Automated detection of persistent kernel control-flow attacks