DETECTING OPERATION OF A VIRTUAL MACHINE

摘要

Detecting the operation of a virtual machine by identifying seed candidates from sets of random numbers generated at a computer, where each of the sets includes multiple random numbers, identifying candidate performance counter frequencies from the seed candidates and from timing information associated with the sets of random numbers, and determining that the computer is operating as a virtual machine if any of the candidate performance counter frequencies is consistent with a predefined virtual machine performance counter frequency.

主权项

1. A method for detecting operation of a virtual machine, the method comprising:
identifying, by one or more computer processors, a plurality of seed candidates from a plurality of sets of random numbers generated at a computer, wherein each of the sets includes a plurality of random numbers; identifying, by one or more computer processors, a plurality of candidate performance counter frequencies from the plurality of seed candidates and from timing information associated with the sets of random numbers; and determining, by one or more computer processors, whether any of the candidate performance counter frequencies is consistent with a predefined virtual machine performance counter frequency.