Aiming at the problem that virtual machine information cannot be extracted incompletely, we extend the typical informa tion extraction model of virtual machine and propose a perception mechanism in virtualization system based on storage covert chan nel to overcome the affection of the semantic gap.Taking advan tage of undetectability of the covert channel, a secure channel is established between Guest and virtual machine monitor to pass data directly.The Guest machine can pass the control information of malicious process to virtual machine monitor by using the VMCALL instruction and shared memory.By parsing critical information in process control structure, virtual machine monitor can terminate the malicious processes.The test results show that the proposed mechanism can clear the user-level malicious pro grams in the virtual machine effectively and covertly.Meanwhile,its performance overhead is about the same as that of other main stream monitoring mode.