@conference {12069,
	title = {Copilot - a coprocessor-based kernel runtime integrity monitor},
	booktitle = {Proceedings of the 13th conference on USENIX Security Symposium - Volume 13},
	series = {SSYM{\textquoteright}04},
	year = {2004},
	month = {2004///},
	pages = {13 - 13},
	publisher = {USENIX Association},
	organization = {USENIX Association},
	address = {San Diego, CA},
	abstract = {Copilot is a coprocessor-based kernel integrity monitor for commodity systems. Copilot is designed to detect malicious modifications to a host{\textquoteright}s kernel and has correctly detected the presence of 12 real-world rootkits, each within 30 seconds of their installation with less than a 1\% penalty to the host{\textquoteright}s performance. Copilot requires no modifications to the protected host{\textquoteright}s software and can be expected to operate correctly even when the host kernel is thoroughly compromised - an advantage over traditional monitors designed to run on the host itself.},
	keywords = {design, management, MONITORS, Security, security and protection},
	url = {http://portal.acm.org/citation.cfm?id=1251375.1251388},
	author = {Petroni,Jr. and Fraser,Timothy and Molina,Jesus and Arbaugh, William A.}
}
