Abstract: A security protection module for virtualization based on memory introspection is proposed. By analyzing the physical memory of host machine, this model can detect running virtual machines in real time and reconstruct their high-level semantic information without any priori knowledge. Then, malicious activity in virtual machines can be identified timely and intelligent response will be made. Experimental results show that the system is transparent, attack-resistant, universal and efficient.

Key words: virtualization security, virtual machine introspection, memory introspection, memory analysis