Analyzing and improving Linux kernel memory protection: a model checking approach
Return-Oriented Rootkits: Bypassing Kernel Code Integrity Protection Mechanisms