An efficient
virtual machine file integrity monitoring method and
system utilizing hierarchical hash trees is disclosed. The method is based on hardware-assisted
virtualization, capturing key
file system call events of the Guest OS at the
Hypervisor layer. It obtains file paths,
metadata, and content summaries based on adaptive segmented sampling through memory
parsing, constructing a hierarchical
hash tree as a unified representation of the integrity baseline and runtime state. When file changes are detected, the
system performs only local incremental updates to the
hash tree, reducing computational complexity to O(log n).
Threat determination is performed by combining multi-dimensional features such as change frequency and file type concentration within a
sliding time window, triggering a tiered response. When the
threat level reaches a preset threshold, the
system physically pauses the
virtual machine and quickly locates the target set of changed files by performing a top-down difference traversal by comparing the current
hash tree with the baseline hash tree. This invention achieves strong external isolation monitoring, effectively defending against
ransomware and internal threats, and combines high real-time performance with low performance overhead.