Abstract: A virtual machine monitor(VMM) has strong control ability and its characteristic of isolation,and can solve open ctuestion in the existing file integrity monitoring systems. A new VMM-based method for file integrity protecting system was proposed,which is isolated between the system and the guest systems. This method should prcconfigure the files to be protected and can avoid the attack to these files from the malicious codes. In this scheme of file integrity protection, the system can intercept all the access attempts to the protected files in real-time by designing and implanting the "detector" and "reversed file locator" into the isolated layer of the virtual machine, and achieves the strategy of pre-protection.

Key words: Virtualization technology, Virtual machine,I/O interception,File integrity protection