Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have seen it presented as a special security technique but it seems like it basically means automated security monitoring of your virtual environment. Is that the basic idea?

share|improve this question
add comment

1 Answer

up vote 13 down vote accepted

As the article describes it, VM introspection looks like inspecting the contents of the VM in real-time, to see that everything appears to be "in order". Virtual machines allow for such inspection without consent or knowledge of the guest system. This contrasts with classic antimalware software on physical systems: the antimalware runs on the system itself, so it is reachable by successful malware; indeed, when some virus or malware succeeds in taking control of a given machine, its first task is to deactivate any antimalware software on the machine, and prevent installation of such software, so that the malware can keep on controlling the machine.

Thus, classic antimalware software must reliably block malware upon entry; if they miss one, they have lost. On the other hand, with a VM, the antimalware could run on the host, outside of the guest, thus impossible to deactivate by malware who subverted the guest system. That's the VM introspection concept. It may possibly "clean up" an infected machine.

It is like surgery. Self-surgery is, let's say, difficult. In particular, invalidating illnesses may make you unconscious, thus unable to heal yourself. An external doctor, being healthy at that time, is still able to help you.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.