2018.02/Security Education
Using Virtual Machine Introspection for Operating Systems Security Education
M. Bhatt, I. Ahmed, Z. Lin
Abstract
Describes a hands-on curriculum using virtual machine introspection to teach operating-systems security, letting students observe rootkits and live system state from outside the compromised guest.
Where it sits
Pillar 03 — Defenses, Artifacts & Disclosure
What can a defender run tomorrow?
Turn findings into usable protection — concrete defenses, deployed tools, and real vulnerability disclosure.
Outside writing
No verified independent writing about this paper yet. If you have written about it, send the link to b1oo@shrewdsecurity.io.
How outside writing is graded →More from defenses
Whole pillar →2026.06Beyond Injection Detection: A Positive-Security Prompt Firewall that Closes the Scope and PHI Gap SOTA Classifiers Miss in HealthcarePresents QFIRE, an inline, provider-agnostic prompt firewall for healthcare AI agents that combines positive-security scope constraints, an asynchronous detector graph, and de-obfuscation — and releases QFIRE-HealthBench, where generic injection detectors recover only 0.40 recall while QFIRE's scope+PHI chain reaches 0.83.2025.11MAIF: Enforcing AI Trust and Provenance with an Artifact-Centric Agentic ParadigmProposes an artifact-centric architecture that embeds provenance, access control, and audit evidence into the data objects used by AI agents.2025.07ETDI: Mitigating Tool Squatting and Rug Pull Attacks in Model Context Protocol (MCP) by Using OAuth-Enhanced Tool Definitions and Policy-Based Access ControlMitigates tool squatting and rug pull attacks in the Model Context Protocol (MCP) by hardening tool definitions with OAuth-enhanced signatures and policy-based access control, preventing malicious or mutated tools from being silently substituted into agent workflows.