A lightweight live memory forensic approach based on hardware virtualization

[1]  Giovanni Vigna,et al.  MalGene: Automatic Extraction of Malware Analysis Evasion Signature , 2015, CCS.

[2]  Xiaolei Wang,et al.  SPEMS: A Stealthy and Practical Execution Monitoring System Based on VMI , 2015, ICCCS.

[3]  Aggelos Kiayias,et al.  Scalability, fidelity and stealth in the DRAKVUF dynamic malware analysis system , 2014, ACSAC.

[4]  Rui Yang,et al.  Investigating the Hooking Behavior: A Page-Level Memory Monitoring Method for Live Forensics , 2014, ISC.

[5]  Xuxian Jiang,et al.  Data-Centric OS Kernel Malware Characterization , 2014, IEEE Transactions on Information Forensics and Security.

[6]  Miao Yu,et al.  A Virtualization Based Monitoring System for Mini-intrusive Live Forensics , 2013, International Journal of Parallel Programming.

[7]  Xiangyu Zhang,et al.  SPIDER: stealthy binary program instrumentation and debugging via hardware virtualization , 2013, ACSAC.

[8]  Yunheung Paek,et al.  Vigilare: toward snoop-based kernel integrity monitor , 2012, CCS '12.

[9]  Chen-Ching Liu,et al.  Evasion-resistant malware signature based on profiling kernel data structure objects , 2012, 2012 7th International Conference on Risks and Security of Internet and Systems (CRiSIS).

[10]  Miao Yu,et al.  Vis: Virtualization enhanced live forensics acquisition for native system , 2012, Digit. Investig..

[11]  Jiang Wang,et al.  Firmware-assisted Memory Acquisition and Analysis tools for Digital Forensics , 2011, 2011 Sixth IEEE International Workshop on Systematic Approaches to Digital Forensic Engineering.

[12]  Julian B. Grizzard,et al.  Locating ×86 paging structures in memory images , 2010, Digit. Investig..

[13]  Lorenzo Martignoni,et al.  Live and Trustworthy Forensic Analysis of Commodity Production Systems , 2010, RAID.

[14]  Heng Yin,et al.  HookScout: Proactive Binary-Centric Hook Detection , 2010, DIMVA.

[15]  Manoj B. Athreya.  Subverting Linux on-the-fly using hardware virtualization technology , 2010 .

[16]  Xuxian Jiang,et al.  Mapping kernel objects to enable systematic integrity checking , 2009, CCS.

[17]  Xuxian Jiang,et al.  Countering kernel rootkits with lightweight hook protection , 2009, CCS.

[18]  Xuxian Jiang,et al.  Multi-aspect profiling of kernel rootkit behavior , 2009, EuroSys '09.

[19]  Xuxian Jiang,et al.  Defeating Dynamic Data Kernel Rootkit Attacks via VMM-Based Guest-Transparent Monitoring , 2009, 2009 International Conference on Availability, Reliability and Security.

[20]  Wenke Lee,et al.  Ether: malware analysis via hardware virtualization extensions , 2008, CCS.

[21]  Thomas Wilhelm,et al.  Metasploit Toolkit for Penetration Testing, Exploit Development, and Vulnerability Research , 2007 .

[22]  Ali Reza Arasteh,et al.  Forensic memory analysis: From stack and code to execution history , 2007, Digit. Investig..

[23]  Bradley L. Schatz,et al.  BodySnatcher: Towards reliable volatile memory acquisition by software , 2007, Digit. Investig..

[24]  Fabrice Bellard,et al.  QEMU, a Fast and Portable Dynamic Translator , 2005, USENIX ATC, FREENIX Track.