{"id":"https://openalex.org/W7131232219","doi":"https://doi.org/10.1109/acsac67867.2025.00048","title":"TrustLeech: Privileged System Analysis using Nested Virtualization","display_name":"TrustLeech: Privileged System Analysis using Nested Virtualization","publication_year":2025,"publication_date":"2025-12-08","ids":{"openalex":"https://openalex.org/W7131232219","doi":"https://doi.org/10.1109/acsac67867.2025.00048"},"language":null,"primary_location":{"id":"doi:10.1109/acsac67867.2025.00048","is_oa":false,"landing_page_url":"https://doi.org/10.1109/acsac67867.2025.00048","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2025 IEEE Annual Computer Security Applications Conference (ACSAC)","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5067122338","display_name":"Matti Schulze","orcid":null},"institutions":[{"id":"https://openalex.org/I181369854","display_name":"Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg","ror":"https://ror.org/00f7hpc57","country_code":"DE","type":"education","lineage":["https://openalex.org/I181369854"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Matti Schulze","raw_affiliation_strings":["FAU Erlangen-Nürnberg"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"FAU Erlangen-Nürnberg","institution_ids":["https://openalex.org/I181369854"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5126744599","display_name":"Paul Bergmann","orcid":null},"institutions":[{"id":"https://openalex.org/I181369854","display_name":"Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg","ror":"https://ror.org/00f7hpc57","country_code":"DE","type":"education","lineage":["https://openalex.org/I181369854"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Paul Bergmann","raw_affiliation_strings":["FAU Erlangen-Nürnberg"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"FAU Erlangen-Nürnberg","institution_ids":["https://openalex.org/I181369854"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5124365395","display_name":"Jonas R\u00f6ckl","orcid":null},"institutions":[{"id":"https://openalex.org/I181369854","display_name":"Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg","ror":"https://ror.org/00f7hpc57","country_code":"DE","type":"education","lineage":["https://openalex.org/I181369854"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Jonas R\u00f6ckl","raw_affiliation_strings":["FAU Erlangen-Nürnberg"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"FAU Erlangen-Nürnberg","institution_ids":["https://openalex.org/I181369854"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5035871932","display_name":"Felix Freiling","orcid":"https://orcid.org/0000-0002-8279-8401"},"institutions":[{"id":"https://openalex.org/I181369854","display_name":"Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg","ror":"https://ror.org/00f7hpc57","country_code":"DE","type":"education","lineage":["https://openalex.org/I181369854"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Felix Freiling","raw_affiliation_strings":["FAU Erlangen-Nürnberg"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"FAU Erlangen-Nürnberg","institution_ids":["https://openalex.org/I181369854"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I181369854"],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"468","last_page":"481"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.7283999919891357,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.7283999919891357,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10927","display_name":"Access Control and Trust","score":0.04659999907016754,"subfield":{"id":"https://openalex.org/subfields/3312","display_name":"Sociology and Political Science"},"field":{"id":"https://openalex.org/fields/33","display_name":"Social Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},{"id":"https://openalex.org/T10917","display_name":"Smart Grid Security and Resilience","score":0.022600000724196434,"subfield":{"id":"https://openalex.org/subfields/2207","display_name":"Control and Systems Engineering"},"field":{"id":"https://openalex.org/fields/22","display_name":"Engineering"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/hypervisor","display_name":"Hypervisor","score":0.7965999841690063},{"id":"https://openalex.org/keywords/rootkit","display_name":"Rootkit","score":0.7771000266075134},{"id":"https://openalex.org/keywords/virtualization","display_name":"Virtualization","score":0.6662999987602234},{"id":"https://openalex.org/keywords/firmware","display_name":"Firmware","score":0.6607999801635742},{"id":"https://openalex.org/keywords/debugging","display_name":"Debugging","score":0.5444999933242798},{"id":"https://openalex.org/keywords/hardware-virtualization","display_name":"Hardware virtualization","score":0.527899980545044},{"id":"https://openalex.org/keywords/virtual-machine","display_name":"Virtual machine","score":0.5130000114440918},{"id":"https://openalex.org/keywords/full-virtualization","display_name":"Full virtualization","score":0.47369998693466187}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8256000280380249},{"id":"https://openalex.org/C112904061","wikidata":"https://www.wikidata.org/wiki/Q1077480","display_name":"Hypervisor","level":4,"score":0.7965999841690063},{"id":"https://openalex.org/C10144332","wikidata":"https://www.wikidata.org/wiki/Q14645","display_name":"Rootkit","level":3,"score":0.7771000266075134},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.6887999773025513},{"id":"https://openalex.org/C513985346","wikidata":"https://www.wikidata.org/wiki/Q270471","display_name":"Virtualization","level":3,"score":0.6662999987602234},{"id":"https://openalex.org/C67212190","wikidata":"https://www.wikidata.org/wiki/Q104851","display_name":"Firmware","level":2,"score":0.6607999801635742},{"id":"https://openalex.org/C168065819","wikidata":"https://www.wikidata.org/wiki/Q845566","display_name":"Debugging","level":2,"score":0.5444999933242798},{"id":"https://openalex.org/C68793194","wikidata":"https://www.wikidata.org/wiki/Q1616095","display_name":"Hardware virtualization","level":5,"score":0.527899980545044},{"id":"https://openalex.org/C25344961","wikidata":"https://www.wikidata.org/wiki/Q192726","display_name":"Virtual machine","level":2,"score":0.5130000114440918},{"id":"https://openalex.org/C47878483","wikidata":"https://www.wikidata.org/wiki/Q848333","display_name":"Full virtualization","level":4,"score":0.47369998693466187},{"id":"https://openalex.org/C13062989","wikidata":"https://www.wikidata.org/wiki/Q651531","display_name":"Application virtualization","level":5,"score":0.4408000111579895},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.4043999910354614},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.37540000677108765},{"id":"https://openalex.org/C43364308","wikidata":"https://www.wikidata.org/wiki/Q8799","display_name":"Byte","level":2,"score":0.3418000042438507},{"id":"https://openalex.org/C149635348","wikidata":"https://www.wikidata.org/wiki/Q193040","display_name":"Embedded system","level":1,"score":0.32100000977516174},{"id":"https://openalex.org/C114466953","wikidata":"https://www.wikidata.org/wiki/Q6034165","display_name":"Initialization","level":2,"score":0.30149999260902405},{"id":"https://openalex.org/C2779395397","wikidata":"https://www.wikidata.org/wiki/Q15731404","display_name":"Malware analysis","level":3,"score":0.2985999882221222},{"id":"https://openalex.org/C2778579508","wikidata":"https://www.wikidata.org/wiki/Q722192","display_name":"System call","level":2,"score":0.27219998836517334},{"id":"https://openalex.org/C149810388","wikidata":"https://www.wikidata.org/wiki/Q5374873","display_name":"Emulation","level":2,"score":0.26739999651908875},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.26460000872612},{"id":"https://openalex.org/C120314980","wikidata":"https://www.wikidata.org/wiki/Q180634","display_name":"Distributed computing","level":1,"score":0.2623000144958496},{"id":"https://openalex.org/C63479239","wikidata":"https://www.wikidata.org/wiki/Q7353546","display_name":"Robustness (evolution)","level":3,"score":0.26159998774528503}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/acsac67867.2025.00048","is_oa":false,"landing_page_url":"https://doi.org/10.1109/acsac67867.2025.00048","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2025 IEEE Annual Computer Security Applications Conference (ACSAC)","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":28,"referenced_works":["https://openalex.org/W147819238","https://openalex.org/W1534092936","https://openalex.org/W1975177131","https://openalex.org/W2032151752","https://openalex.org/W2055184282","https://openalex.org/W2065085847","https://openalex.org/W2092935428","https://openalex.org/W2101889913","https://openalex.org/W2102001185","https://openalex.org/W2140807364","https://openalex.org/W2149886445","https://openalex.org/W2168872572","https://openalex.org/W2466394978","https://openalex.org/W2730168132","https://openalex.org/W2761289806","https://openalex.org/W2793294878","https://openalex.org/W2800989355","https://openalex.org/W2885965503","https://openalex.org/W2888194849","https://openalex.org/W2913096406","https://openalex.org/W2951530623","https://openalex.org/W2973047281","https://openalex.org/W3016246341","https://openalex.org/W3127135009","https://openalex.org/W3196101218","https://openalex.org/W4385080425","https://openalex.org/W4388686503","https://openalex.org/W4404515057"],"related_works":[],"abstract_inverted_index":{"Privileged":[0],"system":[1,36],"analysis,":[2],"i.e.,":[3],"the":[4,13,34,42,45,52,67,84,95,99,122,126,140,163,170,188],"analysis":[5,35,73,119,183],"of":[6,47,54,101,145,157,160,190],"a":[7,16,62,143,153,195,219],"running":[8,37,220],"virtual":[9],"machine":[10],"(VM)":[11],"from":[12,33],"hypervisor,":[14],"is":[15],"common":[17],"and":[18,27,173,215],"robust":[19],"technique":[20],"employed":[21],"in":[22,218],"digital":[23],"forensics,":[24],"incident":[25],"response,":[26],"malware":[28],"analysis.":[29,205],"Its":[30],"robustness":[31],"stems":[32],"with":[38,194,213],"higher":[39,79],"privileges":[40],"than":[41],"target.":[43],"However,":[44,90],"complexity":[46],"modern":[48],"hypervisors":[49],"has":[50],"increased":[51],"probability":[53],"vulnerabilities":[55,102],"allowing":[56,203],"privilege":[57,80],"escalation,":[58],"which":[59,150],"may":[60],"allow":[61],"VM":[63],"to":[64,94,103,115,139,162,198],"take":[65],"over":[66],"hypervisor.":[68,184,221],"To":[69,106],"counter":[70],"this":[71,108],"threat,":[72],"tools":[74],"are":[75],"deployed":[76],"at":[77,166],"even":[78],"levels,":[81],"such":[82],"as":[83],"firmware":[85,96,191],"level":[86,192],"on":[87,133],"ARMv8-A":[88],"systems.":[89],"moving":[91],"complex":[92],"software":[93],"merely":[97],"shifts":[98],"dangers":[100],"another":[104],"layer.":[105],"solve":[107],"dilemma,":[109],"we":[110,147],"propose":[111],"using":[112,135,176],"nested":[113,178],"virtualization":[114,179],"introduce":[116],"an":[117,182],"additional":[118],"layer":[120,129],"below":[121],"hypervisor":[123,172],"but":[124],"above":[125],"firmware.":[127,141,164],"This":[128],"can":[130],"be":[131],"initiated":[132],"demand":[134],"only":[136,151],"minor":[137],"modifications":[138],"As":[142],"proof":[144],"concept,":[146],"present":[148],"TrustLeech,":[149],"adds":[152],"small":[154],"loader":[155],"consisting":[156],"327":[158],"lines":[159],"code":[161],"On-demand":[165],"runtime,":[167],"TrustLeech":[168,185,212],"virtualizes":[169],"existing":[171],"its":[174,208],"VMs":[175],"ARM's":[177],"extensions,":[180],"inserting":[181],"therefore":[186],"combines":[187],"advantages":[189],"initialization":[193],"hypervisor's":[196],"access":[197],"all":[199],"hardware":[200],"debugging":[201],"features,":[202],"precise":[204],"We":[206],"show":[207],"applicability":[209],"by":[210],"integrating":[211],"LibVMI":[214],"analyzing":[216],"rootkits":[217]},"counts_by_year":[],"updated_date":"2026-07-14T23:27:15.235271","created_date":"2026-02-25T00:00:00"}