{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2024,9,7]],"date-time":"2024-09-07T16:01:54Z","timestamp":1725724914853},"publisher-location":"New York, NY, USA","reference-count":50,"publisher":"ACM","content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2014,6,16]]},"DOI":"10.1145\/2591971.2592009","type":"proceedings-article","created":{"date-parts":[[2014,6,10]],"date-time":"2014-06-10T12:50:25Z","timestamp":1402404625000},"page":"249-261","update-policy":"http:\/\/dx.doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":19,"title":["Non-intrusive, out-of-band and out-of-the-box systems monitoring in the cloud"],"prefix":"10.1145","author":[{"given":"Sahil","family":"Suneja","sequence":"first","affiliation":[{"name":"University of Toronto, Toronto, ON, Canada"}]},{"given":"Canturk","family":"Isci","sequence":"additional","affiliation":[{"name":"IBM T.J. Watson Research Center, Yorktown Heights, NY, USA"}]},{"given":"Vasanth","family":"Bala","sequence":"additional","affiliation":[{"name":"IBM T.J. Watson Research Center, Yorktown Heights, NY, USA"}]},{"given":"Eyal","family":"de Lara","sequence":"additional","affiliation":[{"name":"University of Toronto, Toronto, ON, Canada"}]},{"given":"Todd","family":"Mummert","sequence":"additional","affiliation":[{"name":"IBM T.J. Watson Research Center, Yorktown Heights, NY, USA"}]}],"member":"320","published-online":{"date-parts":[[2014,6,16]]},"reference":[{"key":"e_1_3_2_1_1_1","volume-title":"Hit by a Bus: Physical Access Attacks with Firewire. RuxCon","author":"Boileau Adam","year":"2006","unstructured":"Adam Boileau . Hit by a Bus: Physical Access Attacks with Firewire. RuxCon 2006 . http:\/\/www.security-assessment.com\/files\/presentations\/ab_firewire_rux2k6-final.pdf. Adam Boileau. Hit by a Bus: Physical Access Attacks with Firewire. RuxCon 2006. http:\/\/www.security-assessment.com\/files\/presentations\/ab_firewire_rux2k6-final.pdf."},{"key":"e_1_3_2_1_2_1","unstructured":"Amazon. CloudWatch. http:\/\/aws.amazon.com\/cloudwatch\/. Amazon. CloudWatch. http:\/\/aws.amazon.com\/cloudwatch\/."},{"key":"e_1_3_2_1_3_1","unstructured":"Amazon. Summary of the October 22 2012 AWS Service Event in the US-East Region. https:\/\/aws.amazon.com\/message\/680342\/. Amazon. Summary of the October 22 2012 AWS Service Event in the US-East Region. https:\/\/aws.amazon.com\/message\/680342\/."},{"key":"e_1_3_2_1_4_1","unstructured":"Anthony Desnos. Draugr - Live memory forensics on Linux. http:\/\/code.google.com\/p\/draugr\/. Anthony Desnos. Draugr - Live memory forensics on Linux. http:\/\/code.google.com\/p\/draugr\/."},{"key":"e_1_3_2_1_5_1","unstructured":"M. Auty A. Case M. Cohen B. Dolan-Gavitt M. H. Ligh J. Levy and A. Walters. Volatility - An advanced memory forensics framework. http:\/\/code.google.com\/p\/volatility. M. Auty A. Case M. Cohen B. Dolan-Gavitt M. H. Ligh J. Levy and A. Walters. Volatility - An advanced memory forensics framework. http:\/\/code.google.com\/p\/volatility."},{"key":"e_1_3_2_1_6_1","doi-asserted-by":"publisher","DOI":"10.1109\/SRDS.2010.39"},{"key":"e_1_3_2_1_7_1","doi-asserted-by":"publisher","DOI":"10.1145\/945445.945462"},{"key":"e_1_3_2_1_8_1","unstructured":"Bryan Payne. Vmitools - An introduction to LibVMI. http:\/\/code.google.com\/p\/vmitools\/wiki\/LibVMIIntroduction. Bryan Payne. Vmitools - An introduction to LibVMI. http:\/\/code.google.com\/p\/vmitools\/wiki\/LibVMIIntroduction."},{"key":"e_1_3_2_1_9_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.diin.2003.12.001"},{"key":"e_1_3_2_1_10_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.diin.2010.05.005"},{"key":"e_1_3_2_1_11_1","unstructured":"ClamAV. Clam AntiVirus. http:\/\/www.clamav.net. ClamAV. Clam AntiVirus. http:\/\/www.clamav.net."},{"key":"e_1_3_2_1_12_1","volume-title":"Carnegie Mellon University SDI\/ISTC Seminar Series","author":"Colohan C.","year":"2012","unstructured":"C. Colohan . The Scariest Outage Ever . Carnegie Mellon University SDI\/ISTC Seminar Series , 2012 . C. Colohan. The Scariest Outage Ever. Carnegie Mellon University SDI\/ISTC Seminar Series, 2012."},{"key":"e_1_3_2_1_13_1","unstructured":"David Anderson. White Paper: Red Hat Crash Utility. http:\/\/people.redhat.com\/anderson\/crash_whitepaper\/. David Anderson. White Paper: Red Hat Crash Utility. http:\/\/people.redhat.com\/anderson\/crash_whitepaper\/."},{"key":"e_1_3_2_1_14_1","unstructured":"Dell Quest\/VKernel. Foglight for Virtualization. http:\/\/www. quest.com\/foglight-for-virtualization-enterprise-edition\/. Dell Quest\/VKernel. Foglight for Virtualization. http:\/\/www. quest.com\/foglight-for-virtualization-enterprise-edition\/."},{"key":"e_1_3_2_1_15_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2011.11"},{"key":"e_1_3_2_1_17_1","unstructured":"Emilien Girault. Volatilitux- Memory forensics framework to help analyzing Linux physical memory dumps. http:\/\/code.google.com\/p\/volatilitux\/. Emilien Girault. Volatilitux- Memory forensics framework to help analyzing Linux physical memory dumps. http:\/\/code.google.com\/p\/volatilitux\/."},{"key":"e_1_3_2_1_18_1","volume-title":"http:\/\/average-coder.blogspot.com\/2011\/12\/linux-rootkit.html","author":"Linux Rootkit Implementation M. F.","year":"2011","unstructured":"M. F. Linux Rootkit Implementation . http:\/\/average-coder.blogspot.com\/2011\/12\/linux-rootkit.html , 2011 . M. F. Linux Rootkit Implementation. http:\/\/average-coder.blogspot.com\/2011\/12\/linux-rootkit.html, 2011."},{"key":"e_1_3_2_1_19_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2012.40"},{"key":"e_1_3_2_1_20_1","first-page":"191","volume-title":"NDSS","author":"Garfinkel T.","year":"2003","unstructured":"T. Garfinkel and M. Rosenblum . A Virtual Machine Introspection Based Architecture for Intrusion Detection . In NDSS , pages 191 -- 206 , 2003 . T. Garfinkel and M. Rosenblum. A Virtual Machine Introspection Based Architecture for Intrusion Detection. In NDSS, pages 191--206, 2003."},{"key":"e_1_3_2_1_21_1","doi-asserted-by":"publisher","DOI":"10.1145\/1368506.1368517"},{"key":"e_1_3_2_1_22_1","doi-asserted-by":"publisher","DOI":"10.1145\/1950365.1950398"},{"key":"e_1_3_2_1_23_1","unstructured":"Hypertection. Hypervisor-Based Antivirus. hypertection.com. Hypertection. Hypervisor-Based Antivirus. hypertection.com."},{"key":"e_1_3_2_1_24_1","unstructured":"Jack of all Clouds. Recounting EC2 One Year Later. www.jackofallclouds.com\/2010\/12\/recounting-ec2\/. Jack of all Clouds. Recounting EC2 One Year Later. www.jackofallclouds.com\/2010\/12\/recounting-ec2\/."},{"key":"e_1_3_2_1_25_1","doi-asserted-by":"publisher","DOI":"10.1145\/1315245.1315262"},{"key":"e_1_3_2_1_26_1","first-page":"225","volume-title":"KVM: the Linux Virtual Machine Monitor. In OLS '07: The 2007 Ottawa Linux Symposium","author":"Kivity A.","year":"2007","unstructured":"A. Kivity , Y. Kamay , D. Laor , U. Lublin , and A. Liguori . KVM: the Linux Virtual Machine Monitor. In OLS '07: The 2007 Ottawa Linux Symposium , pages 225 -- 230 , 2007 . A. Kivity, Y. Kamay, D. Laor, U. Lublin, and A. Liguori. KVM: the Linux Virtual Machine Monitor. In OLS '07: The 2007 Ottawa Linux Symposium, pages 225--230, 2007."},{"key":"e_1_3_2_1_27_1","volume-title":"Charles University in Prague","author":"Kollar I.","year":"2010","unstructured":"I. Kollar . Forensic RAM dump image analyser. Master's Thesis , Charles University in Prague , 2010 . hysteria.sk\/~niekt0\/fmem\/doc\/foriana.pdf. I. Kollar. Forensic RAM dump image analyser. Master's Thesis, Charles University in Prague, 2010. hysteria.sk\/~niekt0\/fmem\/doc\/foriana.pdf."},{"key":"e_1_3_2_1_28_1","volume-title":"NDSS","author":"Lin Z.","year":"2011","unstructured":"Z. Lin , J. Rhee , X. Zhang , D. Xu , and X. Jiang . SigGraph: Brute Force Scanning of Kernel Data Structure Instances Using Graph-based Signatures . In NDSS , 2011 . Z. Lin, J. Rhee, X. Zhang, D. Xu, and X. Jiang. SigGraph: Brute Force Scanning of Kernel Data Structure Instances Using Graph-based Signatures. In NDSS, 2011."},{"key":"e_1_3_2_1_29_1","doi-asserted-by":"publisher","DOI":"10.1145\/1952682.1952702"},{"key":"e_1_3_2_1_30_1","volume-title":"Digital forensics of the physical memory","author":"Burdach Mariusz","year":"2005","unstructured":"Mariusz Burdach . Digital forensics of the physical memory . 2005 . http:\/\/forensic.seccure.net\/pdf\/mburdach_digital_forensics_of_physical_memory.pdf. Mariusz Burdach. Digital forensics of the physical memory. 2005. http:\/\/forensic.seccure.net\/pdf\/mburdach_digital_forensics_of_physical_memory.pdf."},{"key":"e_1_3_2_1_31_1","unstructured":"N. Mavroyanopoulos and S. Schumann. Mhash. http:\/\/mhash.sourceforge.net. N. Mavroyanopoulos and S. Schumann. Mhash. http:\/\/mhash.sourceforge.net."},{"key":"e_1_3_2_1_32_1","volume-title":"PacSec Applied Security Conference 2004","author":"Dornseif Maximillian","year":"2004","unstructured":"Maximillian Dornseif . 0wned by an iPod. PacSec Applied Security Conference 2004 . http:\/\/md.hudora.de\/presentations\/firewire\/PacSec 2004 .pdf. Maximillian Dornseif. 0wned by an iPod. PacSec Applied Security Conference 2004. http:\/\/md.hudora.de\/presentations\/firewire\/PacSec2004.pdf."},{"key":"e_1_3_2_1_33_1","doi-asserted-by":"publisher","DOI":"10.1145\/306225.306235"},{"key":"e_1_3_2_1_34_1","unstructured":"Nirsoft. Windows Vista Kernel Structures. http:\/\/www.nirsoft.net\/kernel_struct\/vista\/. Nirsoft. Windows Vista Kernel Structures. http:\/\/www.nirsoft.net\/kernel_struct\/vista\/."},{"key":"e_1_3_2_1_35_1","unstructured":"OpenBenchmarking\/Phoronix. x264 Test Profile. http:\/\/openbenchmarking.org\/test\/pts\/x264-1.7.0. OpenBenchmarking\/Phoronix. x264 Test Profile. http:\/\/openbenchmarking.org\/test\/pts\/x264-1.7.0."},{"key":"e_1_3_2_1_36_1","unstructured":"Opscode. Chef. http:\/\/www.opscode.com\/chef\/. Opscode. Chef. http:\/\/www.opscode.com\/chef\/."},{"key":"e_1_3_2_1_37_1","doi-asserted-by":"publisher","DOI":"10.1145\/1217935.1217942"},{"key":"e_1_3_2_1_38_1","first-page":"385","volume-title":"Secure and Flexible Monitoring of Virtual Machines. In Twenty-Third Annual Computer Security Applications Conference","author":"Payne B.","year":"2007","unstructured":"B. Payne , M. de Carbone , and W. Lee . Secure and Flexible Monitoring of Virtual Machines. In Twenty-Third Annual Computer Security Applications Conference , pages 385 -- 397 , 2007 . B. Payne, M. de Carbone, and W. Lee. Secure and Flexible Monitoring of Virtual Machines. In Twenty-Third Annual Computer Security Applications Conference, pages 385--397, 2007."},{"key":"e_1_3_2_1_39_1","unstructured":"PHD Virtual. Virtual Monitoring http:\/\/www.phdvirtual.com\/. PHD Virtual. Virtual Monitoring http:\/\/www.phdvirtual.com\/."},{"key":"e_1_3_2_1_40_1","doi-asserted-by":"publisher","DOI":"10.1145\/1519138.1519142"},{"key":"e_1_3_2_1_41_1","unstructured":"Reflex. vWatch Monitoring. http:\/\/www.reflexsystems.com\/Products\/vWatch. Reflex. vWatch Monitoring. http:\/\/www.reflexsystems.com\/Products\/vWatch."},{"key":"e_1_3_2_1_42_1","unstructured":"Russell Coker. Bonnie++ http:\/\/www.coker.com.au\/bonnie++\/. Russell Coker. Bonnie++ http:\/\/www.coker.com.au\/bonnie++\/."},{"key":"e_1_3_2_1_43_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-87403-4_3"},{"key":"e_1_3_2_1_44_1","doi-asserted-by":"publisher","DOI":"10.1109\/CICT.2013.6558230"},{"key":"e_1_3_2_1_45_1","unstructured":"VMware. vCenter Operations Management Suite. http:\/\/www.vmware.com\/products\/vcenter-operations-management\/. VMware. vCenter Operations Management Suite. http:\/\/www.vmware.com\/products\/vcenter-operations-management\/."},{"key":"e_1_3_2_1_46_1","unstructured":"VMware. VIX API Documentation. http:\/\/www.vmware.com\/support\/developer\/vix-api\/. VMware. VIX API Documentation. http:\/\/www.vmware.com\/support\/developer\/vix-api\/."},{"key":"e_1_3_2_1_47_1","unstructured":"VMware. VMCI Overview. http:\/\/pubs.vmware.com\/vmci-sdk\/. VMware. VMCI Overview. http:\/\/pubs.vmware.com\/vmci-sdk\/."},{"key":"e_1_3_2_1_48_1","unstructured":"VMware. VMWare Tools. http:\/\/kb.vmware.com\/kb\/340. VMware. VMWare Tools. http:\/\/kb.vmware.com\/kb\/340."},{"key":"e_1_3_2_1_49_1","unstructured":"VMware. vShield Endpoint. http:\/\/www.vmware.com\/products\/vsphere\/features-endpoint. VMware. vShield Endpoint. http:\/\/www.vmware.com\/products\/vsphere\/features-endpoint."},{"key":"e_1_3_2_1_50_1","unstructured":"VMWare Inc. VMWare VMSafe security technology. http:\/\/www.vmware.com\/company\/news\/releases\/vmsafe_vmworld.html. VMWare Inc. VMWare VMSafe security technology. http:\/\/www.vmware.com\/company\/news\/releases\/vmsafe_vmworld.html."},{"key":"e_1_3_2_1_52_1","doi-asserted-by":"publisher","DOI":"10.1145\/844128.844146"}],"event":{"name":"SIGMETRICS '14: ACM SIGMETRICS \/ International Conference on Measurement and Modeling of Computer Systems","sponsor":["SIGMETRICS ACM Special Interest Group on Measurement and Evaluation"],"location":"Austin Texas USA","acronym":"SIGMETRICS '14"},"container-title":["The 2014 ACM international conference on Measurement and modeling of computer systems"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/2591971.2592009","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2023,9,4]],"date-time":"2023-09-04T18:22:21Z","timestamp":1693851741000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/2591971.2592009"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2014,6,16]]},"references-count":50,"alternative-id":["10.1145\/2591971.2592009","10.1145\/2591971"],"URL":"https:\/\/doi.org\/10.1145\/2591971.2592009","relation":{"is-identical-to":[{"id-type":"doi","id":"10.1145\/2637364.2592009","asserted-by":"object"}]},"subject":[],"published":{"date-parts":[[2014,6,16]]},"assertion":[{"value":"2014-06-16","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}