Detection of Hardware-Assisted Virtualization Based on Low-Level Feature

Hardware-assisted virtualization is widely adopted in cloud computing and desktop platforms, significantly enhancing the security and efficiency of full virtualization systems by dividing multiple guest operating systems (OSes) and providing isolation between guest OSes and host OS. Thus, malware is usually analyzed in a guest OS to prevent the host OS from being compromised. However, an advanced malware will deliberately masquerade as a benign program when it detects that it is in a virtualized environment. The ideal goal of virtualization is to be utterly transparent to the guest processes, i.e., a guest process cannot be aware that it runs in a virtualized environment. Nowadays, although hardware-assisted virtualization detection is challenging, we present three novel approaches that can be leveraged to detect hardware-assisted virtualization. Our detection approaches are mainly based on the following features: i) The available CPU instruction sets are different in native and virtualized environments; ii) Modification to specific control register flag has different effects in native and virtualized environments; iii) The physical addresses in native and virtualized environments have different effects on the eviction of the level 2 CPU cache. We have conducted intensive experiments in both native and cloud environments. The experimental results show that our approaches can effectively detect the existence of hardware-assisted virtualization.