Abstract:With security researchers relying on the virtual machine (VM) in their analysis work, malware has a significant stake in detecting the presence of a VM to avoid executing its vicious behavior. But hiding a VM from malware by building a transparent virtual machine monitor (VMM) is fundamentally infeasible, as well as impractical from a performance and engineering standpoint. This paper proposes a new idea from another perspective: hiding the "real" machine from the VMM-aware malware. We propose a minimal VMM called MiniVMM which can migrate a booted OS, our protecting concern, to this VMM on demand. In our protection model, all the untrusted code, although having been verified by VMM-based malware detectors, should be executed in this migrated OS. Instead of building a transparent VMM, MiniVMM advisedly exposes the VMM fingerprints to prevent the computer against VMM-aware malicious programs by deceiving them into deactivating their destructive behavior by themselves. MiniVMM has two key features: dynamic OS migration and commodity VMM fingerprints emulation. Unlike existing VMM solutions, MiniVMM can make the protected OS transfer between VMM mode and native mode dynamically. MiniVMM can also emulate the fingerprints of prevalent VMMs to make the protected computer more like a "real" VM. MiniVMM might be deployed as a considerable complement of the existing VMM-based security approaches to make the native OSes immune to the VMM-aware malware.

Detecting Hidden Process with Hardware-Assisted Virtual Machine Monitor

Implicit Detection of Hidden Processes with a Local-Booted Virtual Machine

Implicit Detection of Hidden Processes with a Feather-Weight Hardware-Assisted Virtual Machine Monitor

Vmpmonitor: an Efficient Modularity Approach for Hidden Process Detection

Detecting Hidden Process with Local Virtualization Technology

VMDetector: A VMM-based Platform to Detect Hidden Process by Multi-view Comparison

Detecting Hidden Malware Method Based on "In-VM" Model

VMInsight: Hardware Virtualization-Based Process Security Monitoring System

A Highly Reliable In-VM Hidden Process Detection Countermeasure

Hidden process detection technology in virtual machine based on process life-cycle

The Detection of Hidden Process Technology Based on Thread Scheduling

A Hidden Process Detection Model Based on System Management Mode

Hiding "real" Machine from Attackers and Malware with a Minimal Virtual Machine Monitor

Cross-views Process Detection Based on the Hardware-assisted Virtual Machine

Hidden Process Detection Method Based on Intercepting the Entry of System Kernel

Full-virtualization-based Process Monitoring Method

Secure Virtualization-Based Fine-Grained Process Execution Monitoring

Anti-key Logger Based on Hardware-assisted Virtualization

HODetector: the Hidden Objects Detection Based on Static Semantic Information Library Outside Virtual Machine

Transparency and Semantics Coexist: When Malware Analysis Meets the Hardware Assisted Virtualization

Anti-debugging Framework Based on Hardware Virtualization Technology