NumChecker: Detecting kernel control-flow modifying rootkits by using Hardware Performance Counters

By Xueyang Wang, Ramesh Karri. 2013

118 citations recorded by the source corpus.

Subfields: Artificial Intelligence, Computer Networks and Communications, Signal Processing

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

1. Ahmad-Reza Sadeghi
2. Lucas Davi
3. Wei Yang
4. Nikita Borisov
5. Ramesh Karri
6. Carl A. Gunter
7. Matthew C. Caesar
8. Xueyang Wang

In Computer Networks and Communications

1. Ahmad-Reza Sadeghi
2. Lucas Davi
3. Wei Yang
4. Nikita Borisov
5. Stephen E. McLaughlin
6. Ramesh Karri
7. Carl A. Gunter
8. Matthew C. Caesar

In Signal Processing

1. Lucas Davi
2. Ahmad-Reza Sadeghi
3. Wei Yang
4. Anupam Das
5. Nikita Borisov
6. Ramesh Karri
7. Carl A. Gunter
8. Matthew C. Caesar

Citations in the corpus

• Property Inference Attacks on Fully Connected Neural Networks using Permutation Invariant Representations (2018, background): “HPCs have been demonstrated to be useful in detecting malware [11, 47], cachebased side-channel attacks [10] and cryptomining behavior [41] in clouds and enterprises.”
• Mining on Someone Else's Dime: Mitigating Covert Mining Operations in Clouds and Enterprises (2017, methodology): “In addition to generic malware, HPCs have also been successfully used to detect kernel-level rootkits [53], side-channel attacks [34], firmware modifications [54] etc.”
• On the Detection of Kernel-Level Rootkits Using Hardware Performance Counters (2017, methodology): “Another beneficial use is monitoring program behavior for malware detection [6, 18, 27, 29] and integrity checking [14].”
• The Cybersecurity Landscape in Industrial Control Systems (2016, methodology): “Some runtime CFI techniques leverage low-level hardware events [101]–[103].”