A monitor is a class of security tools that either actively intercept events or passively analyze a system for violations of security. If a monitor resides inside the operating system it protects, the monitor itself can be compromised by kernel-level attacks. This problem can be addressed by using virtualization. In virtual machine monitors, the hypervisor intervenes in executions of the guest VM to give a virtual view of the real hardware. This is achieved through utilizing the higher privilege of the hypervisor over the kernel to intercept accesses to the underlying hardware. The privileged hypervisor allows various security approaches to protect access to hardware in an un-trusted guest VM, and have security tools isolated from the un-trusted system by placing them in a separate VM [14].