Abstract:Malware analysis relies heavily on the use of virtual machines (VMs) for functionality and safety. There are subtle differences in operation between virtual and physical machines. Contemporary malware checks for these differences and changes its behavior when it detects a VM presence. These anti-VM techniques hinder malware analysis. Existing research approaches to uncover differences between VMs and physical machines use randomized testing, and thus cannot guarantee completeness. In this article, we propose a detect-and-hide approach, which systematically addresses anti-VM techniques in malware. First, we propose cardinal pill testing —a modification of red pill testing that aims to enumerate the differences between a given VM and a physical machine through carefully designed tests. Cardinal pill testing finds five times more pills by running 15 times fewer tests than red pill testing. We examine the causes of pills and find that, while the majority of them stem from the failure of VMs to follow CPU specifications, a small number stem from under-specification of certain instructions by the Intel manual. This leads to divergent implementations in different CPU and VM architectures. Cardinal pill testing successfully enumerates the differences that stem from the first cause. Finally, we propose VM Cloak —a WinDbg plug-in which hides the presence of VMs from malware. VM Cloak monitors each execute malware command, detects potential pills, and at runtime modifies the command’s outcomes to match those that a physical machine would generate. We implemented VM Cloak and verified that it successfully hides VM presence from malware.

Anomaly detection based on IO sequences in a virtual machine with the Markov mode

Detection of Virtual Machines Based on Thread Scheduling

Detection of KVM’s Virtual Environment and Vulnerability

Automated Approach to Intrusion Detection in VM-based Dynamic Execution Environment.

Anomaly Detection Model Based on Windows Native API Sequences

Virtual Machine Anomaly Detection Based on Partitioning Detection Domain

Virtual machine file integrity monitoring based on hardware virtualization

Auto-detection System of Suspicious File Based on Virtual Machine Technology

Anomaly Detection for Virtualized Data Center Via Outlier Analysis

Transparency and Semantics Coexist: When Malware Analysis Meets the Hardware Assisted Virtualization

VMInsight: Hardware Virtualization-Based Process Security Monitoring System

A Guest-Transparent File Integrity Monitoring Method in Virtualization Environment

An anomalous behavior detection model in cloud computing

Virtual-Machine-based Intrusion Detection on File-aware Block Level Storage.

On The Detection Of Malicious Behaviors Against Introspection Using Hardware Architectural Events

An Incremental Anomaly Detection Model for Virtual Machines

Detecting and Analyzing VM-exits

Virtualization-based monitoring of untrusted extensions execution

Security Analysis of Virtual Machine Monitor

Unknown Computer Virus Detection Based on Its Behavior Sequence

Handling Anti-Virtual Machine Techniques in Malicious Software