Intrusion detection and detection evasion

[arkenoi]

in practice, you have a non-networked dvm for analysis and a separate vm for capture. the analysis vm state is refreshed frequently to avoid any malicious persistence.