paper.bib

@misc{Lind,
title={{Lind, a new generation of secure virtualization}},
	howpublished = {https://lind.poly.edu/},
	key={Lind},
	note={}
}

@misc{Poisson-distribution,
title={{Poisson Distribution}},
	howpublished = {https://en.wikipedia.org/wiki/Poisson\_distribution},
	key={Poisson},
	note={}
}

@misc{Top-Packages,
	title={{Debian Popularity Contest}},
	howpublished = {http://popcon.debian.org/main/index.html},
	note={Accessed December 2014}
}

@misc{NVD,
	title={{National Vulnerability Database}},
	howpublished = {https://nvd.nist.gov/},
	key={NVD},
	note={Accessed September 2015}
}

@misc{LTP,
	title={{Linux Test Project}},
	howpublished = {https://linux-test-project.github.io/},
	key={LTP},
	note={Accessed February 2015}
}

@misc{Trinity,
title={{Trinity, a Linux System call fuzz tester}},
	howpublished = {http://codemonkey.org.uk/projects/trinity/},
	key={Trinity},
	note={Accessed November 2014}
}

@inproceedings{Repy-10, 
    author={Cappos, J. and Dadgar, A. and Rasley, J. and Samuel, J. and Beschastnikh, 
    I. and Barsan, C. and Krishnamurthy, A. and Anderson, T.}, 
    title={Retaining sandbox containment despite bugs in privileged memory-safe code}, 
    booktitle={Proceedings of the CCS'10}, 
    year={2010}, 
} 

@inproceedings{NaCl-09, 
    author={Yee, B. and Sehr, D. and Dardyk, G. and Chen, J. B. and Muth, 
    R. and Ormandy, T. and Okasaka, S. and Narula, N. and Fullagar, N.}, 
    title={Native Client: A Sandbox for Portable, Untrusted x86 Native Code}, 
    booktitle={Proceedings of the IEEE Symposium on Security and Privacy}, 
    year={2009}, 
    pages = {79-93},
    address = {Berkeley, CA, USA},
} 
    
@inproceedings{Drawbridge-11, 
    author={Porter, D. E. and Boyd-Wickizer, S. and Howell, J. and Olinsky, R. and Hunt, G. C}, 
    title={Rethinking the Library OS from the Top Down}, 
    booktitle={Proceedings of the ASPLOS'11}, 
    year={2011}, 
    pages = {291-304},
    address = {Newport Beach, California, USA},
} 

@inproceedings{Graphene-14, 
    author={Tsai, C. C. and Arora, K. S. and Bandi, N. and Jain, B. and Jannen, W. and John, 
    J. and Kalodner, H. A. and Kulkarni, V. and Oliveira, D. and Porter, D. E.}, 
    title={Cooperation and Security Isolation of Library OSes for Multi-Process Applications}, 
    booktitle={Proceedings of the EuroSys'14}, 
    year={2014}, 
    address = {Amsterdam, Netherlands},
} 


@misc{gcov,
	title={{gcov(1) - Linux man page}},
	howpublished = {http://linux.die.net/man/1/gcov},
	key={gcov},
	note={Accessed October 2014}
}


@inproceedings{Xen-03, 
    author={Barham, P. and Dragovich, B. and Fraser, K. and Hand, S. and Harris, 
    T. and Ho, A. and Neugebauer, R. and Pratt, I. and Warfield, A.}, 
    title={Xen and the Art of Virtualization}, 
    booktitle={Proceedings of the SOSP'03}, 
    year={2003}, 
    pages = {164-177},
} 

@inproceedings{SCI-04, 
    author={Garfinkel, T. and Pfaff, B. and Rosenblum, M.}, 
    title={Ostia: A delegating architecture for secure system call interposition}, 
    booktitle={Proceedings of the NDSS'04}, 
    year={2004}, 
} 

@inproceedings{Janus0:96, 
    author={Goldberg, I. and Wagner, D. and Thomas, R. and Brewer, E.}, 
    title={A secure environment for untrusted helper applications (confining the wily hacker)}, 
    booktitle={Proceedings of the USENIX UNIX Security Symposium'96}, 
    year={1996}, 
} 

@inproceedings{Janus:99, 
    author={Wagner, D. A.}, 
    title={Janus: An approach for confinement of untrusted applications}, 
    booktitle={Tech. Rep. CSD-99-1056, University of California, Berkeley}, 
    year={1999}, 
} 

@inproceedings{SFI:93, 
    author={Wahbe, R. and Lucco, S. and Anderson, T. E. and Graham, S. L.}, 
    title={Efficient software-based fault isolation}, 
    booktitle={SIGOPS Oper. Syst. Rev. 27, 5}, 
    year={1993}, 
    pages = {203-216},
} 

@inproceedings{Nooks:03, 
    author={Swift, M. M. and Bershad, B. N. and Levy, H. M.}, 
    title={Improving the reliability of commodity operating systems}, 
    booktitle={Proceedings of the SOSP'03}, 
    year={2003}, 
    pages = {207-222},
} 

@misc{CVE:14,
    title={{Kernel Vulnerability Statistics0}},
    author={{CVE DETAILS}},
    howpublished={http://www.cvedetails.com/product/47/Linux-Linux-Kernel.html?vendor_id=33},
    year={2014},
}

@misc{NVD:14,
    title={Kernel Vulnerabilities},
    author={{NATIONAL VULNERABILITY DATABASE}},
    howpublished={http://goo.gl/GJpw0b},
    year={2014},
}

@inproceedings{Metrics-13, 
    author={Anil Kurmus and Reinhard Tartler and Daniela Dorneanu and 
    Bernhard Heinloth and Valentin Rothberg and Andreas Ruprecht and Wolfgang Schroder-Preikschat 
    and Daniel Lohmann and Rudiger Kapitza}, 
    title={Attack Surface Metrics and Automated Compile-Time OS Kernel Tailoring}, 
    booktitle={Proceedings of the NDSS'13}, 
    year={2013}, 
    pages={}, 
} 

@inproceedings{Linux-13, 
    author={Greg Kroah-Hartman and Jonathan Corbet and Amanda McPherson}, 
    title={Linux Kernel Development Tech. Rep.}, 
    booktitle={Linux Foundation}, 
    year={2013}, 
    pages={}, 
} 

#
#  below are 40 sever Linux kernel bugs from last 5 years
#  that we examined and used in this Lind paper
#

# number: 01
# type: concurrency, race condition
@misc{CVE:20149529,
    title={{CVE-2014-9529}},
    author={{COMMON VULNERABILITIES AND EXPOSURES}},
    howpublished={},
    year={2014},
    month={},
}

# number: 02
# type: NULL pointer dereference
@misc{CVE:20143631,
    title={{CVE-2014-3631}},
    author={{COMMON VULNERABILITIES AND EXPOSURES}},
    howpublished={},
    year={2014},
    month={},
}

# number: 03
# type: network socket variable mischeck
@misc{CVE:20126657,
    title={{CVE-2012-6657}},
    author={{COMMON VULNERABILITIES AND EXPOSURES}},
    howpublished={},
    year={2012},
    month={},
}

# number: 04
# type: privilege escalation
@misc{CVE:20145207,
    title={{CVE-2014-5207}},
    author={{COMMON VULNERABILITIES AND EXPOSURES}},
    howpublished={},
    year={2014},
    month={},
}

# number: 05
# type: privilege escalation
@misc{CVE:20145206,
    title={{CVE-2014-5206}},
    author={{COMMON VULNERABILITIES AND EXPOSURES}},
    howpublished={},
    year={2014},
    month={},
}

# number: 06
# type: privilege escalation
@misc{CVE:20143153,
    title={{CVE-2014-3153}},
    author={{COMMON VULNERABILITIES AND EXPOSURES}},
    howpublished={},
    year={2014},
    month={},
}

# number: 07
# type: privilege escalation
@misc{CVE:20142851,
    title={{CVE-2014-2851}},
    author={{COMMON VULNERABILITIES AND EXPOSURES}},
    howpublished={},
    year={2014},
    month={},
}

# number: 08
# type: race condition, DoS
@misc{CVE:20142706,
    title={{CVE-2014-2706}},
    author={{COMMON VULNERABILITIES AND EXPOSURES}},
    howpublished={},
    year={2014},
    month={},
}

# number: 09
# type: race condition, DoS
@misc{CVE:20140100,
    title={{CVE-2014-0100}},
    author={{COMMON VULNERABILITIES AND EXPOSURES}},
    howpublished={},
    year={2014},
    month={},
}

# number: 10
# type: buffer overflow
@misc{CVE:20140049,
    title={{CVE-2014-0049}},
    author={{COMMON VULNERABILITIES AND EXPOSURES}},
    howpublished={},
    year={2014},
    month={},
}

# number: 11
# type: DoS 
@misc{CVE:20126638,
    title={{CVE-2012-6638}},
    author={{COMMON VULNERABILITIES AND EXPOSURES}},
    howpublished={},
    year={2012},
    month={},
}

# number: 12
# type: privilege escalation 
@misc{CVE:20140038,
    title={{CVE-2014-0038}},
    author={{COMMON VULNERABILITIES AND EXPOSURES}},
    howpublished={},
    year={2014},
    month={},
}

# number: 13
# type: privilege escalation 
@misc{CVE:20136368,
    title={{CVE-2013-6368}},
    author={{COMMON VULNERABILITIES AND EXPOSURES}},
    howpublished={},
    year={2013},
    month={},
}

# number: 14
# type: index error, privilege escalation 
@misc{CVE:20134587,
    title={{CVE-2013-4587}},
    author={{COMMON VULNERABILITIES AND EXPOSURES}},
    howpublished={},
    year={2013},
    month={},
}

# number: 15
# type: size/boundary check, DoS 
@misc{CVE:20134563,
    title={{CVE-2013-4563}},
    author={{COMMON VULNERABILITIES AND EXPOSURES}},
    howpublished={},
    year={2013},
    month={},
}

# number: 16
# type: value validation 
@misc{CVE:20134348,
    title={{CVE-2013-4348}},
    author={{COMMON VULNERABILITIES AND EXPOSURES}},
    howpublished={},
    year={2013},
    month={},
}

# number: 17
# type: privilege escalation 
@misc{CVE:20134300,
    title={{CVE-2013-4300}},
    author={{COMMON VULNERABILITIES AND EXPOSURES}},
    howpublished={},
    year={2013},
    month={},
}

# number: 18
# type: privilege escalation 
@misc{CVE:20131943,
    title={{CVE-2013-1943}},
    author={{COMMON VULNERABILITIES AND EXPOSURES}},
    howpublished={},
    year={2013},
    month={},
}

# number: 19
# type: privilege escalation 
@misc{CVE:20132094,
    title={{CVE-2013-2094}},
    author={{COMMON VULNERABILITIES AND EXPOSURES}},
    howpublished={},
    year={2013},
    month={February},
}

# number: 20
# type: NULL pointer dereference, DoS
@misc{CVE:20133301,
    title={{CVE-2013-3301}},
    author={{COMMON VULNERABILITIES AND EXPOSURES}},
    howpublished={},
    year={2013},
    month={},
}

# number: 21
# type: privilege escalation
@misc{CVE:20131858,
    title={{CVE-2013-1858}},
    author={{COMMON VULNERABILITIES AND EXPOSURES}},
    howpublished={},
    year={2013},
    month={},
}

# number: 22
# type: use-after-free
@misc{CVE:20131797,
    title={{CVE-2013-1797}},
    author={{COMMON VULNERABILITIES AND EXPOSURES}},
    howpublished={},
    year={2013},
    month={},
}

# number: 23
# type: privilege escalation, index error
@misc{CVE:20131763,
    title={{CVE-2013-1763}},
    author={{COMMON VULNERABILITIES AND EXPOSURES}},
    howpublished={},
    year={2013},
    month={},
}

# number: 24
# type: NULL pointer dereference
@misc{CVE:20130310,
    title={{CVE-2013-0310}},
    author={{COMMON VULNERABILITIES AND EXPOSURES}},
    howpublished={},
    year={2013},
    month={},
}

# number: 25
# type: heap-based buffer overflow
@misc{CVE:20122136,
    title={{CVE-2012-2136}},
    author={{COMMON VULNERABILITIES AND EXPOSURES}},
    howpublished={},
    year={2012},
    month={},
}

# number: 26
# type: lack of sanity check
@misc{CVE:20122100,
    title={{CVE-2012-2100}},
    author={{COMMON VULNERABILITIES AND EXPOSURES}},
    howpublished={},
    year={2012},
    month={},
}

# number: 27
# type: privilege escalation
@misc{CVE:20120028,
    title={{CVE-2012-0028}},
    author={{COMMON VULNERABILITIES AND EXPOSURES}},
    howpublished={},
    year={2012},
    month={},
}

# number: 28
# type: privilege escalation, buffer overflow
@misc{CVE:20112517,
    title={{CVE-2011-2517}},
    author={{COMMON VULNERABILITIES AND EXPOSURES}},
    howpublished={},
    year={2011},
    month={},
}

# number: 29
# type: privilege escalation
@misc{CVE:20122123,
    title={{CVE-2012-2123}},
    author={{COMMON VULNERABILITIES AND EXPOSURES}},
    howpublished={},
    year={2012},
    month={},
}

# number: 30
# type: NULL pointer dereference
@misc{CVE:20121146,
    title={{CVE-2012-1146}},
    author={{COMMON VULNERABILITIES AND EXPOSURES}},
    howpublished={},
    year={2012},
    month={},
}

# number: 31
# type: divide-by-zero error and panic
@misc{CVE:20120207,
    title={{CVE-2012-0207}},
    author={{COMMON VULNERABILITIES AND EXPOSURES}},
    howpublished={},
    year={2012},
    month={},
}

# number: 32
# type: NULL pointer dereference
@misc{CVE:20112525,
    title={{CVE-2011-2525}},
    author={{COMMON VULNERABILITIES AND EXPOSURES}},
    howpublished={},
    year={2011},
    month={},
}

# number: 33
# type: NULL pointer dereference
@misc{CVE:20111076,
    title={{CVE-2011-1076}},
    author={{COMMON VULNERABILITIES AND EXPOSURES}},
    howpublished={},
    year={2011},
    month={},
}

# number: 34
# type: NULL pointer dereference, none Initialization
@misc{CVE:20112184,
    title={{CVE-2011-2184}},
    author={{COMMON VULNERABILITIES AND EXPOSURES}},
    howpublished={},
    year={2011},
    month={},
}

# number: 35
# type: integer overflow 
@misc{CVE:20102478,
    title={{CVE-2010-2478}},
    author={{COMMON VULNERABILITIES AND EXPOSURES}},
    howpublished={},
    year={2010},
    month={},
}

# number: 36
# type: NULL pointer dereference 
@misc{CVE:20102960,
    title={{CVE-2010-2960}},
    author={{COMMON VULNERABILITIES AND EXPOSURES}},
    howpublished={},
    year={2010},
    month={},
}

# number: 37
# type: privilege escalation, buffer overflow 
@misc{CVE:20102492,
    title={{CVE-2010-2492}},
    author={{COMMON VULNERABILITIES AND EXPOSURES}},
    howpublished={},
    year={2010},
    month={},
}

# number: 38
# type: stack overflow
@misc{CVE:20102240,
    title={{CVE-2010-2240}},
    author={{COMMON VULNERABILITIES AND EXPOSURES}},
    howpublished={},
    year={2010},
    month={},
}

# number: 39
# type: use-after-free
@misc{CVE:20101188,
    title={{CVE-2010-1188}},
    author={{COMMON VULNERABILITIES AND EXPOSURES}},
    howpublished={},
    year={2010},
    month={},
}

# number: 40
# type: NULL pointer dereference
@misc{CVE:20100437,
    title={{CVE-2010-0437}},
    author={{COMMON VULNERABILITIES AND EXPOSURES}},
    howpublished={},
    year={2010},
    month={},
}

#
#  below are 17 additional bugs from previous work
#

@misc{CVE:20093234,
    title={{CVE-2009-3234}},
    author={{COMMON VULNERABILITIES AND EXPOSURES}},
    howpublished={},
    year={2009},
    month={September},
}

@misc{CVE:20131828,
    title={{CVE-2013-1828}},
    author={{COMMON VULNERABILITIES AND EXPOSURES}},
    howpublished={},
    year={2013},
    month={February},
}

@misc{CVE:20132892,
    title={{CVE-2013-2892}},
    author={{COMMON VULNERABILITIES AND EXPOSURES}},
    howpublished={},
    year={2013},
    month={August},
}

@misc{CVE:20050736,
    title={{CVE-2005-0736}},
    author={{COMMON VULNERABILITIES AND EXPOSURES}},
    howpublished={},
    year={2005},
    month={March},
}

@misc{CVE:20092698,
    title={{CVE-2009-2698}},
    author={{COMMON VULNERABILITIES AND EXPOSURES}},
    howpublished={},
    year={2009},
    month={August},
}

@misc{CVE:20093002,
    title={{CVE-2009-3002}},
    author={{COMMON VULNERABILITIES AND EXPOSURES}},
    howpublished={},
    year={2009},
    month={August},
}

@misc{CVE:20104073,
    title={{CVE-2010-4073}},
    author={{COMMON VULNERABILITIES AND EXPOSURES}},
    howpublished={},
    year={2010},
    month={October},
}

@misc{CVE:20132852,
    title={{CVE-2013-2852}},
    author={{COMMON VULNERABILITIES AND EXPOSURES}},
    howpublished={},
    year={2013},
    month={April},
}


@misc{CVE:20134343,
    title={{CVE-2013-4343}},
    author={{COMMON VULNERABILITIES AND EXPOSURES}},
    howpublished={},
    year={2013},
    month={June},
}

@misc{CVE:20103437,
    title={{CVE-2010-3437}},
    author={{COMMON VULNERABILITIES AND EXPOSURES}},
    howpublished={},
    year={2010},
    month={September},
}

@misc{CVE:20102959,
    title={{CVE-2010-2959}},
    author={{COMMON VULNERABILITIES AND EXPOSURES}},
    howpublished={},
    year={2010},
    month={August},
}

@misc{CVE:20091527,
    title={{CVE-2009-1527}},
    author={{COMMON VULNERABILITIES AND EXPOSURES}},
    howpublished={},
    year={2009},
    month={May},
}

@misc{CVE:20093547,
    title={{CVE-2009-3547}},
    author={{COMMON VULNERABILITIES AND EXPOSURES}},
    howpublished={},
    year={2009},
    month={October},
}

@misc{CVE:20103904,
    title={{CVE-2010-3904}},
    author={{COMMON VULNERABILITIES AND EXPOSURES}},
    howpublished={},
    year={2010},
    month={October},
}

@misc{CVE:20104347,
    title={{CVE-2010-4347}},
    author={{COMMON VULNERABILITIES AND EXPOSURES}},
    howpublished={},
    year={2010},
    month={November},
}

@misc{CVE:20120946,
    title={{CVE-2012-0946}},
    author={{COMMON VULNERABILITIES AND EXPOSURES}},
    howpublished={},
    year={2012},
    month={February},
}

@misc{CVE:20130268,
    title={{CVE-2013-0268}},
    author={{COMMON VULNERABILITIES AND EXPOSURES}},
    howpublished={},
    year={2013},
    month={December},
}

@misc{CVE-2014-3153,
    title={{Privilege Escalation Vulnerability in Linux Kernel}},
    author={{CVE-2014-3153}},
    howpublished={\url{http://thehackernews.com/2014/06/linux-kernel-vulnerable-to-privilege\_7.html}},
    year={2014},
    month={},
}

@misc{CVE-2008-2100,
    title={{VMware buffer overflows in the VIX API let local users execute arbitrary code in the host OS}},
    author={{CVE-2008-2100}},
    howpublished={\url{http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2100}},
    year={2008},
    month={},
}

@misc{CVE-2009-3234,
    title={{COMMON VULNERABILITIES AND EXPOSURES}},
    author={{CVE-2009-3234}},
    howpublished={\url{}},
    year={2009},
    month={},
}

@misc{CVE-2013-1828,
    title={{COMMON VULNERABILITIES AND EXPOSURES}},
    author={{CVE-2013-1828}},
    howpublished={\url{}},
    year={2013},
    month={},
}

@misc{CVE-2013-2892,
    title={{COMMON VULNERABILITIES AND EXPOSURES}},
    author={{CVE-2013-2892}},
    howpublished={\url{}},
    year={2013},
    month={},
}

@misc{CVE-2009-3002,
    title={{COMMON VULNERABILITIES AND EXPOSURES}},
    author={{CVE-2009-3002}},
    howpublished={\url{}},
    year={2009},
    month={},
}

@misc{CVE-2010-4073,
    title={{COMMON VULNERABILITIES AND EXPOSURES}},
    author={{CVE-2010-4073}},
    howpublished={\url{}},
    year={2010},
    month={},
}

@misc{CVE-2013-4343,
    title={{COMMON VULNERABILITIES AND EXPOSURES}},
    author={{CVE-2013-4343}},
    howpublished={\url{}},
    year={2013},
    month={},
}

@misc{CVE-2011-1751,
    title={{COMMON VULNERABILITIES AND EXPOSURES}},
    author={{CVE-2013-4343}},
    howpublished={\url{}},
    year={2011},
    month={},
}

@misc{Virtunoid,
    title={{Virtunoid: A KVM Guest: Host privilege escalation exploit}},
    author={{Nelson Elhage}},
    howpublished={BlackHat},
    year={2011},
    month={},
}

@misc{IntelVT,
	title = {{Intel® Virtualization Technology Specification for the Intel® Itanium® Architecture (VT-i)}},
	year={2005},
	month = {April}
}




@misc{KVM-Attack,
    title={{Virtualization Under Attack: Breaking Out of KVM}},
    author={{ELHAGE, N.}},
    howpublished={\url{http://www.blackhat.com/html/bh-us-11/bh-us-11-briefings.html}},
    year={2011},
    month={},
}

@misc{VMWare-Attack,
    title={{Cloudburst: A VMWare Guest to Host Escape Story}},
    author={{KORTCHINSKY, K.}},
    howpublished={\url{http://www.blackhat.com/presentations/bh-usa-09/KORTCHINSKY/BHUSA09-Kortchinsky-Cloudburst-SLIDES.pdf}},
    year={},
    month={},
}

@inproceedings{lewis2013does,
  title={Does bug prediction support human developers? findings from a google case study},
  author={Lewis, Chris and Lin, Zhongpeng and Sadowski, Caitlin and Zhu, Xiaoyan and Ou, Rong and Whitehead, EJ},
  booktitle={Software Engineering (ICSE), 2013 35th International Conference on},
  pages={372--381},
  year={2013},
  organization={IEEE}
}

@inproceedings{Bug-Location,
  title={Predicting the Location and Number of Faults in Large Software Systems},
  author={Thomas J. Ostrand and Elaine J. Weyuker and Robert M. Bell},
  booktitle={Transactions on Software Engineering},
  pages={},
  year={2005},
  organization={IEEE}
}

@inproceedings{Mining-Metrics,
  title={Mining Metrics to Predict Component Failures},
  author={Nachiappan Nagappan and Thomas Ball and Andreas Zeller},
  booktitle={Proceedings of the 28th international conference on Software engineering},
  pages={},
  year={2006},
  organization={}
}

@inproceedings{LTP-Coverage,
  title={Improving the Linux Test Project with Kernel Code Coverage Analysis},
  author={Paul Larson},
  booktitle={Proceedings of the 2003 Ottawa Linux Symposium},
  pages={},
  year={2003},
  organization={}
}

@misc{RepyKernel,
	title={{Seattle's Repy V2 Library}},
	howpublished = {https://seattle.poly.edu/wiki/RepyV2API},
	key={Repy},
	note={Accessed September 2014}
}


@misc{seattle,
	title={{Seattle testbed}},
	howpublished = {https://seattle.poly.edu/},
	key={seattle},
	note={Accessed September 2014}
}


@misc{CVE-Datasource,
	title={{CVE Details Datasource}},
	howpublished = {http://www.cvedetails.com/vulnerability-list/vendor\_id-33/product\_id-47/version\_id-163187/Linux-Linux-Kernel-3.14.1.html},
	key={CVE-Data},
	note={Accessed October 2014}
}

@misc{Exploit-Database,
	title={{Exploit Database}},
	howpublished = {https://www.exploit-db.com},
	key={Exploit-Database},
	note={Accessed October 2014}	
}

@misc{Java,
	title={Java},
	howpublished = {https://www.java.com},
	key={Java}
}

@misc{Lua,
	title={{The programming language Lua}},
	howpublished = {www.lua.org},
	key={Lua},
	note={Accessed October 2015}
}

@misc{Silverlight,
	title={{Microsoft Silverlight}},
	howpublished = {http://www.microsoft.com/silverlight/},
	key={Silverlight},
	note={Accessed October 2015}
}

@misc{JavaScript,
	title={JavaScript},
	howpublished = {http://www.w3schools.com/js/},
	key={JavaScript}
}

@misc{CSharp,
	title={Microsoft C\#},
	howpublished = {https://msdn.microsoft.com/en-us/library/67ef8sbd.aspx},
	key={CSharp}
}

@inproceedings{Java-Lessons,
  title={Comparing Java and .NET security: Lessons learned and missed},
  author={N. Paul and D. Evans.},
  booktitle={Computers and Security},
  pages={338-350},
  year={2006},
  organization={}
}
	
@misc{JavaBugs,
	title={Learn about Java technology},
	howpublished = {http://www.java.com/en/about/},
	key={JavaBugs},
	note={}
}


@misc{style,
	title={Code  Style Guidelines for the Seattle project},
	howpublished = {https://seattle.poly.edu/wiki/CodingStyle},
	key={style},
	note={}
}

@misc{VMWare-ESX-Server,
	title={VMWare ESX Server},
	howpublished = {https://www.vmware.com/products/esxi-and-esx/overview},
	key={VMWare-ESX-Server},
	note={Accessed September 2015}
}

@misc{LXC,
	title={{Linux Container (LXC)}},
	howpublished = {https://linuxcontainers.org},
	key={LXC},
	note={Accessed September 2015}
}

@misc{Jails,
	title={{FreeBSD Jails}},
	howpublished = {https://wiki.freebsd.org/Jails},
	key={Jails},
	note={Accessed September 2015}
}

@misc{Zones,
	title={Oracle Solaris Zones},
	howpublished = {https://docs.oracle.com/cd/E18440\_01
	/doc.111/e18415/chapter\_zones.htm\#OPCUG426},
	key={Zones},
	note={}
}

@misc{Microsoft-Hyper-V,
	title={{Microsoft Hyper-V}},
	howpublished = {https://technet.microsoft.com/en-us/windowsserver/dd448604.aspx},
	key={Microsoft-Hyper-V},
	note={Accessed September 2015}
}

@misc{VMWare-Workstation,
	title={VMWare Workstation},
	howpublished = {https://www.vmware.com/products/workstation},
	key={VMWare-Workstation},
	note={Accessed September 2015}
}

@misc{VMWare-Server,
	title={VMWare Server},
	howpublished = {https://my.vmware.com/web/vmware/info?
	slug=infrastructure\_operations\_management/vmware\_server/2\_0},
	key={VMWare-Server},
	note={}
}

@misc{Microsoft-Virtual-PC,
	title={Microsoft Virtual PC},
	howpublished = {http://www.microsoft.com/en-us/download/details.aspx?id=3702},
	key={Microsoft-Virtual-PC},
	note={Accessed September 2015}
}

@misc{VirtualBox,
	title={VirtualBox},
	howpublished = {https://www.virtualbox.org},
	key={VirtualBox},
	note={Accessed September 2015}
}

@inproceedings{Virt-Issues,
	 author = {Bratus, Sergey and Locasto, Michael E. and Ramaswamy, Ashwin and Smith, Sean W.},
	 title = {VM-based Security Overkill: A Lament for Applied Systems Security Research},
	 booktitle = {Proceedings of the 2010 Workshop on New Security Paradigms},
	 series = {NSPW '10},
	 year = {2010},
	 isbn = {978-1-4503-0415-3},
	 location = {Concord, Massachusetts, USA},
	 pages = {51--60},
	 numpages = {10},
	 url = {http://doi.acm.org/10.1145/1900546.1900554},
	 doi = {10.1145/1900546.1900554},
	 acmid = {1900554},
	 publisher = {ACM},
	 address = {New York, NY, USA},
	 keywords = {isolation, virtualization, vm},
} 



@article{JVM,
 author = {Fong, Philip W. L.},
 title = {Reasoning About Safety Properties in a JVM-like Environment},
 journal = {Sci. Comput. Program.},
 issue_date = {July, 2007},
 volume = {67},
 number = {2-3},
 month = jul,
 year = {2007},
 issn = {0167-6423},
 pages = {278--300},
 numpages = {23},
 url = {http://dx.doi.org/10.1016/j.scico.2007.04.001},
 doi = {10.1016/j.scico.2007.04.001},
 acmid = {1274473},
 publisher = {Elsevier North-Holland, Inc.},
 address = {Amsterdam, The Netherlands, The Netherlands},
 keywords = {Access control, Confinement, Formal verification, Java Virtual Machine, Safety, Stack invariant, Type-based protection mechanism},
} 

@misc{Qubes,
	title={{Qubes OS}},
	howpublished= { http://www.qubes-os.org},
	note={Accessed November 2015}
}

@INPROCEEDINGS{SecureVM,
	author={Chunxiao Li and Raghunathan, A. and Jha, N.K.},
	booktitle={Cloud Computing (CLOUD), 2010 IEEE 3rd International Conference on},
	title={Secure Virtual Machine Execution under an Untrusted Management OS},
	year={2010},
	pages={172-179},
	keywords={data privacy;operating systems (computers);virtual machines;Xen virtualization system;operating systems;resource utilization;software portability;software reliability;trusted computing base;untrusted management OS;virtual machine execution;virtual machine monitor;virtualization;Computer architecture;Cryptography;Hardware;Kernel;Registers;Virtual machine monitors;cloud computing;computing as a service;memory protection;trusted computing base;virtual machine},
	doi={10.1109/CLOUD.2010.29},
	month={July},
}


@inproceedings{Tal,
 author = {Garfinkel, Tal and Rosenblum, Mendel},
 title = {When Virtual is Harder Than Real: Security Challenges in Virtual Machine Based Computing Environments},
 booktitle = {Proceedings of the 10th Conference on Hot Topics in Operating Systems - Volume 10},
 series = {HOTOS'05},
 year = {2005},
 location = {Santa Fe, NM},
 pages = {20--20},
 numpages = {1},
 url = {http://dl.acm.org/citation.cfm?id=1251123.1251143},
 acmid = {1251143},
 publisher = {USENIX Association},
 address = {Berkeley, CA, USA},
} 


@inproceedings{Terra,
 author = {Garfinkel, Tal and Pfaff, Ben and Chow, Jim and Rosenblum, Mendel and Boneh, Dan},
 title = {Terra: A Virtual Machine-based Platform for Trusted Computing},
 booktitle = {Proceedings of the Nineteenth ACM Symposium on Operating Systems Principles},
 series = {SOSP '03},
 year = {2003},
 isbn = {1-58113-757-5},
 location = {Bolton Landing, NY, USA},
 pages = {193--206},
 numpages = {14},
 url = {http://doi.acm.org/10.1145/945445.945464},
 doi = {10.1145/945445.945464},
 acmid = {945464},
 publisher = {ACM},
 address = {New York, NY, USA},
 keywords = {VMM, attestation, authentication, trusted computing, virtual machine, virtual machine monitor},
} 

@inproceedings{HypSec,
 author = {Yang, Jisoo and Shin, Kang G.},
 title = {Using Hypervisor to Provide Data Secrecy for User Applications on a Per-page Basis},
 booktitle = {Proceedings of the Fourth ACM SIGPLAN/SIGOPS International Conference on Virtual Execution Environments},
 series = {VEE '08},
 year = {2008},
 isbn = {978-1-59593-796-4},
 location = {Seattle, WA, USA},
 pages = {71--80},
 numpages = {10},
 url = {http://doi.acm.org/10.1145/1346256.1346267},
 doi = {10.1145/1346256.1346267},
 acmid = {1346267},
 publisher = {ACM},
 address = {New York, NY, USA},
 keywords = {application protection, data privacy, hypervisor, virtualization},
} 

@article{Overshadow,
 author = {Chen, Xiaoxin and Garfinkel, Tal and Lewis, E. Christopher and Subrahmanyam, Pratap and Waldspurger, Carl A. and Boneh, Dan and Dwoskin, Jeffrey and Ports, Dan R.K.},
 title = {Overshadow: A Virtualization-based Approach to Retrofitting Protection in Commodity Operating Systems},
 journal = {SIGPLAN Not.},
 issue_date = {March 2008},
 volume = {43},
 number = {3},
 month = mar,
 year = {2008},
 issn = {0362-1340},
 pages = {2--13},
 numpages = {12},
 url = {http://doi.acm.org/10.1145/1353536.1346284},
 doi = {10.1145/1353536.1346284},
 acmid = {1346284},
 publisher = {ACM},
 address = {New York, NY, USA},
 keywords = {VMM, cloaking, hypervisors, memory protection, multi-shadowing, operating systems, virtual machine monitors},
} 

@article{JS-Sandboxing,
    author = "Joe~Gibbs Politz and Arjun Guha and Shriram Krishnamurthi",
    title = "Typed-based verification of {Web} sandboxes",
    journal = "Journal of Computer Security",
    volume = 22,
    number = 4,
    year = 2014,
    pages = "511--565"
  }
  
@inproceedings{JS-Sandboxing1,
	 author = {Phung, Phu H. and Sands, David and Chudnov, Andrey},
	 title = {Lightweight Self-protecting JavaScript},
	 booktitle = {Proceedings of the 4th International Symposium on Information, Computer, and Communications Security},
	 series = {ASIACCS '09},
	 year = {2009},
	 isbn = {978-1-60558-394-5},
	 location = {Sydney, Australia},
	 pages = {47--60},
	 numpages = {14},
	 url = {http://doi.acm.org/10.1145/1533057.1533067},
	 doi = {10.1145/1533057.1533067},
	 acmid = {1533067},
	 publisher = {ACM},
	 address = {New York, NY, USA},
	 keywords = {JavaScript, inlined reference monitors, language based security, programming},
} 

@inproceedings{Castro-BGI,
	 author = {Castro, Miguel and Costa, Manuel and Martin, Jean-Philippe and Peinado, Marcus and Akritidis, Periklis and Donnelly, Austin and Barham, Paul and Black, Richard},
	 title = {Fast Byte-granularity Software Fault Isolation},
	 booktitle = {Proceedings of the ACM SIGOPS 22Nd Symposium on Operating Systems Principles},
	 series = {SOSP '09},
	 year = {2009},
	 isbn = {978-1-60558-752-3},
	 location = {Big Sky, Montana, USA},
	 pages = {45--58},
	 numpages = {14},
	 url = {http://doi.acm.org/10.1145/1629575.1629581},
	 doi = {10.1145/1629575.1629581},
	 acmid = {1629581},
	 publisher = {ACM},
	 address = {New York, NY, USA},
	 keywords = {device drivers, isolation},
} 

@inproceedings{PSFI,
	 author = {Kroll, Joshua A. and Stewart, Gordon and Appel, Andrew W.},
	 title = {Portable Software Fault Isolation},
	 booktitle = {Proceedings of the 2014 IEEE 27th Computer Security Foundations Symposium},
	 series = {CSF '14},
	 year = {2014},
	 isbn = {978-1-4799-4290-9},
	 pages = {18--32},
	 numpages = {15},
	 url = {http://dx.doi.org/10.1109/CSF.2014.10},
	 doi = {10.1109/CSF.2014.10},
	 acmid = {2708686},
	 publisher = {IEEE Computer Society},
	 address = {Washington, DC, USA},
	 keywords = {Software Fault Isolation, Memory Safety, Verified Compilers, Architecture Portability},
} 

@inproceedings{McCamant:2006:ESC:1267336.1267351,
	 author = {McCamant, Stephen and Morrisett, Greg},
	 title = {Evaluating SFI for a CISC Architecture},
	 booktitle = {Proceedings of the 15th Conference on USENIX Security Symposium - Volume 15},
	 series = {USENIX-SS'06},
	 year = {2006},
	 location = {Vancouver, B.C., Canada},
	 articleno = {15},
	 url = {http://dl.acm.org/citation.cfm?id=1267336.1267351},
	 acmid = {1267351},
	 publisher = {USENIX Association},
	 address = {Berkeley, CA, USA},
} 



@inproceedings{Bascule, 
    author={Andrew Baumann and Dongyoon Lee and Pedro Fonseca and Lisa Glendenning 
    and Jacob R. Lorch and Barry Bond and Reuben Olinsky and Galen C. Hunt}, 
    title={Composing OS Extensions Safely and Efficiently with Bascule}, 
    booktitle={Proceedings of the Eurosys'13}, 
    year={2013}, 
}

@inproceedings{Haven, 
    author={Andrew Baumann and Marcus Peinado and Galen Hunt}, 
    title={Shielding Applications from an Untrusted Cloud with Haven}, 
    booktitle={Proceedings of the OSDI'14}, 
    year={2014}, 
}

@misc{Problems-SCI,
    title={{Traps and Pitfalls: Practical Problems in System Call Interposition Based Security Tools}},
    author={{Tal Garfinkel}},
}

@ARTICLE{MISFit,
	author={Small, C. and Seltzer, M.I.},
	journal={Concurrency, IEEE},
	title={MiSFIT: constructing safe extensible systems},
	year={1998},
	volume={6},
	number={3},
	pages={34-41},
	keywords={program testing;software fault tolerance;software performance evaluation;Minimal i386 Software Fault Isolation Tool;Web browsers;client code;database server;dynamically linked extensions;end user extensions;end-to-end solution;operating system extensions;safe extensible systems development;unprotected code;unsafe languages;Application software;Assembly systems;Databases;Filters;Protection;Robustness;Runtime;Software safety;Software tools;Writing},
	doi={10.1109/4434.708254},
	ISSN={1092-3063},
	month={Jul},
	}


@book{PittSFIeld,
  title={An empirical study of operating systems errors},
  author={Chou, Andy and Yang, Junfeng and Chelf, Benjamin and Hallem, Seth and Engler, Dawson},
  volume={35},
  number={5},
  year={2001},
  publisher={ACM}
}

@inproceedings{XFI,
	 author = {Erlingsson, \'{U}lfar and Abadi, Mart\'{\i}n and Vrable, Michael and Budiu, Mihai and Necula, George C.},
	 title = {XFI: Software Guards for System Address Spaces},
	 booktitle = {Proceedings of the 7th Symposium on Operating Systems Design and Implementation},
	 series = {OSDI '06},
	 year = {2006},
	 isbn = {1-931971-47-1},
	 location = {Seattle, Washington},
	 pages = {75--88},
	 numpages = {14},
	 url = {http://dl.acm.org/citation.cfm?id=1298455.1298463},
	 acmid = {1298463},
	 publisher = {USENIX Association},
	 address = {Berkeley, CA, USA},
} 

@INPROCEEDINGS{LXFI,
		author = {Ong Mao and Haogang Chen and Dong Zhou and Xi Wang and Nickolai Zeldovich and M. Frans Kaashoek},
		title = {Software fault isolation with api integrity and multi-principal modules},
		booktitle = {In SOSP},
    year = {2011}
}

@INPROCEEDINGS{Libra,
    author = {Glenn Ammons and Dilma Da Silva and Orran Krieger and David Grove and Byran Rosenburg and Robert W. Wisniewski and Maria Butrico and Kiyokuni Kawachiya and Eric Van Hensbergen},
    title = {Libra: A library operating system for a jvm in a virtualized execution environment},
    booktitle = {In VEE (Virtual Execution Environments},
    year = {2007},
    pages = {13--15}
}

@inproceedings {Jitk,
	author = {Xi Wang and David Lazar and Nickolai Zeldovich and Adam Chlipala and Zachary Tatlock},
	title = {Jitk: A Trustworthy In-Kernel Interpreter Infrastructure},
	booktitle = {11th USENIX Symposium on Operating Systems Design and Implementation (OSDI 14)},
	year = {2014},
	month = Oct,
	isbn = { 978-1-931971-16-4},
	address = {Broomfield, CO},
	pages = {33--47},
	publisher = {USENIX Association},
}


@inproceedings{palix2011faults,
  title={Faults in linux: ten years later},
  author={Palix, Nicolas and Thomas, Ga{\"e}l and Saha, Suman and Calv{\`e}s, Christophe and Lawall, Julia and Muller, Gilles},
  booktitle={ACM SIGARCH Computer Architecture News},
  volume={39},
  number={1},
  pages={305--318},
  year={2011},
  organization={ACM}
}


@book{engler2001bugs,
  title={Bugs as deviant behavior: A general approach to inferring errors in systems code},
  author={Engler, Dawson and Chen, David Yu and Hallem, Seth and Chou, Andy and Chelf, Benjamin},
  volume={35},
  number={5},
  year={2001},
  publisher={ACM}
}


@inproceedings{brumley2006towards,
  title={Towards automatic generation of vulnerability-based signatures},
  author={Brumley, David and Newsome, James and Song, Dawn and Wang, Hao and Jha, Somesh},
  booktitle={Security and Privacy, 2006 IEEE Symposium on},
  pages={15--pp},
  year={2006},
  organization={IEEE}
}


@article{chou2003static,
  title={Static analysis for bug finding in systems software},
  author={Chou, Andy Chow},
  year={2003},
  publisher={Stanford University}
}


@inproceedings{jones2002visualization,
  title={Visualization of test information to assist fault localization},
  author={Jones, James A and Harrold, Mary Jean and Stasko, John},
  booktitle={Proceedings of the 24th international conference on Software engineering},
  pages={467--477},
  year={2002},
  organization={ACM}
}


@inproceedings{jones2005empirical,
  title={Empirical evaluation of the tarantula automatic fault-localization technique},
  author={Jones, James A and Harrold, Mary Jean},
  booktitle={Proceedings of the 20th IEEE/ACM international Conference on Automated software engineering},
  pages={273--282},
  year={2005},
  organization={ACM}
}


@article{agrawal1995fault,
  title={Fault localization using execution slices and dataflow tests},
  author={Agrawal, Hiraral and Horgan, Joseph and London, Saul and Wong, W},
  journal={Proceedings of IEEE Software Reliability Engineering},
  pages={143--151},
  year={1995},
  publisher={Citeseer}
}


@inproceedings{liblit2005scalable,
  title={Scalable statistical bug isolation},
  author={Liblit, Ben and Naik, Mayur and Zheng, Alice X and Aiken, Alex and Jordan, Michael I},
  booktitle={ACM SIGPLAN Notices},
  volume={40},
  number={6},
  pages={15--26},
  year={2005},
  organization={ACM}
}


@article{mayer1989probability,
  title={A probability model for analysing complexity metrics data},
  author={Mayer, Alan and Sykes, Alan},
  journal={Software Engineering Journal},
  volume={4},
  number={5},
  pages={254--258},
  year={1989},
  publisher={IET}
}


@article{shiue1982experiment,
  title={Experiment size and power comparisons for two-sample Poisson tests},
  author={Shiue, Wei-Kei and Bain, Lee J},
  journal={Applied Statistics},
  pages={130--134},
  year={1982},
  publisher={JSTOR}
}


@inproceedings{ozment2006milk,
  title={Milk or wine: does software security improve with age?},
  author={Ozment, Andy and Schechter, Stuart E},
  booktitle={Usenix Security},
  year={2006}
}


@inproceedings{li2006have,
  title={Have things changed now?: an empirical study of bug characteristics in modern open source software},
  author={Li, Zhenmin and Tan, Lin and Wang, Xuanhui and Lu, Shan and Zhou, Yuanyuan and Zhai, Chengxiang},
  booktitle={Proceedings of the 1st workshop on Architectural and system support for improving software dependability},
  pages={25--33},
  year={2006},
  organization={ACM}
}


@inproceedings{schroter2006predicting,
  title={Predicting component failures at design time},
  author={Schr{\"o}ter, Adrian and Zimmermann, Thomas and Zeller, Andreas},
  booktitle={Proceedings of the 2006 ACM/IEEE international symposium on Empirical software engineering},
  pages={18--27},
  year={2006},
  organization={ACM}
}


@inproceedings{neuhaus2007predicting,
  title={Predicting vulnerable software components},
  author={Neuhaus, Stephan and Zimmermann, Thomas and Holler, Christian and Zeller, Andreas},
  booktitle={Proceedings of the 14th ACM conference on Computer and communications security},
  pages={529--540},
  year={2007},
  organization={ACM}
}