Matches in SemOpenAlex for { <https://semopenalex.org/work/W2119580333> ?p ?o ?g. }
Showing items 1 to 75 of
75
with 100 items per page.
- W2119580333 abstract "Currently stealth malware is becoming a major threat to the PC computers. Process hiding is the technique commonly used by stealth malware to evade detection by anti-malware scanners. On the defensive side, previous host-based approaches will be defeated once the privileged stealth malware controls a lower reach of the system. The virtual machine (VM) based solutions gain tamper resistance at the cost of losing the OS-level process view. Moreover, existing VM-based approaches cannot introspect the preinstalled OS which is just the protecting concern for PC users. In this paper, we present a new VM-based approach called Libra which accurately reproduces the software environment of the underlying preinstalled OS within the Libra VM and provides an OS-level semantic view of the processes. With our new local-booting technology, Libra VM just boots from the underlying host OS but not a newly installed OS image. Thus, Libra provides a way to detect the existing process-hiding stealth malware in the host OS. In addition, instead of depending on the guest information which is subvertable to the privileged guest malware, Libra adopts a unique technique to implicitly construct the trusted view of process list (TVPL) from within the virtualized hardware layer. Our evaluation results with real-world hiding-process rootkits, which are widely used by stealth malware, demonstrate its practicality and effectiveness." @default.
- W2119580333 created "2016-06-24" @default.
- W2119580333 creator A5018221313 @default.
- W2119580333 creator A5048138933 @default.
- W2119580333 creator A5049151430 @default.
- W2119580333 date "2008-04-01" @default.
- W2119580333 modified "2023-09-23" @default.
- W2119580333 title "Implicit Detection of Hidden Processes with a Local-Booted Virtual Machine" @default.
- W2119580333 cites W1561837749 @default.
- W2119580333 cites W1742385376 @default.
- W2119580333 cites W2112731379 @default.
- W2119580333 cites W4232895233 @default.
- W2119580333 cites W4256483320 @default.
- W2119580333 doi "https://doi.org/10.1109/isa.2008.22" @default.
- W2119580333 hasPublicationYear "2008" @default.
- W2119580333 type Work @default.
- W2119580333 sameAs 2119580333 @default.
- W2119580333 citedByCount "11" @default.
- W2119580333 countsByYear W21195803332012 @default.
- W2119580333 countsByYear W21195803332013 @default.
- W2119580333 countsByYear W21195803332015 @default.
- W2119580333 countsByYear W21195803332017 @default.
- W2119580333 crossrefType "proceedings-article" @default.
- W2119580333 hasAuthorship W2119580333A5018221313 @default.
- W2119580333 hasAuthorship W2119580333A5048138933 @default.
- W2119580333 hasAuthorship W2119580333A5049151430 @default.
- W2119580333 hasConcept C10144332 @default.
- W2119580333 hasConcept C111919701 @default.
- W2119580333 hasConcept C126831891 @default.
- W2119580333 hasConcept C149635348 @default.
- W2119580333 hasConcept C154945302 @default.
- W2119580333 hasConcept C18903297 @default.
- W2119580333 hasConcept C25344961 @default.
- W2119580333 hasConcept C2777904410 @default.
- W2119580333 hasConcept C2780801425 @default.
- W2119580333 hasConcept C31258907 @default.
- W2119580333 hasConcept C38652104 @default.
- W2119580333 hasConcept C41008148 @default.
- W2119580333 hasConcept C504728807 @default.
- W2119580333 hasConcept C541664917 @default.
- W2119580333 hasConcept C86803240 @default.
- W2119580333 hasConcept C98045186 @default.
- W2119580333 hasConceptScore W2119580333C10144332 @default.
- W2119580333 hasConceptScore W2119580333C111919701 @default.
- W2119580333 hasConceptScore W2119580333C126831891 @default.
- W2119580333 hasConceptScore W2119580333C149635348 @default.
- W2119580333 hasConceptScore W2119580333C154945302 @default.
- W2119580333 hasConceptScore W2119580333C18903297 @default.
- W2119580333 hasConceptScore W2119580333C25344961 @default.
- W2119580333 hasConceptScore W2119580333C2777904410 @default.
- W2119580333 hasConceptScore W2119580333C2780801425 @default.
- W2119580333 hasConceptScore W2119580333C31258907 @default.
- W2119580333 hasConceptScore W2119580333C38652104 @default.
- W2119580333 hasConceptScore W2119580333C41008148 @default.
- W2119580333 hasConceptScore W2119580333C504728807 @default.
- W2119580333 hasConceptScore W2119580333C541664917 @default.
- W2119580333 hasConceptScore W2119580333C86803240 @default.
- W2119580333 hasConceptScore W2119580333C98045186 @default.
- W2119580333 hasLocation W21195803331 @default.
- W2119580333 hasOpenAccess W2119580333 @default.
- W2119580333 hasPrimaryLocation W21195803331 @default.
- W2119580333 hasRelatedWork W1565457235 @default.
- W2119580333 hasRelatedWork W1578553365 @default.
- W2119580333 hasRelatedWork W1997166898 @default.
- W2119580333 hasRelatedWork W2003283343 @default.
- W2119580333 hasRelatedWork W2109359020 @default.
- W2119580333 hasRelatedWork W2119580333 @default.
- W2119580333 hasRelatedWork W2130605493 @default.
- W2119580333 hasRelatedWork W2170510882 @default.
- W2119580333 hasRelatedWork W301169851 @default.
- W2119580333 hasRelatedWork W4290996267 @default.
- W2119580333 isParatext "false" @default.
- W2119580333 isRetracted "false" @default.
- W2119580333 magId "2119580333" @default.
- W2119580333 workType "article" @default.