@conference {14664,
	title = {Automated detection of persistent kernel control-flow attacks},
	booktitle = {Proceedings of the 14th ACM conference on Computer and communications security},
	series = {CCS {\textquoteright}07},
	year = {2007},
	month = {2007///},
	pages = {103 - 115},
	publisher = {ACM},
	organization = {ACM},
	address = {New York, NY, USA},
	abstract = {This paper presents a new approach to dynamically monitoring operating system kernel integrity, based on a property called state-based control-flow integrity (SBCFI). Violations of SBCFI signal a persistent, unexpected modification of the kernel{\textquoteright}s control-flow graph. We performed a thorough analysis of 25 Linux rootkits and found that 24 (96\%) employ persistent control-flow modifications; an informal study of Windows rootkits yielded similar results. We have implemented SBCFI enforcement as part of the Xen and VMware virtual machine monitors. Our implementation detected all the control-flow modifying rootkits we could install, while imposing unnoticeable overhead for both a typical web server workload and CPU-intensive workloads when operating at 10 second intervals.},
	keywords = {CFI, integrity, Kernel, rootkit, virtualization},
	isbn = {978-1-59593-703-2},
	doi = {10.1145/1315245.1315260},
	url = {http://doi.acm.org/10.1145/1315245.1315260},
	author = {Petroni,Jr.,Nick L. and Hicks, Michael W.}
}
