FAROS: Illuminating In-memory Injection Attacks via Provenance-Based Whole-System Dynamic Information Flow Tracking
Ether: malware analysis via hardware virtualization extensions