Reusing Hardware Performance Counters to Detect and Identify Kernel Control-Flow Modifying Rootkits
Lares: An Architecture for Secure Active Monitoring Using Virtualization