  In monolithic operating systems, the kernel is the piece of code that
executes with the highest privileges and has control over all the software
running on a host. A successful attack against an operating system's kernel
means a total and complete compromise of the running system. These attacks
usually end with the installation of a rootkit, a stealthy piece of software
running with kernel privileges. When a rootkit is present, no guarantees can be
made about the correctness, privacy or isolation of the operating system.
  In this paper we present \emph{Hello rootKitty}, an invariance-enforcing
framework which takes advantage of current virtualization technology to protect
a guest operating system against rootkits. \emph{Hello rootKitty} uses the idea
of invariance to detect maliciously modified kernel data structures and restore
them to their original legitimate values. Our prototype has negligible
performance and memory overhead while effectively protecting commodity
operating systems from modern rootkits.
