Reusing Hardware Performance Counters to Detect and Identify Kernel Control-Flow Modifying Rootkits
On the feasibility of online malware detection with performance counters