Mapping kernel objects to enable systematic integrity checking
Copilot - a coprocessor-based kernel runtime integrity monitor