I was wondering if malicious programs are detected using a virtual system.

For example a "canary" system would be set up in a virtual environment then unknown and untrusted programs would be executed in it, the operation of the unknown program would be highly scrutinized for signs of malicious activity.

Could the virtual environment be safely sand-boxed to prevent infection of the host system? Is this method used and is it practical in practice? what is the name of this method? what are some examples of this method being used?

1 Answer 1


The colloquial term for that is honeypot. A honeypot system must be attractive for the attacker, but otherwise constrained so that it does not help the attacker in his nefarious schemes. This is a rather delicate balance. For instance, a honeypot to trap spammers must look as if it could serve as relay for tons of spam, but preferably not allow much spam (or any) to actually be sent.

Virtual machines are a method to make several systems share the same hardware, and yet be (nominally) isolated from each other. Escaping from the VM is normally impossible, unless the VM engine has a security hole, and existing VM engines do have security holes, so hosting a honeypot in a VM is somewhat risky. It is understandable that, for a honeypot, you want something cheap (it will not contribute much to your business, after all), and a VM is usually cheaper than a physical server. But it is really safer to use a physical machine as honeypot, with good network separation (explicit firewalls, no VLAN...). On the other hand, a VM can be snapshot, which is very convenient for post mortem analysis.

The main point of a honeypot is to serve as an observation deck to learn what kind of attacks are in vogue. Companies who write botnet detection systems run honeypots to have botnets to observe under controlled conditions.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .