Detecting operation of a virtual machine

摘要

Detecting the operation of a virtual machine by identifying seed candidates from sets of random numbers generated at a computer, where each of the sets includes multiple random numbers, identifying candidate performance counter frequencies from the seed candidates and from timing information associated with the sets of random numbers, and determining that the computer is operating as a virtual machine if any of the candidate performance counter frequencies is consistent with a predefined virtual machine performance counter frequency.

主权项

1. A method for detecting the operation of a virtual machine, the method comprising:
identifying a plurality of seed candidates from each of two or more sets of random numbers generated at a computer, wherein each of the sets includes a plurality of random numbers and each of the sets of random numbers is produced at a different time; identifying a plurality of candidate performance counter frequencies from the plurality of seed candidates and from timing information associated with the two or more sets of random numbers; and determining that the computer is operating as a virtual machine if any of the candidate performance counter frequencies is consistent with a predefined virtual machine performance counter frequency.