Lionel Litty H. Andrés Lagar-Cavilla David Lie Hypervisor Support for Identifying Covertly Executing Binaries. 243-258 2008 USENIX Security Symposium http://www.usenix.org/events/sec08/tech/full_papers/litty/litty.pdf conf/uss/2008 db/conf/uss/uss2008.html#LittyLL08