial Key Laboratory of Computer Networks, Shandong Computer Science Center (National Supercomputer Center in Jinan), Qilu University of Technology (Shandong Academy of Sciences), Jinan 250014, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Lijuan","family":"Xu","sequence":"additional","affiliation":[{"name":"Shandong Provincial Key Laboratory of Computer Networks, Shandong Computer Science Center (National Supercomputer Center in Jinan), Qilu University of Technology (Shandong Academy of Sciences), Jinan 250014, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Xiaohui","family":"Han","sequence":"additional","affiliation":[{"name":"Shandong Provincial Key Laboratory of Computer Networks, Shandong Computer Science Center (National Supercomputer Center in Jinan), Qilu University of Technology (Shandong Academy of Sciences), Jinan 250014, China"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"311","reference":[{"key":"1","doi-asserted-by":"publisher","DOI":"10.1145\/2856126"},{"key":"2","doi-asserted-by":"publisher","DOI":"10.1145\/2431211.2431216"},{"issue":"3","key":"3","first-page":"4808","volume":"5","journal-title":"International Journal of Computer Science and Information Technologies"},{"issue":"12","key":"4","first-page":"97","volume":"5","year":"2017","journal-title":"International Journal of Emerging Technologies in Engineering Research"},{"key":"5","doi-asserted-by":"publisher","DOI":"10.1109\/Anti-Cybercrime.2017.7905276"},{"journal-title":"ACM Computing Surveys","first-page":"1","year":"2014","key":"10"},{"issue":"11","key":"12","first-page":"5642","volume":"11","year":"2017","journal-title":"KSII Transactions on Internet Information Systems"},{"issue":"5","key":"13","first-page":"511","volume":"13","year":"2018","journal-title":"Journal of Computers"},{"key":"14","doi-asserted-by":"publisher","DOI":"10.1016\/j.diin.2014.05.016"},{"key":"15","doi-asserted-by":"publisher","DOI":"10.1145\/2775111"},{"key":"16","doi-asserted-by":"publisher","DOI":"10.1535\/itj.1003.01"},{"year":"2007","key":"17"},{"key":"18","doi-asserted-by":"publisher","DOI":"10.1109\/TBDATA.2017.2715335"},{"key":"22","first-page":"459","volume":"73","year":"2008","journal-title":"Computers & Security"},{"key":"23","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2017.2675991"},{"key":"24","doi-asserted-by":"publisher","DOI":"10.1109\/TC.2016.2560809"},{"key":"26","doi-asserted-by":"publisher","DOI":"10.1145\/1368506.1368517"},{"key":"29","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-25141-2_7"},{"key":"30","doi-asserted-by":"publisher","DOI":"10.1186\/s13677-014-0016-2"},{"year":"2014","key":"31"},{"key":"32","doi-asserted-by":"publisher","DOI":"10.1016\/j.diin.2017.10.004"},{"key":"33","doi-asserted-by":"publisher","DOI":"10.1109\/TCC.2014.2338305"},{"key":"34","doi-asserted-by":"publisher","DOI":"10.1016\/j.ins.2016.07.019"},{"key":"35","doi-asserted-by":"publisher","DOI":"10.1134\/S0361768817050036"},{"year":"2016","key":"36"},{"key":"37","doi-asserted-by":"publisher","DOI":"10.1109\/TC.2016.2540634"},{"key":"38","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2013.53"},{"key":"40","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2015.2457918"},{"first-page":"85","volume-title":"Hypershell: a practical hypervisor layer guest os shell for automated in-vm management","year":"2014","key":"41"},{"issue":"1","key":"42","first-page":"1","volume":"1","year":"2017","journal-title":"ACM Transactions on the Web"},{"year":"2014","key":"43"},{"key":"45","doi-asserted-by":"publisher","DOI":"10.1186\/s13635-016-0038-z"},{"first-page":"41","volume-title":"A Trusted VM Live Migration Protocol in IaaS","year":"2017","key":"47"},{"key":"48","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-41284-4_2"}],"container-title":["Security and Communication Networks"],"original-title":[],"language":"en","link":[{"URL":"http:\/\/downloads.hindawi.com\/journals\/scn\/2018\/9410278.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"http:\/\/downloads.hindawi.com\/journals\/scn\/2018\/9410278.xml","content-type":"application\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"http:\/\/downloads.hindawi.com\/journals\/scn\/2018\/9410278.pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2018,3,20]],"date-time":"2018-03-20T19:33:47Z","timestamp":1521574427000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.hindawi.com\/journals\/scn\/2018\/9410278\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2018]]},"references-count":34,"alternative-id":["9410278","9410278"],"URL":"https:\/\/doi.org\/10.1155\/2018\/9410278","relation":{},"ISSN":["1939-0114","1939-0122"],"issn-type":[{"type":"print","value":"1939-0114"},{"type":"electronic","value":"1939-0122"}],"subject":[],"published":{"date-parts":[[2018]]}}}