Automated detection of persistent kernel control-flow attacks

By Nick L. Petroni Jr., Michael W. Hicks. Conference on Computer and Communications Security, 2007

343 citations recorded by the source corpus.

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

HyperSentry: enabling stealthy in-context measurement of hypervisor integrity (2010, methodology): “To solve this problem, we adopt the approach previously presented by Petroni and Hicks [ 18 ] to verify persistent control ∞ow integrity.”
Lares: An Architecture for Secure Active Monitoring Using Virtualization (2008, methodology): “This technique was later incorporated and further developed by other projects related to attack replaying [15], passive controlflow integrity checking [ 25 ], and intrusion detection [18].”
HyperSafe: A Lightweight Approach to Provide Lifetime Hypervisor Control-Flow Integrity (2010, background): “Systems such as [34], [35], [36], [40], [44], [53] take advantage of the isolation and dominant control provided by a trusted hypervisor to secure the integrity of guest OS kernels.”
Guest-Transparent Prevention of Kernel Rootkits with VMM-Based Memory Shadowing (2008, methodology): “the presence of kernel rootkits in a system [1, 2, 3, 4, 5] and (2) preventing the compromise of OS kernel integrity [6, 7].”
NumChecker: Detecting kernel control-flow modifying rootkits by using Hardware Performance Counters (2013, methodology): “By using HPCs, the checking cost is signi.cantly reduced and the tamper-resistance is enhanced.”