1. Kim, G.H., Spafford, E.H.: The design and implementation of Tripwire: A file system integrity checker. In: Proceedings of the 2nd ACM Conference on Computer and Communications Security, pp. 18–29. ACM (1994)

   Google Scholar 

2. Smalley, S., Vance, C., Salamon, W.: Implementing SELinux as a Linux security module. NAI Labs Report 1, 43 (2001)

   Google Scholar 

3. Garfinkel, T., Rosenblum, M.: A Virtual Machine Introspection Based Architecture for Intrusion Detection. In: Proc. Network and Distributed Systems Security Symposium, pp. 191–206 (2003)

   Google Scholar 

4. Nance, K., Bishop, M., Hay, B.: Virtual machine introspection: Observation or interference? IEEE Security & Privacy 6(5), 32–37 (2008)

   Article  Google Scholar 

5. Jones, S.T., Arpaci-Dusseau, A.C., Arpaci-Dusseau, R.H.: Antfarm: Tracking processes in a virtual machine environment. In: Proceedings of the USENIX Annual Technical Conference, pp. 1–14 (2006)

   Google Scholar 

6. Payne, B.D., de Carbone, M.D.P., Lee, W.: Secure and flexible monitoring of virtual machines. In: Twenty-Third Annual Computer Security Applications Conference, ACSAC 2007, pp. 385–397 (2007)

   Google Scholar 

7. Payne, B.D., Carbone, M., Sharif, M., Lares, W.L.: An architecture for secure active monitoring using virtualization. In: IEEE Symposium on Security and Privacy, SP 2008, pp. 233–247. IEEE (2008)

   Google Scholar 

8. Quynh, N.A., Suzaki, K.: Xenprobes, a lightweight user-space probing framework for xen virtual machine. In: USENIX Annual Technical Conference Proceedings (2007)

   Google Scholar 

9. Zhao, F., Jiang, Y., Xiang, G., Jin, H., Jiang, W.: VRFPS: A Novel Virtual Machine-Based Real-time File Protection System. In: Proceedings of the 2009 Seventh ACIS International Conference on Software Engineering Research, Management and Applications, SERA 2009, Washington, DC, USA, pp. 217–224 (2009)

   Google Scholar 

10. Van Hensbergen, E., Minnich, R.: Grave Robbers from outer space using 9P2000 under Linux. In: Proceedings of the Annual Conference on USENIX Annual Technical Conference, ATEC 2005, p. 45. USENIX Association, Berkeley (2005)

    Google Scholar 

11. Velten, M., Stumpf, F.: Secure and Privacy-Aware Multiplexing of Hardware-Protected TPM Integrity Measurements among Virtual Machines. In: Kwon, T., Lee, M.-K., Kwon, D. (eds.) ICISC 2012. LNCS, vol. 7839, pp. 324–336. Springer, Heidelberg (2013)

    Chapter  Google Scholar 

12. Russell, R.: Virtio: towards a de-facto standard for virtual I/O devices. ACM SIGOPS Operating Systems Review 42(5), 95–103 (2008)

    Article  Google Scholar 

13. Trusted Platform Module, Main Specification, Level 2, Version 1.2, Revision 116 (2011),http://www.trustedcomputinggroup.org/resources/tpm_main_specification

14. Plan 9 – 9P2000.L Protocol,https://code.google.com/p/diod/w/list

15. Tool Interface Standard (TIS) – Executable and Linking Format (ELF) Specification (May 1995),http://refspecs.linuxbase.org/elf/elf.pdf

16. Sailer, R., Zhang, X., Jaeger, T., van Doorn, L.: Design and implementation of a TCG-based integrity measurement architecture. In: Proceedings of the 13th Conference on USENIX Security Symposium, SSYM 2004, vol. 13. USENIX Association, Berkeley (2004)

    Google Scholar 

17. Native Linux KVM Tool,https://github.com/penberg/linux-kvm

18. Kivity, A., Kamay, Y., Laor, D., Lublin, U., Liguori, A.: kvm: the Linux virtual machine monitor. In: OLS 2007: Proceedings of the Linux Symposium, vol. 1, pp. 225–230 (June 2007)

    Google Scholar 

19. Bellard, F.: QEMU, a fast and portable dynamic translator. In: Proceedings of the Annual Conference on USENIX Annual Technical Conference, ATEC 2005. USENIX Association, Berkeley (2005)

    Google Scholar 

20. Wessel, S., Stumpf, F.: Page-based Runtime Integrity Protection of User and Kernel Code. In: 5th European Workshop on System Security (2012)

    Google Scholar 

21. Litty, L., Lagar-Cavilla, H.A., Lie, D.: Hypervisor support for identifying covertly executing binaries. In: Proceedings of the 17th Conference on Security Symposium, SS 2008, pp. 243–258. USENIX Association, Berkeley (2008)

    Google Scholar 

22. Patil, S., Kashyap, A., Sivathanu, G., Zadok, E.: I3FS: An in-kernel integrity checker and intrusion detection file system. In: Proceedings of the 18th Annual Large Installation System Administration Conference, LISA 2004 (2004)

    Google Scholar 

23. Azab, A.M., Ning, P., Sezer, E.C., Zhang, X.: HIMA: A Hypervisor-Based Integrity Measurement Agent. In: ACSAC, pp. 461–470. IEEE Computer Society (2009)

    Google Scholar 

Download references