{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,9,28]],"date-time":"2025-09-28T20:42:35Z","timestamp":1759092155828,"version":"3.28.0"},"reference-count":21,"publisher":"IEEE","content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2011,10]]},"DOI":"10.1109\/srds.2011.26","type":"proceedings-article","created":{"date-parts":[[2011,11,17]],"date-time":"2011-11-17T21:17:16Z","timestamp":1321564636000},"page":"147-156","source":"Crossref","is-referenced-by-count":52,"title":["Process Implanting: A New Active Introspection Framework for Virtualization"],"prefix":"10.1109","author":[{"given":"Zhongshu","family":"Gu","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Zhui","family":"Deng","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Dongyan","family":"Xu","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Xuxian","family":"Jiang","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"263","reference":[{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1145\/1653662.1653728"},{"key":"ref11","first-page":"225","article-title":"kvm: the Linux virtual machine monitor","volume":"1","author":"kivity","year":"2007","journal-title":"Proceedings of the Linux Symposium"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1535\/itj.1003.01"},{"key":"ref13","article-title":"QEMU, a fast and portable dynamic translator","author":"bellard","year":"2005","journal-title":"USENIX"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1145\/1134760.1134762"},{"key":"ref15","doi-asserted-by":"crossref","first-page":"198","DOI":"10.1007\/978-3-540-74320-0_11","article-title":"Out-of-the-box monitoring of VM-based high-interaction honeypots","author":"jiang","year":"2007","journal-title":"Proceedings of the 10th International Conference on Recent Advances in Intrusion Detection"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1145\/1455770.1455779"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1145\/1095810.1095820"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1145\/1181309.1181311"},{"key":"ref19","first-page":"13","article-title":"Copilot-a coprocessor-based kernel runtime integrity monitor","volume":"13","author":"petroni","year":"2004","journal-title":"USENIX Association"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1109\/ACSAC.2007.10"},{"key":"ref3","doi-asserted-by":"crossref","first-page":"128","DOI":"10.1145\/1315245.1315262","article-title":"Stealthy malware detection through vmm-based out-of-the-box semantic view reconstruction","author":"jiang","year":"2007","journal-title":"Proceedings of the 14th ACM conference on Computer and Communications Security"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1145\/1346256.1346269"},{"key":"ref5","first-page":"1","article-title":"Antfarm: Tracking processes in a virtual machine environment","author":"jones","year":"2006","journal-title":"Proceedings of the USENIX Annual Technical Conference"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1145\/1653662.1653720"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2008.24"},{"key":"ref2","first-page":"253","article-title":"A virtual machine introspection based architecture for intrusion detection","volume":"1","author":"garfinkel","year":"2003","journal-title":"Proc Symp Network and Distributed System Security"},{"key":"ref1","first-page":"133","article-title":"When virtual is better than real","author":"chen","year":"2001","journal-title":"PUBLISHED BY THE IEEE COMPUTER SOCIETY"},{"key":"ref9","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1007\/978-3-540-87403-4_1","article-title":"Guest-transparent prevention of kernel rootkits with vmm-based memory shadowing","author":"riley","year":"2008","journal-title":"Recent Advances in Intrusion Detection"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1145\/1294261.1294294"},{"key":"ref21","first-page":"243","article-title":"Hypervisor support for identifying covertly executing binaries","author":"litty","year":"2008","journal-title":"Proceedings of The 17th Conference on Security Symposium"}],"event":{"name":"2011 IEEE 30th International Symposium on Reliable Distributed Systems (SRDS)","start":{"date-parts":[[2011,10,4]]},"location":"Madrid, Spain","end":{"date-parts":[[2011,10,7]]}},"container-title":["2011 IEEE 30th International Symposium on Reliable Distributed Systems"],"original-title":[],"link":[{"URL":"https:\/\/2.zoppoz.workers.dev:443\/http\/xplorestaging.ieee.org\/ielx5\/6075220\/6076749\/06076772.pdf?arnumber=6076772","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2017,6,20]],"date-time":"2017-06-20T09:55:42Z","timestamp":1497952542000},"score":1,"resource":{"primary":{"URL":"https:\/\/2.zoppoz.workers.dev:443\/http\/ieeexplore.ieee.org\/document\/6076772\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2011,10]]},"references-count":21,"URL":"https:\/\/2.zoppoz.workers.dev:443\/https\/doi.org\/10.1109\/srds.2011.26","relation":{},"subject":[],"published":{"date-parts":[[2011,10]]}}}