Work

HProve: A Hypervisor Level Provenance System to Reconstruct Attack Story Caused by Kernel Malware

Year: 2019

Type: article

Abstract: Provenance of system subjects (e.g., processes) and objects (e.g., ﬁles) are very useful for many forensics tasks. In our analysis and comparison of existing Linux provenance tracing systems, we found that most systems assume the Linux kernel to be in the trust base, making these systems vulnerable

Source: ICST Transactions on Security and Safety

DOI: 10.4108/eai.8-4-2019.157417

Authors: Chonghua Wang, Libo Yin, Jun Li, Xuehong Chen, Rongchao Yin, Xiaochun Yun, Yang Jiao, Zhiyu Hao

Institutions: China Industrial Control Systems Cyber Emergency Response Team, National Computer Network Emergency Response Technical Team/Coordination Center of Chinar, Chinese Academy of Sciences, Institute of Information Engineering

Language: English

Topic: Security and Verification in Computing

Subfield: Artificial Intelligence

Field: Computer Science

Domain: Physical Sciences

SDG: Peace, justice, and strong institutions

Open Access status: diamond

OpenAlex ID: W4236623484

FWCI: 0.114

Cites: 27

Cited by: 1

Related to: 10