Hiding virtualization from attackers and malware

Malware researchers are increasingly reliant on virtual machine environments (VME) to conduct their trade as VMEs offer useful monitoring and isolation capabilities. VMEs let a user or adminstrator run one or more guest operating systems on top of a host operating system. Attackers often use VME detection to confound security researchers. VME detecting malware might even behave in an entirely benign fashion inside a VME, to the point that a malware researcher might not realize its true destructive nature. VMEs are a complex layer of software that usually tries to isolate the host and guest operating systems. The most popular VMEs implement virtualized x86 PC systems as guest machines running on top of x86 host systems. VMware allows for communication between host and guest operating systems through a custom communications channel hard-coded into all major VMware products.