Recent studies on virtual machine introspection mostly build guest VM state by the use of guest OS kernel data structures and kernel functions, which can be maliciously subverted. They are unable to resist direct kernel structure attacks. In view of the above situation, the capability of VMI was analyzed thoroughly, and then the possibilities of using hardware architectural knowledge and virtualization extension knowledge to construct VMI technology were explored and the possible attacks that can be detected and foiled by this mechanism were discussed. Collection and monitoring of system calls using the proposed method were described and the efficient of the monitored system was analyzed.
