You are not wrong. The earliest one I'm aware of is Stephanie Forrest's work from 1997: http://www.cs.unm.edu/~forrest/publications/int_decssc.pdf http://www.c

You are not wrong. The earliest one I'm aware of is Stephanie Forrest's work from 1997: http://www.cs.unm.edu/~forrest/publications/int_decssc.pdf http://www.cs.unm.edu/~forrest/publications/int_decssc.pdf Though she also had a couple papers in a similar vein starting in 1994. However, Masters theses are often not completely novel, and it's sometimes worth repeating work from long ago to see what's changed as operating systems and malware have evolved.