Thats a unique idea.You should consider the following idea to enhance your idea so that it would impact uniquely: Process hiding is a commonly used stealth technique which facilitates the evasion from the detection by anti-malware programs. ,  propose a new approach called  Aries to implicitly detect the hidden processes. Aries introduces a novel feather-ight hardware-assisted virtual machine monitor (VMM) to obtain the True Process List (TPL). Compared to existing VMM-based approaches, Aries offers three distinct advantages:  dynamic OS migration ,  implicit introspection of TPL and  non-bypassable interfaces for exposing TPL. Unlike typical VMMs, Aries can dynamically migrate a booted OS on it. By tracking the low-level interactions beten the OS and the memory management structures, Aries is decoupled with the explicit OS implementation information which is subvertable for the privileged malware. Our functionality evaluation shows Aries can detect more process-hiding malware than existing detectors while the performance evaluation shows desktop-oriented workloads achieve 95.2% of native speed on average.
['Yan Wen', 'Jinjing Zhao', 'Huaimin Wang', 'Jiannong Cao']
I am writing a research paper on a idea Implicit Detection of Hidden Processes with a Feather-Weight Hardware-Assisted Virtual Machine Monitor
[{"from": "human", "value": "I am writing a research paper on a idea Implicit Detection of Hidden Processes with a Feather-Weight Hardware-Assisted Virtual Machine Monitor"}, {"from": "gpt", "value": "Thats a unique idea.You should consider the following idea to enhance your idea so that it would impact uniquely: Process hiding is a commonly used stealth technique which facilitates the evasion from the detection by anti-malware programs. ,  propose a new approach called  Aries to implicitly detect the hidden processes. Aries introduces a novel feather-ight hardware-assisted virtual machine monitor (VMM) to obtain the True Process List (TPL). Compared to existing VMM-based approaches, Aries offers three distinct advantages:  dynamic OS migration ,  implicit introspection of TPL and  non-bypassable interfaces for exposing TPL. Unlike typical VMMs, Aries can dynamically migrate a booted OS on it. By tracking the low-level interactions beten the OS and the memory management structures, Aries is decoupled with the explicit OS implementation information which is subvertable for the privileged malware. Our functionality evaluation shows Aries can detect more process-hiding malware than existing detectors while the performance evaluation shows desktop-oriented workloads achieve 95.2% of native speed on average."}]