What is Virtual Machine Introspection?

Question

I have seen it presented as a special security technique but it seems like it basically means automated security monitoring of your virtual environment. Is that the basic idea?

Answer 1

As the article describes it, VM introspection looks like inspecting the contents of the VM in real-time, to see that everything appears to be "in order". Virtual machines allow for such inspection without consent or knowledge of the guest system. This contrasts with classic antimalware software on physical systems: the antimalware runs on the system itself, so it is reachable by successful malware; indeed, when some virus or malware succeeds in taking control of a given machine, its first task is to deactivate any antimalware software on the machine, and prevent installation of such software, so that the malware can keep on controlling the machine.

Thus, classic antimalware software must reliably block malware upon entry; if they miss one, they have lost. On the other hand, with a VM, the antimalware could run on the host, outside of the guest, thus impossible to deactivate by malware who subverted the guest system. That's the VM introspection concept. It may possibly "clean up" an infected machine.

It is like surgery. Self-surgery is, let's say, difficult. In particular, invalidating illnesses may make you unconscious, thus unable to heal yourself. An external doctor, being healthy at that time, is still able to help you.