{"id":"https://openalex.org/W4232895233","doi":"https://doi.org/10.1145/1095810.1095820","title":"Detecting past and present intrusions through vulnerability-specific predicates","display_name":"Detecting past and present intrusions through vulnerability-specific predicates","publication_year":2005,"publication_date":"2005-10-20","ids":{"openalex":"https://openalex.org/W4232895233","doi":"https://doi.org/10.1145/1095810.1095820"},"language":"en","primary_location":{"id":"doi:10.1145/1095810.1095820","is_oa":false,"landing_page_url":"https://doi.org/10.1145/1095810.1095820","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the twentieth ACM symposium on Operating systems principles","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5089293463","display_name":"Ashlesha Joshi","orcid":null},"institutions":[{"id":"https://openalex.org/I27837315","display_name":"University of Michigan","ror":"https://ror.org/00jmfr291","country_code":"US","type":"education","lineage":["https://openalex.org/I27837315"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Ashlesha Joshi","raw_affiliation_strings":["University of Michigan, Ann Arbor, MI"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Michigan, Ann Arbor, MI","institution_ids":["https://openalex.org/I27837315"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5112039412","display_name":"Samuel T. King","orcid":null},"institutions":[{"id":"https://openalex.org/I27837315","display_name":"University of Michigan","ror":"https://ror.org/00jmfr291","country_code":"US","type":"education","lineage":["https://openalex.org/I27837315"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Samuel T. King","raw_affiliation_strings":["University of Michigan, Ann Arbor, MI"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Michigan, Ann Arbor, MI","institution_ids":["https://openalex.org/I27837315"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5050883214","display_name":"George W. Dunlap","orcid":null},"institutions":[{"id":"https://openalex.org/I27837315","display_name":"University of Michigan","ror":"https://ror.org/00jmfr291","country_code":"US","type":"education","lineage":["https://openalex.org/I27837315"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"George W. Dunlap","raw_affiliation_strings":["University of Michigan, Ann Arbor, MI"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Michigan, Ann Arbor, MI","institution_ids":["https://openalex.org/I27837315"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5027819880","display_name":"Peter M. Chen","orcid":"https://orcid.org/0000-0002-5951-4183"},"institutions":[{"id":"https://openalex.org/I27837315","display_name":"University of Michigan","ror":"https://ror.org/00jmfr291","country_code":"US","type":"education","lineage":["https://openalex.org/I27837315"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Peter M. Chen","raw_affiliation_strings":["University of Michigan, Ann Arbor, MI"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Michigan, Ann Arbor, MI","institution_ids":["https://openalex.org/I27837315"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I27837315"],"apc_list":null,"apc_paid":null,"fwci":10.844,"has_fulltext":false,"cited_by_count":142,"citation_normalized_percentile":{"value":0.98896284,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":89,"max":100},"biblio":{"volume":null,"issue":null,"first_page":"91","last_page":"104"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.9994999766349792,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.9994999766349792,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9973000288009644,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10772","display_name":"Distributed systems and fault tolerance","score":0.9969000220298767,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8619323968887329},{"id":"https://openalex.org/keywords/vulnerability","display_name":"Vulnerability (computing)","score":0.7099227905273438},{"id":"https://openalex.org/keywords/software","display_name":"Software","score":0.5267521739006042},{"id":"https://openalex.org/keywords/virtual-machine","display_name":"Virtual machine","score":0.5248575210571289},{"id":"https://openalex.org/keywords/context","display_name":"Context (archaeology)","score":0.4921056628227234},{"id":"https://openalex.org/keywords/rootkit","display_name":"Rootkit","score":0.48639896512031555},{"id":"https://openalex.org/keywords/secure-coding","display_name":"Secure coding","score":0.4852614104747772},{"id":"https://openalex.org/keywords/overhead","display_name":"Overhead (engineering)","score":0.46384790539741516},{"id":"https://openalex.org/keywords/attack-surface","display_name":"Attack surface","score":0.43070870637893677},{"id":"https://openalex.org/keywords/software-system","display_name":"Software system","score":0.42735612392425537},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.4263584613800049},{"id":"https://openalex.org/keywords/taint-checking","display_name":"Taint checking","score":0.4147539436817169},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.4107348322868347},{"id":"https://openalex.org/keywords/software-security-assurance","display_name":"Software security assurance","score":0.4050832688808441},{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.31937384605407715},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.303477942943573},{"id":"https://openalex.org/keywords/information-security","display_name":"Information security","score":0.1797609031200409}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8619323968887329},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.7099227905273438},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.5267521739006042},{"id":"https://openalex.org/C25344961","wikidata":"https://www.wikidata.org/wiki/Q192726","display_name":"Virtual machine","level":2,"score":0.5248575210571289},{"id":"https://openalex.org/C2779343474","wikidata":"https://www.wikidata.org/wiki/Q3109175","display_name":"Context (archaeology)","level":2,"score":0.4921056628227234},{"id":"https://openalex.org/C10144332","wikidata":"https://www.wikidata.org/wiki/Q14645","display_name":"Rootkit","level":3,"score":0.48639896512031555},{"id":"https://openalex.org/C22680326","wikidata":"https://www.wikidata.org/wiki/Q7444867","display_name":"Secure coding","level":5,"score":0.4852614104747772},{"id":"https://openalex.org/C2779960059","wikidata":"https://www.wikidata.org/wiki/Q7113681","display_name":"Overhead (engineering)","level":2,"score":0.46384790539741516},{"id":"https://openalex.org/C2776576444","wikidata":"https://www.wikidata.org/wiki/Q303569","display_name":"Attack surface","level":2,"score":0.43070870637893677},{"id":"https://openalex.org/C149091818","wikidata":"https://www.wikidata.org/wiki/Q2429814","display_name":"Software system","level":3,"score":0.42735612392425537},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.4263584613800049},{"id":"https://openalex.org/C63116202","wikidata":"https://www.wikidata.org/wiki/Q7676227","display_name":"Taint checking","level":3,"score":0.4147539436817169},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.4107348322868347},{"id":"https://openalex.org/C62913178","wikidata":"https://www.wikidata.org/wiki/Q7554361","display_name":"Software security assurance","level":4,"score":0.4050832688808441},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.31937384605407715},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.303477942943573},{"id":"https://openalex.org/C527648132","wikidata":"https://www.wikidata.org/wiki/Q189900","display_name":"Information security","level":2,"score":0.1797609031200409},{"id":"https://openalex.org/C151730666","wikidata":"https://www.wikidata.org/wiki/Q7205","display_name":"Paleontology","level":1,"score":0.0},{"id":"https://openalex.org/C29983905","wikidata":"https://www.wikidata.org/wiki/Q7445066","display_name":"Security service","level":3,"score":0.0},{"id":"https://openalex.org/C86803240","wikidata":"https://www.wikidata.org/wiki/Q420","display_name":"Biology","level":0,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/1095810.1095820","is_oa":false,"landing_page_url":"https://doi.org/10.1145/1095810.1095820","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the twentieth ACM symposium on Operating systems principles","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":26,"referenced_works":["https://openalex.org/W103935667","https://openalex.org/W1495241705","https://openalex.org/W1500546894","https://openalex.org/W1641762327","https://openalex.org/W1979820341","https://openalex.org/W2011992756","https://openalex.org/W2040015657","https://openalex.org/W2053903896","https://openalex.org/W2108806129","https://openalex.org/W2109914336","https://openalex.org/W2114488210","https://openalex.org/W2120635877","https://openalex.org/W2151182669","https://openalex.org/W2159477904","https://openalex.org/W2163762767","https://openalex.org/W2172126802","https://openalex.org/W4206796831","https://openalex.org/W4244704438","https://openalex.org/W4254762831","https://openalex.org/W6607144868","https://openalex.org/W6629420296","https://openalex.org/W6638932164","https://openalex.org/W6664953017","https://openalex.org/W6676207613","https://openalex.org/W6678648185","https://openalex.org/W6845661910"],"related_works":["https://openalex.org/W2141388993","https://openalex.org/W1978034799","https://openalex.org/W2999607548","https://openalex.org/W2956597637","https://openalex.org/W2293245356","https://openalex.org/W4225160120","https://openalex.org/W23486959","https://openalex.org/W2589805430","https://openalex.org/W1486481742","https://openalex.org/W4248500578"],"abstract_inverted_index":{"Most":[0],"systems":[1],"contain":[2],"software":[3,23,41],"with":[4,146],"yet-to-be-discovered":[5],"security":[6,54],"vulnerabilities.":[7,241],"When":[8],"a":[9,83,106,215],"vulnerability":[10,62,77,84],"is":[11,51,78,85],"disclosed,":[12],"administrators":[13],"face":[14],"the":[15,43,61,76,92,100,110,127,151,165,168,184,187,201,229],"grim":[16],"reality":[17],"that":[18,30,58,72,108,176,207],"they":[19,198],"have":[20],"been":[21,47],"running":[22,38],"which":[24],"was":[25,63],"open":[26],"to":[27,36,52,70,125,159,193,225],"attack.":[28],"Sites":[29],"value":[31],"availability":[32],"may":[33],"be":[34,211],"forced":[35],"continue":[37],"this":[39],"vulnerable":[40],"until":[42],"accompanying":[44],"patch":[45],"has":[46],"tested.":[48],"Our":[49,118],"goal":[50],"improve":[53],"by":[55,66,87,142,156],"detecting":[56,67],"intrusions":[57,71,226],"occurred":[59],"before":[60],"disclosed":[64],"and":[65,68,103,112,131,171,223,231,235],"responding":[69],"are":[73],"attempted":[74],"after":[75],"disclosed.":[79],"We":[80,205],"detect":[81,222],"when":[82],"triggered":[86],"executing":[88],"vulnerability-specific":[89,116,208],"predicates":[90,137,155,158,177,192,209],"as":[91],"system":[93,107,133],"runs":[94],"or":[95],"replays.":[96],"This":[97],"paper":[98],"describes":[99],"design,":[101],"implementation":[102],"evaluation":[104],"of":[105,114,129,153,167,186,203,218],"supports":[109],"construction":[111,152],"execution":[113,128,140],"these":[115],"predicates.":[117],"system,":[119,170],"called":[120],"IntroVirt,":[121],"uses":[122,173],"virtual-machine":[123,144,147],"introspection":[124,145],"monitor":[126],"application":[130],"operating":[132],"software.":[134],"IntroVirt":[135,149,190],"executes":[136],"over":[138,227],"past":[139,230],"periods":[141],"combining":[143],"replay.":[148],"eases":[150],"powerful":[154],"allowing":[157],"run":[160],"existing":[161],"target":[162,169,180,188],"code":[163,181],"in":[164,200],"context":[166],"it":[172],"checkpoints":[174],"so":[175,197],"can":[178,210,221],"execute":[179],"without":[182],"perturbing":[183],"state":[185],"system.":[189],"allows":[191],"refresh":[194],"themselves":[195],"automatically":[196],"work":[199],"presence":[202],"preemptions.":[204],"show":[206],"written":[212],"easily":[213],"for":[214,239],"wide":[216],"variety":[217],"real":[219],"vulnerabilities,":[220],"respond":[224],"both":[228],"present":[232],"time":[233],"intervals,":[234],"add":[236],"little":[237],"overhead":[238],"most":[240]},"counts_by_year":[{"year":2023,"cited_by_count":1},{"year":2021,"cited_by_count":1},{"year":2020,"cited_by_count":1},{"year":2018,"cited_by_count":1},{"year":2017,"cited_by_count":2},{"year":2016,"cited_by_count":5},{"year":2015,"cited_by_count":5},{"year":2014,"cited_by_count":11},{"year":2013,"cited_by_count":18},{"year":2012,"cited_by_count":10}],"updated_date":"2026-07-29T14:22:42.915294","created_date":"2025-10-10T00:00:00"}