Apparatus and method for monitoring virtual machine based on hypervisor

An apparatus for monitoring a virtual machine based on a hypervisor, comprising:

• one or more computer-executable units being configured and executed by a processor using algorithm associated with at least one non-transitory storage device, the algorithm, when executed, causing the processor to execute one or units, the units comprising,
• a monitoring unit for monitoring an attempt to access an executable file located in a virtual machine, the monitoring unit further configured for;
• generating an access event in response to detection of an exception which being occurred where a task accesses the location of a system call code and where the task accesses a page table entry indicating the location of the system call code, the page table being set to cause the exception;
• detecting a location of a system call code corresponding to the executable file in virtual memory corresponding to the virtual machine, and determining whether the attempt to access the executable file has occurred in response to detection of the access event generated based on an attempt to execute the system call code, and
• in response to detection of the attempt to access the executable file being detected, extracting a system call transfer factor which being accessed through a task;
• a path acquisition unit for acquiring, based on the system call transfer factor, an execution path corresponding to the executable file and a reference path corresponding to a reference file that is executed together with the executable file;
• and
• a malicious file collection unit for checking based on the execution path and the reference path whether any of the executable file and the reference file is malicious, and collecting a file in which malicious code is present in response to detection of the malicious code being present in any of the executable file and the reference file.