CBD: A Counter-Based Detection Method for VMM in Hardware Virtualization Technology

VMM detection technology plays increasingly vital role in the detection of malicious codes which hide themselves inside the VMM. However, the adoption of hardware virtualization technology has led to the failure of those traditional detection methods which mainly focus their attention on logic, resources and timing discrepancies between physical hardware and virtualized hardware. Based on this, a novel counter-based detection (CBD) method is proposed in this paper. It establishes a benchmark thread in the user mode while counting the number of privileged instructions' execution times. The VMM's presence is detected by the discrepancy between the actual execution times and theoretic execution times of the privileged instruction. Evaluation test shows that this method is feasible for the detection of both Normal and Anti-time VMM and is currently free of specific anti-detection methods.