Hiding Virtualization from Attackers and Malware

Abstract

Virtual machine environments (VMEs) let a user or administrator run one or more guest operating systems on top of a host operating system. With security researchers relying on VMEs in their analysis work, attackers and their malicious code have a significant stake in detecting the presence of a virtual machine. This article focuses on detection techniques and mitigation options for the most widely deployed VME product today, VMware.