{"id":"https://openalex.org/W1976146154","doi":"https://doi.org/10.1145/1134760.1134765","title":"Using VMM-based sensors to monitor honeypots","display_name":"Using VMM-based sensors to monitor honeypots","publication_year":2006,"publication_date":"2006-06-14","ids":{"openalex":"https://openalex.org/W1976146154","doi":"https://doi.org/10.1145/1134760.1134765","mag":"1976146154"},"language":"en","primary_location":{"id":"doi:10.1145/1134760.1134765","is_oa":false,"landing_page_url":"https://doi.org/10.1145/1134760.1134765","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2nd international conference on Virtual execution environments","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5032195188","display_name":"Kurniadi Asrigo","orcid":null},"institutions":[{"id":"https://openalex.org/I185261750","display_name":"University of Toronto","ror":"https://ror.org/03dbr7087","country_code":"CA","type":"education","lineage":["https://openalex.org/I185261750"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"Kurniadi Asrigo","raw_affiliation_strings":["University of Toronto"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Toronto","institution_ids":["https://openalex.org/I185261750"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5082549562","display_name":"Lionel Litty","orcid":null},"institutions":[{"id":"https://openalex.org/I185261750","display_name":"University of Toronto","ror":"https://ror.org/03dbr7087","country_code":"CA","type":"education","lineage":["https://openalex.org/I185261750"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"Lionel Litty","raw_affiliation_strings":["University of Toronto"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Toronto","institution_ids":["https://openalex.org/I185261750"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5049933072","display_name":"David Lie","orcid":"https://orcid.org/0000-0002-2000-6827"},"institutions":[{"id":"https://openalex.org/I185261750","display_name":"University of Toronto","ror":"https://ror.org/03dbr7087","country_code":"CA","type":"education","lineage":["https://openalex.org/I185261750"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"David Lie","raw_affiliation_strings":["University of Toronto"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Toronto","institution_ids":["https://openalex.org/I185261750"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I185261750"],"apc_list":null,"apc_paid":null,"fwci":4.7007,"has_fulltext":false,"cited_by_count":57,"citation_normalized_percentile":{"value":0.96066532,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":90,"max":98},"biblio":{"volume":null,"issue":null,"first_page":"13","last_page":"23"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9994999766349792,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.9986000061035156,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/honeypot","display_name":"Honeypot","score":0.8563727140426636},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7759992480278015},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.7211703658103943},{"id":"https://openalex.org/keywords/hypervisor","display_name":"Hypervisor","score":0.6705701351165771},{"id":"https://openalex.org/keywords/virtualization","display_name":"Virtualization","score":0.6361897587776184},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.6188989877700806},{"id":"https://openalex.org/keywords/overhead","display_name":"Overhead (engineering)","score":0.5898988842964172},{"id":"https://openalex.org/keywords/virtual-machine","display_name":"Virtual machine","score":0.547883152961731},{"id":"https://openalex.org/keywords/system-monitoring","display_name":"System monitoring","score":0.5269875526428223},{"id":"https://openalex.org/keywords/exploit","display_name":"Exploit","score":0.5178380608558655},{"id":"https://openalex.org/keywords/embedded-system","display_name":"Embedded system","score":0.49220624566078186},{"id":"https://openalex.org/keywords/trusted-computing-base","display_name":"Trusted computing base","score":0.46910056471824646},{"id":"https://openalex.org/keywords/real-time-computing","display_name":"Real-time computing","score":0.3465084731578827},{"id":"https://openalex.org/keywords/cloud-computing","display_name":"Cloud computing","score":0.31594347953796387},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.2810855805873871}],"concepts":[{"id":"https://openalex.org/C191267431","wikidata":"https://www.wikidata.org/wiki/Q911932","display_name":"Honeypot","level":2,"score":0.8563727140426636},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7759992480278015},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.7211703658103943},{"id":"https://openalex.org/C112904061","wikidata":"https://www.wikidata.org/wiki/Q1077480","display_name":"Hypervisor","level":4,"score":0.6705701351165771},{"id":"https://openalex.org/C513985346","wikidata":"https://www.wikidata.org/wiki/Q270471","display_name":"Virtualization","level":3,"score":0.6361897587776184},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.6188989877700806},{"id":"https://openalex.org/C2779960059","wikidata":"https://www.wikidata.org/wiki/Q7113681","display_name":"Overhead (engineering)","level":2,"score":0.5898988842964172},{"id":"https://openalex.org/C25344961","wikidata":"https://www.wikidata.org/wiki/Q192726","display_name":"Virtual machine","level":2,"score":0.547883152961731},{"id":"https://openalex.org/C200749887","wikidata":"https://www.wikidata.org/wiki/Q1165574","display_name":"System monitoring","level":2,"score":0.5269875526428223},{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.5178380608558655},{"id":"https://openalex.org/C149635348","wikidata":"https://www.wikidata.org/wiki/Q193040","display_name":"Embedded system","level":1,"score":0.49220624566078186},{"id":"https://openalex.org/C147346212","wikidata":"https://www.wikidata.org/wiki/Q5492632","display_name":"Trusted computing base","level":4,"score":0.46910056471824646},{"id":"https://openalex.org/C79403827","wikidata":"https://www.wikidata.org/wiki/Q3988","display_name":"Real-time computing","level":1,"score":0.3465084731578827},{"id":"https://openalex.org/C79974875","wikidata":"https://www.wikidata.org/wiki/Q483639","display_name":"Cloud computing","level":2,"score":0.31594347953796387},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.2810855805873871},{"id":"https://openalex.org/C184842701","wikidata":"https://www.wikidata.org/wiki/Q370563","display_name":"Cloud computing security","level":3,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/1134760.1134765","is_oa":false,"landing_page_url":"https://doi.org/10.1145/1134760.1134765","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2nd international conference on Virtual execution environments","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":27,"referenced_works":["https://openalex.org/W161166442","https://openalex.org/W186343359","https://openalex.org/W198543417","https://openalex.org/W1490509368","https://openalex.org/W1514368868","https://openalex.org/W1540548505","https://openalex.org/W1641762327","https://openalex.org/W1655226010","https://openalex.org/W1844590493","https://openalex.org/W2040234252","https://openalex.org/W2054840305","https://openalex.org/W2100673955","https://openalex.org/W2104948281","https://openalex.org/W2127133592","https://openalex.org/W2131726714","https://openalex.org/W2139859676","https://openalex.org/W2142892618","https://openalex.org/W2147767253","https://openalex.org/W2155750598","https://openalex.org/W2160352512","https://openalex.org/W2914982603","https://openalex.org/W4231945399","https://openalex.org/W4232895233","https://openalex.org/W4244704438","https://openalex.org/W4250874986","https://openalex.org/W6630780968","https://openalex.org/W6638932164"],"related_works":["https://openalex.org/W2150042079","https://openalex.org/W2133426354","https://openalex.org/W2112715807","https://openalex.org/W2495160385","https://openalex.org/W2295390884","https://openalex.org/W2535368334","https://openalex.org/W2318857059","https://openalex.org/W1589284876","https://openalex.org/W4313287740","https://openalex.org/W78055790"],"abstract_inverted_index":{"Virtual":[0],"Machine":[1],"Monitors":[2],"(VMMs)":[3],"are":[4,129],"a":[5,19,67,75,81],"common":[6],"tool":[7],"for":[8,26,120],"implementing":[9,154],"honeypots.":[10,32,104],"In":[11,80],"this":[12],"paper":[13],"we":[14,39,85],"examine":[15],"the":[16,58,63,117,136,142,155,159,163,167,171,174,179],"implementation":[17],"of":[18,70,78,126,138,162,169,173,178],"VMM-based":[20],"intrusion":[21],"detection":[22],"and":[23,35,49,65,97,141],"monitoring":[24,71,112,121,139,144],"system":[25,64],"collecting":[27],"information":[28],"about":[29],"attacks":[30,106],"on":[31,42,102,135],"We":[33,114],"document":[34],"evaluate":[36],"three":[37,82],"designs":[38,56],"have":[40],"implemented":[41],"two":[43,111],"open-source":[44],"virtualization":[45],"platforms:":[46],"User-Mode":[47],"Linux":[48],"Xen.":[50],"Our":[51],"results":[52],"show":[53],"that":[54,116],"our":[55,103],"give":[57],"monitor":[59,156],"good":[60],"visibility":[61],"into":[62],"thus,":[66],"small":[68],"number":[69,77,137],"sensors":[72],"can":[73,149],"detect":[74,89],"large":[76],"intrusions.":[79],"month":[83],"period,":[84],"were":[86,107],"able":[87],"to":[88],"five":[90],"different":[91],"attacks,":[92],"as":[93,95],"well":[94],"collect":[96],"try":[98],"46":[99],"more":[100],"exploits":[101],"All":[105],"detected":[108],"with":[109],"only":[110],"sensors.":[113],"found":[115],"performance":[118,147],"overhead":[119,148],"such":[122],"intrusions":[123],"is":[124],"independent":[125],"which":[127],"events":[128,140],"being":[130],"monitored,":[131],"but":[132],"depends":[133],"entirely":[134],"underlying":[143],"implementation.":[145],"The":[146],"be":[150],"significantly":[151],"improved":[152],"by":[153],"directly":[157],"in":[158],"privileged":[160],"code":[161],"VMM,":[164],"though":[165],"at":[166],"cost":[168],"increasing":[170],"size":[172],"trusted":[175],"computing":[176],"base":[177],"system.":[180]},"counts_by_year":[{"year":2024,"cited_by_count":1},{"year":2023,"cited_by_count":2},{"year":2021,"cited_by_count":2},{"year":2020,"cited_by_count":2},{"year":2018,"cited_by_count":3},{"year":2017,"cited_by_count":1},{"year":2016,"cited_by_count":3},{"year":2015,"cited_by_count":4},{"year":2014,"cited_by_count":3},{"year":2013,"cited_by_count":5},{"year":2012,"cited_by_count":3}],"updated_date":"2026-07-29T14:22:42.915294","created_date":"2025-10-10T00:00:00"}