Stealthy malware detection through vmm-based "out-of-the-box" semantic view reconstruction

By Xuxian Jiang, Xinyuan Wang, Dongyan Xu. Conference on Computer and Communications Security, 2007

557 citations recorded by the source corpus.

Subfields: Artificial Intelligence, Computer Networks and Communications, Signal Processing

View Paper: https://www.semanticscholar.org/paper/0dac671dae4192cfe96d290b50cc3f1105798825

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

In Signal Processing

Citations in the corpus

The Evolution of Process Hiding Techniques in Malware - Current Threats and Possible Countermeasures (2017, methodology): “Additionally VmWatcher [25] is able to operate on both hypervisors and is able to use its detection functionality on Windows as well as on Linux distributions.”
Ether: malware analysis via hardware virtualization extensions (2008, methodology): “System call tracing using out-of-guest environments has been previously implemented in VMScope [30] and TTAnalyze [19], both of which are based on QEMU [20].”
Hypervision Across Worlds: Real-time Kernel Protection from the ARM TrustZone Secure World (2014, background): “Hypervisor-based approaches, such as [12,20,23,24,30,31, 35,38,43–45,50,52], use virtualization to provide their security tools with high privilege and isolation.”
DroidScope: Seamlessly Reconstructing the OS and Dalvik Semantic Views for Dynamic Android Malware Analysis (2012, methodology): “The basic techniques for reconstructing the OS-level view have been well studied for the x86 architecture and are generally known as virtual machine introspection [16, 21, 24].”
CloudVisor: retrofitting protection of virtual machines in multi-tenant cloud with nested virtualization (2011, methodology): “Many prior literatures use special-purpose VMMs to improve security of operating systems [53, 69, 48], or extend existing VMMs with security-enhanced policies or mechanisms [30, 29] Compared to CloudVisor, these systems only protect a part of a program, while CloudVisor aims at protecting the entire”