Paper Citation Record · LEDGER

User-space library rootkits revisited: Are user-space detection mechanisms futile?

As of 8 August 2026, this Paper Citation Record lists 42 of 42 outbound references and 0 inbound Pith citation observations for arXiv:2506.07827.

A citation records a reference. It does not transfer a finding from one paper to another.

pith.paper-citation-record.v1
2506.07827 v1

Coverage vector

measured 42 of 42 reference resolution

Typed states for the displayed outbound observations.

Source: paper_references, paper_reference_links, observed 2026-08-07T05:29:36.946605Z

measured 42 of 42 standing notices

One-hop event checks from named stored sources.

Source: scholarly_work_events, retraction_status_cache, observed 2026-08-07T06:34:17.273281+00:00

measured 0 of 0 inbound itemization

Pith citing papers itemized under the disclosed page cap.

Source: paper_references, paper_reference_links

measured 0 of 1 external citation measurements

A source-named dated measurement, never combined with another source.

Source: cited_works

Reference resolution

42 of 42 outbound references displayed

verified exact1
verified fuzzy33
unresolved1
parse uncertain0
malformed identifier0
metadata mismatch7

External citation measurements

No source-named external measurement is stored.

Outbound references

Observation 90dd663d-1db9-429b-803e-82619736c6f2 · outbound

This paper cites Hoglund and J.

User-space library rootkits revisited: Are user-space detection mechanisms futile? Hoglund and J

Reference 1

Resolution: verified fuzzy; raw_fallback, observed 2026-08-07T05:29:44.207296Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.

Observation f85794ef-06b7-4c35-bfb8-3ae860d09ea0 · outbound

This paper cites an unresolved cited work.

User-space library rootkits revisited: Are user-space detection mechanisms futile? Unresolved cited work

Reference 2

Resolution: unresolved; raw_fallback, observed 2026-08-07T05:29:44.067442Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.

Observation 7aa28e0c-15f9-4ee0-9da4-51d138bad691 · outbound

This paper cites Subverting vista kernel for fun and profit.

User-space library rootkits revisited: Are user-space detection mechanisms futile? Subverting vista kernel for fun and profit

Reference 3

Resolution: verified fuzzy; raw_fallback, observed 2026-08-07T05:29:43.957622Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.

Observation c3db2c56-47a2-4eb6-a7f3-3e0f277242c0 · outbound

This paper cites Subvirt: implementing malware with vir- tual machines,.

User-space library rootkits revisited: Are user-space detection mechanisms futile? Subvirt: implementing malware with vir- tual machines,

Reference 4

Resolution: verified fuzzy; raw_fallback, observed 2026-08-07T05:29:43.797643Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.

Observation ce82c954-62f5-4800-aab4-eac8c46a777a · outbound

This paper cites Covirt (a virtual-machine based rootkit).

User-space library rootkits revisited: Are user-space detection mechanisms futile? Covirt (a virtual-machine based rootkit)

Reference 5

Resolution: verified fuzzy; raw_fallback, observed 2026-08-07T05:29:43.655929Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.

Observation 97f9c4ef-ad5a-44eb-baac-361e795d75c2 · outbound

This paper cites Linux on-the-fly kernel patching without lkm,.

User-space library rootkits revisited: Are user-space detection mechanisms futile? Linux on-the-fly kernel patching without lkm,

Reference 6

Resolution: verified fuzzy; raw_fallback, observed 2026-08-07T05:29:43.499916Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.

Observation a930a85e-1db3-4e72-a17b-9adbf79bf02c · outbound

This paper cites Triplecross.

User-space library rootkits revisited: Are user-space detection mechanisms futile? Triplecross

Reference 7

Resolution: verified fuzzy; raw_fallback, observed 2026-08-07T05:29:43.342167Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.

Observation 41b46cce-fcb0-401d-bb82-d6240a38370d · outbound

This paper cites The hidden threat: Analysis of linux rootkit techniques and limitations of current detection tools,.

User-space library rootkits revisited: Are user-space detection mechanisms futile? The hidden threat: Analysis of linux rootkit techniques and limitations of current detection tools,

Reference 8

Resolution: verified exact; doi, observed 2026-08-07T05:29:36.987982Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.

Observation faf641f8-a9fb-4203-b856-0538ef507c9e · outbound

This paper cites Unhide git repository.

User-space library rootkits revisited: Are user-space detection mechanisms futile? Unhide git repository

Reference 9

Resolution: verified fuzzy; raw_fallback, observed 2026-08-07T05:29:43.205639Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.

Observation 287fa780-7d3f-4e55-8a38-18d3f008499f · outbound

This paper cites Unhide: the open source forensic tool.

User-space library rootkits revisited: Are user-space detection mechanisms futile? Unhide: the open source forensic tool

Reference 10

Resolution: verified fuzzy; raw_fallback, observed 2026-08-07T05:29:43.021299Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.

Observation bfab6b6d-482c-472e-a906-76744919759a · outbound

This paper cites Unhide-ng (next generation) git repository.

User-space library rootkits revisited: Are user-space detection mechanisms futile? Unhide-ng (next generation) git repository

Reference 11

Resolution: verified fuzzy; raw_fallback, observed 2026-08-07T05:29:42.816819Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.

Observation c54f283e-d838-4338-a817-64b0b6ceae68 · outbound

This paper cites Kong,Designing BSD Rootkits.

User-space library rootkits revisited: Are user-space detection mechanisms futile? Kong,Designing BSD Rootkits

Reference 12

Resolution: verified fuzzy; raw_fallback, observed 2026-08-07T05:29:42.534764Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.

Observation 34aa1783-d7d6-4ced-b276-841796076c86 · outbound

This paper cites Blunden,The Rootkit Arsenal: Escape and Evasion in the Dark Cor- ners of the System.

User-space library rootkits revisited: Are user-space detection mechanisms futile? Blunden,The Rootkit Arsenal: Escape and Evasion in the Dark Cor- ners of the System

Reference 13

Resolution: verified fuzzy; raw_fallback, observed 2026-08-07T05:29:42.345154Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.

Observation c55a4c1d-29b8-436d-b0c7-be84b9201b81 · outbound

This paper cites Efficient and trusted detection of rootkit in iot devices via offline profiling and online monitoring,.

User-space library rootkits revisited: Are user-space detection mechanisms futile? Efficient and trusted detection of rootkit in iot devices via offline profiling and online monitoring,

Reference 14

Resolution: metadata mismatch; raw_fallback, observed 2026-08-07T05:29:38.160585Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.

Observation bf1c7202-475f-4627-80f3-2293b8688c3d · outbound

This paper cites Multi-aspect profiling of kernel rootkit behavior,.

User-space library rootkits revisited: Are user-space detection mechanisms futile? Multi-aspect profiling of kernel rootkit behavior,

Reference 15

Resolution: metadata mismatch; raw_fallback, observed 2026-08-07T05:29:37.947157Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.

Observation f8282bbc-9414-4fae-9e4c-b4b57482ce60 · outbound

This paper cites An online cross view difference and behavior based kernel rootkit detector,.

User-space library rootkits revisited: Are user-space detection mechanisms futile? An online cross view difference and behavior based kernel rootkit detector,

Reference 16

Resolution: metadata mismatch; raw_fallback, observed 2026-08-07T05:29:37.668202Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.

Observation 9a0a9682-5073-45be-bf7c-637553de1e96 · outbound

This paper cites On the detection of kernel-level rootkits using hardware performance counters,.

User-space library rootkits revisited: Are user-space detection mechanisms futile? On the detection of kernel-level rootkits using hardware performance counters,

Reference 17

Resolution: metadata mismatch; raw_fallback, observed 2026-08-07T05:29:37.468658Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.

Observation 211fed27-19f6-48d2-9829-a1b11ed5135e · outbound

This paper cites Position paper: Consider hardware-enhanced defenses for rootkit attacks,.

User-space library rootkits revisited: Are user-space detection mechanisms futile? Position paper: Consider hardware-enhanced defenses for rootkit attacks,

Reference 18

Resolution: metadata mismatch; raw_fallback, observed 2026-08-07T05:29:37.306664Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.

Observation cce7b835-b996-4a2d-a997-9b532fd6dba5 · outbound

This paper cites Advance kernel rootkit de- tection: Survey,.

User-space library rootkits revisited: Are user-space detection mechanisms futile? Advance kernel rootkit de- tection: Survey,

Reference 19

Resolution: verified fuzzy; raw_fallback, observed 2026-08-07T05:29:42.192259Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.

Observation 2f52696a-5de2-4cd9-9b40-665618e68f71 · outbound

This paper cites Rootkit modeling and ex- periments under linux,.

User-space library rootkits revisited: Are user-space detection mechanisms futile? Rootkit modeling and ex- periments under linux,

Reference 20

Resolution: verified fuzzy; raw_fallback, observed 2026-08-07T05:29:42.031531Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.

Observation e925dbd6-116a-4caa-b627-5c8d176b13b9 · outbound

This paper cites Rootkit detection mechanism: A survey,.

User-space library rootkits revisited: Are user-space detection mechanisms futile? Rootkit detection mechanism: A survey,

Reference 21

Resolution: verified fuzzy; raw_fallback, observed 2026-08-07T05:29:41.858578Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.

Observation c74d0fda-3145-4024-b104-4fb0886df5ef · outbound

This paper cites A framework for prototyping and testing data-only rootkit attacks,.

User-space library rootkits revisited: Are user-space detection mechanisms futile? A framework for prototyping and testing data-only rootkit attacks,

Reference 22

Resolution: verified fuzzy; raw_fallback, observed 2026-08-07T05:29:41.715505Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.

Observation 0e21a625-40f5-4bf7-958c-7f9a66cadbf1 · outbound

This paper cites The design of the simple smm rootkit,.

User-space library rootkits revisited: Are user-space detection mechanisms futile? The design of the simple smm rootkit,

Reference 23

Resolution: metadata mismatch; raw_fallback, observed 2026-08-07T05:29:37.216043Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.

Observation 82ef1018-f4cc-477a-a785-bd2a8f56e42b · outbound

This paper cites The research on rootkit for information system classified protection,.

User-space library rootkits revisited: Are user-space detection mechanisms futile? The research on rootkit for information system classified protection,

Reference 24

Resolution: verified fuzzy; raw_fallback, observed 2026-08-07T05:29:41.546260Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.

Observation f11f6cf6-f95d-47a2-9ffd-3c4eea0d6590 · outbound

This paper cites Kernel rootkit experiences,.

User-space library rootkits revisited: Are user-space detection mechanisms futile? Kernel rootkit experiences,

Reference 25

Resolution: verified fuzzy; raw_fallback, observed 2026-08-07T05:29:41.355475Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.

Observation 0ff3dd1c-ad4b-42e8-803d-04b76228578a · outbound

This paper cites Execution path analysis: finding kernel based rootkits,.

User-space library rootkits revisited: Are user-space detection mechanisms futile? Execution path analysis: finding kernel based rootkits,

Reference 26

Resolution: verified fuzzy; raw_fallback, observed 2026-08-07T05:29:41.171563Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.

Observation 2e57b1b8-1b17-4206-920f-fdea913376c4 · outbound

This paper cites Finding hidden kernel modules (extrem way reborn): 20 years later,.

User-space library rootkits revisited: Are user-space detection mechanisms futile? Finding hidden kernel modules (extrem way reborn): 20 years later,

Reference 27

Resolution: verified fuzzy; raw_fallback, observed 2026-08-07T05:29:41.006144Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.

Observation e51a3e76-1e5e-4d22-ac5d-651c83f291a9 · outbound

This paper cites Shared library redirection techniques,.

User-space library rootkits revisited: Are user-space detection mechanisms futile? Shared library redirection techniques,

Reference 28

Resolution: verified fuzzy; raw_fallback, observed 2026-08-07T05:29:40.805380Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.

Observation 9e28e81d-8348-43dc-ac60-7faa903cbcc3 · outbound

This paper cites He compels secure shells,.

User-space library rootkits revisited: Are user-space detection mechanisms futile? He compels secure shells,

Reference 29

Resolution: verified fuzzy; raw_fallback, observed 2026-08-07T05:29:40.597146Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.

Observation 4e9e2d4a-be53-4bd2-9977-27b2158b35ec · outbound

This paper cites The art of linux kernel rootkits,.

User-space library rootkits revisited: Are user-space detection mechanisms futile? The art of linux kernel rootkits,

Reference 30

Resolution: verified fuzzy; raw_fallback, observed 2026-08-07T05:29:40.414753Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.

Observation ec043be2-d2e1-4276-be65-929f93604d36 · outbound

This paper cites Bypassing ldpreload rootkits is easy,.

User-space library rootkits revisited: Are user-space detection mechanisms futile? Bypassing ldpreload rootkits is easy,

Reference 31

Resolution: verified fuzzy; raw_fallback, observed 2026-08-07T05:29:40.204667Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.

Observation 56f5da44-4f27-49f1-8018-04beb0bb521f · outbound

This paper cites In-depth study of linux rootkits: Evolution, detection, and defense.

User-space library rootkits revisited: Are user-space detection mechanisms futile? In-depth study of linux rootkits: Evolution, detection, and defense

Reference 32

Resolution: verified fuzzy; raw_fallback, observed 2026-08-07T05:29:40.042922Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.

Observation 667ad252-9c53-4f0b-aad7-6cc299e17d64 · outbound

This paper cites Malware memory analysis of the jynx2 linux rootkit: Investigating a publicly available linux rootkit using the volatility memory analy- sis framework,.

User-space library rootkits revisited: Are user-space detection mechanisms futile? Malware memory analysis of the jynx2 linux rootkit: Investigating a publicly available linux rootkit using the volatility memory analy- sis framework,

Reference 33

Resolution: verified fuzzy; raw_fallback, observed 2026-08-07T05:29:39.815620Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.

Observation 1ec92ba2-73ce-4ebc-9e2f-57d9f7825b04 · outbound

This paper cites Shared library call redirection via elf plt infection,.

User-space library rootkits revisited: Are user-space detection mechanisms futile? Shared library call redirection via elf plt infection,

Reference 34

Resolution: verified fuzzy; raw_fallback, observed 2026-08-07T05:29:39.615271Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.

Observation 412cd382-697e-41ea-a6c6-73ba32f47898 · outbound

This paper cites How detect a ldpreload rootkit and hide from ldd and /proc,.

User-space library rootkits revisited: Are user-space detection mechanisms futile? How detect a ldpreload rootkit and hide from ldd and /proc,

Reference 35

Resolution: verified fuzzy; raw_fallback, observed 2026-08-07T05:29:39.431162Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.

Observation f688440a-236f-4437-ba01-d33ee3a964e0 · outbound

This paper cites Snoopy command logger.

User-space library rootkits revisited: Are user-space detection mechanisms futile? Snoopy command logger

Reference 36

Resolution: verified fuzzy; raw_fallback, observed 2026-08-07T05:29:39.240413Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.

Observation e3fda074-de24-43b9-b76f-0756cc604a5d · outbound

This paper cites zpoline: a system call hook mechanism based on binary rewriting,.

User-space library rootkits revisited: Are user-space detection mechanisms futile? zpoline: a system call hook mechanism based on binary rewriting,

Reference 37

Resolution: verified fuzzy; raw_fallback, observed 2026-08-07T05:29:39.052616Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.

Observation 5a1a0fd6-8aac-4eae-a877-82e4d91d6e0b · outbound

This paper cites Kerrisk,The Linux Programming Interface: A Linux and UNIX Sys- tem Programming Handbook, 1st ed.

User-space library rootkits revisited: Are user-space detection mechanisms futile? Kerrisk,The Linux Programming Interface: A Linux and UNIX Sys- tem Programming Handbook, 1st ed

Reference 38

Resolution: verified fuzzy; raw_fallback, observed 2026-08-07T05:29:38.863176Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.

Observation 93375496-e35a-4174-9194-0eb1783a19dd · outbound

This paper cites The use of name spaces in plan 9,.

User-space library rootkits revisited: Are user-space detection mechanisms futile? The use of name spaces in plan 9,

Reference 39

Resolution: metadata mismatch; raw_fallback, observed 2026-08-07T05:29:37.119780Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.

Observation 9b125233-d334-4655-9d04-f02e022099d2 · outbound

This paper cites The ptrace anti Re trick.

User-space library rootkits revisited: Are user-space detection mechanisms futile? The ptrace anti Re trick

Reference 40

Resolution: verified fuzzy; raw_fallback, observed 2026-08-07T05:29:38.695428Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.

Observation 51c1a27e-ba88-425a-a4dd-b8e6a2f8c893 · outbound

This paper cites The linux kernel documentation: Syscall user dispatch.

User-space library rootkits revisited: Are user-space detection mechanisms futile? The linux kernel documentation: Syscall user dispatch

Reference 41

Resolution: verified fuzzy; raw_fallback, observed 2026-08-07T05:29:38.519192Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.

Observation 5da1e49e-9487-471d-9b24-8e0c2d376626 · outbound

This paper cites The linux kernel documentation: ftrace - function tracer.

User-space library rootkits revisited: Are user-space detection mechanisms futile? The linux kernel documentation: ftrace - function tracer

Reference 42

Resolution: verified fuzzy; raw_fallback, observed 2026-08-07T05:29:38.296650Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.

Pith citing papers

No inbound Pith citation observations are available.