<?xml version="1.0" encoding="utf-8"?>
<TEI xmlns="http://www.tei-c.org/ns/1.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:hal="http://hal.archives-ouvertes.fr/" xmlns:gml="http://www.opengis.net/gml/3.3/" xmlns:gmlce="http://www.opengis.net/gml/3.3/ce" version="1.1" xsi:schemaLocation="http://www.tei-c.org/ns/1.0 http://api.archives-ouvertes.fr/documents/aofr-sword.xsd">
  <teiHeader>
    <fileDesc>
      <titleStmt>
        <title>HAL TEI export of hal-02023739</title>
      </titleStmt>
      <publicationStmt>
        <distributor>CCSD</distributor>
        <availability status="restricted">
          <licence target="https://creativecommons.org/publicdomain/zero/1.0/">CC0 1.0 - Universal</licence>
        </availability>
        <date when="2026-05-20T23:26:42+02:00"/>
      </publicationStmt>
      <sourceDesc>
        <p part="N">HAL API Platform</p>
      </sourceDesc>
    </fileDesc>
  </teiHeader>
  <text>
    <body>
      <listBibl>
        <biblFull>
          <titleStmt>
            <title xml:lang="en">Follow the WhiteRabbit: Towards Consolidation of On-the-Fly Virtualization and Virtual Machine Introspection</title>
            <author role="aut">
              <persName>
                <forename type="first">Sergej</forename>
                <surname>Proskurin</surname>
              </persName>
              <email type="md5">e28293f25e6911e087eb9f2e68a95608</email>
              <email type="domain">sec.in.tum.de</email>
              <idno type="idhal" notation="numeric">1042916</idno>
              <idno type="halauthorid" notation="string">1525998-1042916</idno>
              <affiliation ref="#struct-132871"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Julian</forename>
                <surname>Kirsch</surname>
              </persName>
              <email type="md5">7f82df271d70ead91cd8e63892f45525</email>
              <email type="domain">sec.in.tum.de</email>
              <idno type="idhal" notation="numeric">1023803</idno>
              <idno type="halauthorid" notation="string">886300-1023803</idno>
              <affiliation ref="#struct-132871"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Apostolis</forename>
                <surname>Zarras</surname>
              </persName>
              <email type="md5">e6864c1948a2316586863a696ee83d5d</email>
              <email type="domain">maastrichtuniversity.nl</email>
              <idno type="idhal" notation="numeric">1042917</idno>
              <idno type="halauthorid" notation="string">1270735-1042917</idno>
              <affiliation ref="#struct-83832"/>
            </author>
            <editor role="depositor">
              <persName>
                <forename>Hal</forename>
                <surname>Ifip</surname>
              </persName>
              <email type="md5">2073ac78024b6e13f2714db96e9b1e63</email>
              <email type="domain">inria.fr</email>
            </editor>
          </titleStmt>
          <editionStmt>
            <edition n="v1" type="current">
              <date type="whenSubmitted">2019-02-21 16:41:39</date>
              <date type="whenModified">2026-01-28 10:52:04</date>
              <date type="whenReleased">2019-02-21 16:42:50</date>
              <date type="whenProduced">2018-09-18</date>
              <date type="whenEndEmbargoed">2021-01-01</date>
              <ref type="file" target="https://inria.hal.science/hal-02023739v1/document">
                <date notBefore="2021-01-01"/>
              </ref>
              <ref type="file" subtype="author" n="1" target="https://inria.hal.science/hal-02023739v1/file/472722_1_En_19_Chapter.pdf" id="file-2044873-2051723">
                <date notBefore="2021-01-01"/>
              </ref>
            </edition>
            <respStmt>
              <resp>contributor</resp>
              <name key="200187">
                <persName>
                  <forename>Hal</forename>
                  <surname>Ifip</surname>
                </persName>
                <email type="md5">2073ac78024b6e13f2714db96e9b1e63</email>
                <email type="domain">inria.fr</email>
              </name>
            </respStmt>
          </editionStmt>
          <publicationStmt>
            <distributor>CCSD</distributor>
            <idno type="halId">hal-02023739</idno>
            <idno type="halUri">https://inria.hal.science/hal-02023739</idno>
            <idno type="halBibtex">proskurin:hal-02023739</idno>
            <idno type="halRefHtml">&lt;i&gt;33th IFIP International Conference on ICT Systems Security and Privacy Protection (SEC)&lt;/i&gt;, Sep 2018, Poznan, Poland. pp.263-277, &lt;a target="_blank" href="https://dx.doi.org/10.1007/978-3-319-99828-2_19"&gt;&amp;#x27E8;10.1007/978-3-319-99828-2_19&amp;#x27E9;&lt;/a&gt;</idno>
            <idno type="halRef">33th IFIP International Conference on ICT Systems Security and Privacy Protection (SEC), Sep 2018, Poznan, Poland. pp.263-277, &amp;#x27E8;10.1007/978-3-319-99828-2_19&amp;#x27E9;</idno>
            <availability status="restricted">
              <licence target="https://creativecommons.org/licenses/by/4.0/">CC BY 4.0 - Attribution<ref corresp="#file-2044873-2051723"/></licence>
            </availability>
          </publicationStmt>
          <seriesStmt>
            <idno type="stamp" n="IFIP">IFIP - International Federation for Information Processing</idno>
            <idno type="stamp" n="IFIP-AICT" corresp="IFIP">IFIP Advances in Information and Communication Technology</idno>
            <idno type="stamp" n="IFIP-TC" corresp="IFIP">IFIP Technical Committees </idno>
            <idno type="stamp" n="IFIP-TC11" corresp="IFIP-TC">IFIP TC11: Security and Privacy Protection in Information Processing Systems</idno>
            <idno type="stamp" n="IFIP-SEC" corresp="IFIP"> International Information Security Conference</idno>
            <idno type="stamp" n="IFIP-AICT-529" corresp="IFIP-AICT">ICT Systems Security and Privacy Protection</idno>
          </seriesStmt>
          <notesStmt>
            <note type="commentary">Part 4: Software Security / Attacks</note>
            <note type="audience" n="2">International</note>
            <note type="invited" n="0">No</note>
            <note type="popular" n="0">No</note>
            <note type="peer" n="1">Yes</note>
            <note type="proceedings" n="1">Yes</note>
          </notesStmt>
          <sourceDesc>
            <biblStruct>
              <analytic>
                <title xml:lang="en">Follow the WhiteRabbit: Towards Consolidation of On-the-Fly Virtualization and Virtual Machine Introspection</title>
                <author role="aut">
                  <persName>
                    <forename type="first">Sergej</forename>
                    <surname>Proskurin</surname>
                  </persName>
                  <email type="md5">e28293f25e6911e087eb9f2e68a95608</email>
                  <email type="domain">sec.in.tum.de</email>
                  <idno type="idhal" notation="numeric">1042916</idno>
                  <idno type="halauthorid" notation="string">1525998-1042916</idno>
                  <affiliation ref="#struct-132871"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Julian</forename>
                    <surname>Kirsch</surname>
                  </persName>
                  <email type="md5">7f82df271d70ead91cd8e63892f45525</email>
                  <email type="domain">sec.in.tum.de</email>
                  <idno type="idhal" notation="numeric">1023803</idno>
                  <idno type="halauthorid" notation="string">886300-1023803</idno>
                  <affiliation ref="#struct-132871"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Apostolis</forename>
                    <surname>Zarras</surname>
                  </persName>
                  <email type="md5">e6864c1948a2316586863a696ee83d5d</email>
                  <email type="domain">maastrichtuniversity.nl</email>
                  <idno type="idhal" notation="numeric">1042917</idno>
                  <idno type="halauthorid" notation="string">1270735-1042917</idno>
                  <affiliation ref="#struct-83832"/>
                </author>
              </analytic>
              <monogr>
                <title level="m">IFIP Advances in Information and Communication Technology</title>
                <meeting>
                  <title>33th IFIP International Conference on ICT Systems Security and Privacy Protection (SEC)</title>
                  <date type="start">2018-09-18</date>
                  <date type="end">2018-09-20</date>
                  <settlement>Poznan</settlement>
                  <country key="PL">Poland</country>
                </meeting>
                <editor>Lech Jan Janczewski</editor>
                <editor>Mirosław Kutyłowski</editor>
                <imprint>
                  <publisher>Springer International Publishing</publisher>
                  <biblScope unit="serie">ICT Systems Security and Privacy Protection</biblScope>
                  <biblScope unit="volume">AICT-529</biblScope>
                  <biblScope unit="pp">263-277</biblScope>
                  <date type="datePub">2018</date>
                </imprint>
              </monogr>
              <idno type="doi">10.1007/978-3-319-99828-2_19</idno>
            </biblStruct>
          </sourceDesc>
          <profileDesc>
            <langUsage>
              <language ident="en">English</language>
            </langUsage>
            <textClass>
              <classCode scheme="halDomain" n="info">Computer Science [cs]</classCode>
              <classCode scheme="halTypology" n="COMM">Conference papers</classCode>
              <classCode scheme="halOldTypology" n="COMM">Conference papers</classCode>
              <classCode scheme="halTreeTypology" n="COMM">Conference papers</classCode>
            </textClass>
            <abstract xml:lang="en">
              <p>The growing complexity of modern malware drives security applications to leverage Virtual Machine Introspection (VMI), which provides a complete and untainted view over the Virtual Machine state. To benefit from this ability, a VMI-aware Virtual Machine Monitor (VMM) must be set up in advance underneath the target system; a constraint for the massive application of VMI. In this paper, we present WhiteRabbit, a VMI framework comprising a microkernel-based VMM that transparently virtualizes a running Operating System, on-the-fly, for the purpose of forensic analysis. As a result, the systems to be analyzed do not have to be explicitly set up for VMI a priori. After its deployment, our framework exposes VMI services for remote applications: WhiteRabbit implements a LibVMI interface that enables it to be engaged by popular VMI applications remotely. Our prototype employs Intel as well as ARM virtualization extensions to take over control of a running Linux system. WhiteRabbit’s on-the-fly capability and limited virtualization overhead constitute an effective solution for malware detection and analysis.</p>
            </abstract>
            <particDesc>
              <org type="consortium">TC 11</org>
            </particDesc>
          </profileDesc>
        </biblFull>
      </listBibl>
    </body>
    <back>
      <listOrg type="structures">
        <org type="institution" xml:id="struct-132871" status="VALID">
          <idno type="IdRef">031660150</idno>
          <idno type="ISNI">0000000123369749</idno>
          <idno type="ROR">https://ror.org/02kkvpp62</idno>
          <idno type="Wikidata">Q157808</idno>
          <orgName>Technische Universität Munchen = Technical University Munich = Université Technique de Munich</orgName>
          <orgName type="acronym">TUM</orgName>
          <date type="start">1868-01-01</date>
          <desc>
            <address>
              <addrLine>Arcisstrasse 21, D- 80333 München</addrLine>
              <country key="DE"/>
            </address>
            <ref type="url">https://www.tum.de</ref>
          </desc>
        </org>
        <org type="institution" xml:id="struct-83832" status="VALID">
          <idno type="ROR">https://ror.org/02jz4aj89</idno>
          <orgName>Maastricht University [Maastricht]</orgName>
          <desc>
            <address>
              <addrLine>Universiteitssingel 40;6200 MD Maastricht</addrLine>
              <country key="NL"/>
            </address>
            <ref type="url">http://www.maastrichtuniversity.nl/</ref>
          </desc>
        </org>
      </listOrg>
    </back>
  </text>
</TEI>