2018.01/Systems Security
Automatic Mitigation of Kernel Rootkits in Cloud Environments
J. Grimm, I. Ahmed, V. Roussev, M. Bhatt, M. Hong
Abstract
Presents an automated approach to detecting and mitigating kernel rootkits in cloud environments using virtual machine introspection, without agents inside the guest.
Where it sits
Pillar 03 — Defenses, Artifacts & Disclosure
What can a defender run tomorrow?
Turn findings into usable protection — concrete defenses, deployed tools, and real vulnerability disclosure.
Outside writing
No verified independent writing about this paper yet. If you have written about it, send the link to b1oo@shrewdsecurity.io.
How outside writing is graded →More from defenses
Whole pillar →2026.06Beyond Injection Detection: A Positive-Security Prompt Firewall that Closes the Scope and PHI Gap SOTA Classifiers Miss in HealthcarePresents QFIRE, an inline, provider-agnostic prompt firewall for healthcare AI agents that combines positive-security scope constraints, an asynchronous detector graph, and de-obfuscation — and releases QFIRE-HealthBench, where generic injection detectors recover only 0.40 recall while QFIRE's scope+PHI chain reaches 0.83.2025.11MAIF: Enforcing AI Trust and Provenance with an Artifact-Centric Agentic ParadigmProposes an artifact-centric architecture that embeds provenance, access control, and audit evidence into the data objects used by AI agents.2025.07ETDI: Mitigating Tool Squatting and Rug Pull Attacks in Model Context Protocol (MCP) by Using OAuth-Enhanced Tool Definitions and Policy-Based Access ControlMitigates tool squatting and rug pull attacks in the Model Context Protocol (MCP) by hardening tool definitions with OAuth-enhanced signatures and policy-based access control, preventing malicious or mutated tools from being silently substituted into agent workflows.