Guest-Transparent Prevention of Kernel Rootkits with VMM-Based Memory Shadowing

By Ryan D. Riley, Xuxian Jiang, Dongyan Xu. International Symposium on Recent Advances in Intrusion Detection, 2008

329 citations recorded by the source corpus.

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

A Survey of Stealth Malware Attacks, Mitigation Measures, and Steps Toward Autonomous Open World Solutions (2016, methodology): “Also, the NICKLE implementation in [83] does not support kernel page swapping, which would need to ensure that swapped in pages had the same cryptographic hash as when they were swapped out.”
HyperSafe: A Lightweight Approach to Provide Lifetime Hypervisor Control-Flow Integrity (2010, background): “Systems such as [34], [35], [36], [40], [44], [53] take advantage of the isolation and dominant control provided by a trusted hypervisor to secure the integrity of guest OS kernels.”
CloudVisor: retrofitting protection of virtual machines in multi-tenant cloud with nested virtualization (2011, background): “Many prior literatures use special-purpose VMMs to improve security of operating systems [53, 69, 48], or extend existing VMMs with security-enhanced policies or mechanisms [30, 29] Compared to CloudVisor, these systems only protect a part of a program, while CloudVisor aims at protecting the entire”