Compared with traditional malicious codes detection mechanisms

detecting malicious codes in virtual desktop system faces serious performance challenge

multiple virtual desktops on a physical server conduct malicious code detection in parallel will face serious bottlenecks in the hardware devices with poor performance

such as hard disks.In this paper

we propose a malicious code detection mechanism for virtual desktop system

a malicious code detection mechanism based on mother-clone technology(MCIDS).Based on the characteristics of virtual desktops

MCIDS is designed to reduce the scope of mal-code detection by system image network storage clone technique and the mal-code detection engine deployed in network storage system

and this method effectively decreases the amount of disk IO operation caused by the detection of malicious codes

so that the performance of the system is improved greatly;In addition

MCIDS overcomes the semantic gap problem which often exists in traditional out-of-the-box security detection mechanisms.Experiments conducted on the prototype show that our method is technicallyfeasibleand the performance of MCIDS is better than other methods.