{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2024,9,7]],"date-time":"2024-09-07T23:27:31Z","timestamp":1725751651345},"publisher-location":"Berlin, Heidelberg","reference-count":23,"publisher":"Springer Berlin Heidelberg","isbn-type":[{"type":"print","value":"9783642411472"},{"type":"electronic","value":"9783642411489"}],"license":[{"start":{"date-parts":[[2013,1,1]],"date-time":"2013-01-01T00:00:00Z","timestamp":1356998400000},"content-version":"tdm","delay-in-days":0,"URL":"http:\/\/www.springer.com\/tdm"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2013]]},"DOI":"10.1007\/978-3-642-41148-9_21","type":"book-chapter","created":{"date-parts":[[2013,10,9]],"date-time":"2013-10-09T18:47:31Z","timestamp":1381344451000},"page":"305-328","source":"Crossref","is-referenced-by-count":3,"title":["Rule-Based Integrity Checking of Interrupt Descriptor Tables in Cloud Environments"],"prefix":"10.1007","author":[{"given":"Irfan","family":"Ahmed","sequence":"first","affiliation":[]},{"given":"Aleksandar","family":"Zoranic","sequence":"additional","affiliation":[]},{"given":"Salman","family":"Javaid","sequence":"additional","affiliation":[]},{"suffix":"III","given":"Golden","family":"Richard","sequence":"additional","affiliation":[]},{"given":"Vassil","family":"Roussev","sequence":"additional","affiliation":[]}],"member":"297","reference":[{"key":"21_CR1","first-page":"306","volume-title":"Proceedings of the Forty-First International Conference on Parallel Processing Workshops","author":"I. Ahmed","year":"2012","unstructured":"I. Ahmed, A. Zoranic, S. Javaid and G. Richard III, ModChecker: Kernel module integrity checking in the cloud environment, Proceedings of the Forty-First International Conference on Parallel Processing Workshops, pp. 306\u2013313, 2012."},{"key":"21_CR2","unstructured":"A. Bassov, Hooking the kernel directly (\n \n www.codeproject.com\/Articles\/13677\/Hooking-the-kernel-directly\n \n \n ), 2006."},{"key":"21_CR3","volume-title":"Rootkits: Subverting the Windows Kernel","author":"J. Butler","year":"2005","unstructured":"J. Butler and G. Hoglund, Rootkits: Subverting the Windows Kernel, Addison-Wesley, Boston, Massachusetts, 2005."},{"key":"21_CR4","first-page":"191","volume-title":"Proceedings of the Network and Distributed System Security Symposium","author":"T. Garfinkel","year":"2003","unstructured":"T. Garfinkel and M. Rosenblum, A virtual machine introspection based architecture for intrusion detection, Proceedings of the Network and Distributed System Security Symposium, pp. 191\u2013206, 2003."},{"key":"21_CR5","unstructured":"Intel, Intel 64 and IA-32 Architectures Software Developer\u2019s Manuals, Santa Clara, California (\n \n www.intel.com\/content\/www\/us\/en\/processors\/architectures-software-developer-manuals.html\n \n \n ), 2013."},{"key":"21_CR6","unstructured":"Kad, Handling the interrupt descriptor table for fun and profit, Phrack, vol. 0x0b(0x3b), 2002."},{"key":"21_CR7","unstructured":"G. Kroah-Hartman, Signed kernel modules, Linux Journal, vol. 2004(117), article no. 4, 2004."},{"key":"21_CR8","first-page":"21","volume-title":"Proceedings of the Second ACM Workshop on Scalable Trusted Computing","author":"P. Loscocco","year":"2007","unstructured":"P. Loscocco, P. Wilson, J. Pendergrass and C. McDonell, Linux kernel integrity measurement using contextual inspection, Proceedings of the Second ACM Workshop on Scalable Trusted Computing, pp. 21\u201329, 2007."},{"key":"21_CR9","unstructured":"Microsoft, Digital Signatures for Kernel Modules on Windows, Redmond, Washington (\n \n msdn.microsoft.com\/en-us\/library\/windows\/hardware\/gg487332.aspx\n \n \n ), 2007."},{"key":"21_CR10","unstructured":"mxatone and ivanlef0u, Stealth hooking: Another way to subvert the Windows kernel, Phrack, vol. 0x0c(0x41), 2008."},{"key":"21_CR11","volume-title":"Programming the Microsoft Windows Driver Model","author":"W. Oney","year":"2002","unstructured":"W. Oney, Programming the Microsoft Windows Driver Model, Microsoft Press, Redmond, Washington, 2002."},{"key":"21_CR12","unstructured":"Opdis Project, Opdis (\n \n mkfs.github.com\/content\/opdis\n \n \n )."},{"key":"21_CR13","unstructured":"OpenSSL Core and Development Team, OpenSSL Cryptography and SSL\/TLS Toolkit (\n \n www.openssl.org\n \n \n ), 2009."},{"key":"21_CR14","unstructured":"pragmatic, (Nearly) complete Linux loadable kernel modules: The definitive guide for hackers, virus coders and system administrators (\n \n newdata.box.sk\/raven\/lkm.html\n \n \n ), 1999."},{"key":"21_CR15","unstructured":"J. Rutkowska, System virginity verifier: Defining the roadmap for malware detection in Windows systems, presented at the Hack in the Box Conference, 2005."},{"key":"21_CR16","unstructured":"sd and devik, Linux on-the-fly kernel patching without LKM, Phrack, vol. 0x0b(0x3a), 2001."},{"key":"21_CR17","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1145\/1095810.1095812","volume-title":"Proceedings of the Twentieth ACM Symposium on Operating Systems Principles","author":"A. Seshadri","year":"2005","unstructured":"A. Seshadri, M. Luk, E. Shi, A. Perrig, L. van Doorn and P. Khosla, Pioneer: Verifying code integrity and enforcing untampered code execution on legacy systems, Proceedings of the Twentieth ACM Symposium on Operating Systems Principles, pp. 1\u201316, 2005."},{"key":"21_CR18","unstructured":"S. Skape, Bypassing PatchGuard on Windows x64 (\n \n uninformed.org\/?v=3&a=3&t=sumry\n \n \n ), 2005."},{"key":"21_CR19","unstructured":"M. Suiche, IDTGuard v0.1 December 2005 Build (\n \n www.msuiche.net\/2006\/12\/10\/idtguard-v01-december-2005-build\n \n \n ), 2005."},{"key":"21_CR20","unstructured":"VMI Tools Project, LibVMI (\n \n code.google.com\/p\/vmitools\n \n \n )."},{"key":"21_CR21","unstructured":"Volatility Project, The Volatility Framework (\n \n code.google.com\/p\/volatility\n \n \n )."},{"key":"21_CR22","unstructured":"Volatility Project, Volatility Plugin (\n \n code.google.com\/p\/volatility\/source\/browse\/trunk\/volatility\/plugins\/linux\/check_idt.py?spec=svn2273&r=2273\n \n \n )."},{"key":"21_CR23","unstructured":"Xen Project, Xen, Cambridge, United Kingdom (\n \n www.xenproject.org\n \n \n )."}],"container-title":["IFIP Advances in Information and Communication Technology","Advances in Digital Forensics IX"],"original-title":[],"language":"en","link":[{"URL":"http:\/\/link.springer.com\/content\/pdf\/10.1007\/978-3-642-41148-9_21","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2020,1,29]],"date-time":"2020-01-29T15:32:17Z","timestamp":1580311937000},"score":1,"resource":{"primary":{"URL":"http:\/\/link.springer.com\/10.1007\/978-3-642-41148-9_21"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2013]]},"ISBN":["9783642411472","9783642411489"],"references-count":23,"URL":"https:\/\/doi.org\/10.1007\/978-3-642-41148-9_21","relation":{},"ISSN":["1868-4238","1868-422X"],"issn-type":[{"type":"print","value":"1868-4238"},{"type":"electronic","value":"1868-422X"}],"subject":[],"published":{"date-parts":[[2013]]}}}