Compared with the traditional intrusion detection system

the intrusion detection system based on virtual machine introspection has stronger anti-jamming ability.However

the difference between the hardware byte information and the high level semantics leads to the decrease of the versatility and real-time.Aiming to solve this problem

this paper proposes Vlhd

a OS hidden object detection technology based on semantic repair method.Vlhd separates the system into two parts:the offline module and the online module.The online module reconstructs semantic view outside the target virtual machine;the offline module is responsible for the extraction of OS semantic knowledge

and providing semantic services to the online module.Through a variety of rootkit intrusion detection test in various types of Linux OS

we find that Vlhd can detect the objects hidden by rootkits.A single scan time of Vlhd is 34ms

and the performance overhead is 1.1% (scan cycle is set to 8s).