# How VMAware's Scoring System Works and What Determines the Detection Threshold

> Understand VMAware's scoring system. Learn how weighted scores determine VM detection, with thresholds set at 150 or 300 points for accurate analysis.

- Repository: [Louis/vmaware](https://github.com/kernelwernel/vmaware)
- Tags: deep-dive
- Published: 2026-03-05

---

**VMAware detects virtual machines by accumulating weighted technique scores and comparing the cumulative total against a configurable threshold of 150 points (or 300 in high-security mode) to render a final verdict.**

The kernelwernel/vmaware library implements a sophisticated scoring mechanism to evaluate VM detection techniques, moving beyond binary checks to a confidence-based model. Understanding how VMAware's scoring system calculates individual technique weights and applies detection thresholds enables developers to interpret results accurately and tune the library for production environments versus research contexts.

## How Technique Scores Are Calculated

VMAware assigns every detection technique a **technique score** derived from two primary quality metrics documented in [[`docs/score_system.md`](https://github.com/kernelwernel/vmaware/blob/main/docs/score_system.md)](https://github.com/kernelwernel/vmaware/blob/main/docs/score_system.md). The scoring algorithm balances detection confidence against the risk of false positives.

### Reliability and Specificity Weighting

Each technique receives a raw score based on two categories weighted equally at **50%** each:

- **Reliability (50%)**: Measures consistency across repeated executions on the same virtualized platform. Techniques that produce stable, reproducible results receive higher percentages within the 5%–40% typical range.
- **Specificity to VMs (50%)**: Evaluates how uniquely the technique triggers inside virtualized environments versus bare-metal hosts. High-specificity techniques that rarely flag physical machines score up to 40%.

The raw score combines these weighted values. According to the source analysis, the final technique score never drops below **5 points**, ensuring that even low-confidence checks contribute minimally to the cumulative total.

### False-Positive Penalty Structure

After calculating the raw score, VMAware applies a **false-positive penalty** using a four-tier scale that reduces the final score by 0% to 80%. This penalty directly subtracts from the reliability and specificity sum when a technique is known to incorrectly flag non-VM environments. The complete penalty criteria and tier definitions reside in the [[`docs/score_system.md`](https://github.com/kernelwernel/vmaware/blob/main/docs/score_system.md)](https://github.com/kernelwernel/vmaware/blob/main/docs/score_system.md) specification file.

## Detection Threshold Configuration and Logic

The detection threshold represents the cumulative score required to trigger a "VM detected" verdict. In [[`src/vmaware.hpp`](https://github.com/kernelwernel/vmaware/blob/main/src/vmaware.hpp)](https://github.com/kernelwernel/vmaware/blob/main/src/vmaware.hpp), VMAware defines two static threshold constants that govern this behavior:

```cpp
static constexpr u16 threshold_score      = 150; // normal detection threshold
static constexpr u16 high_threshold_score = 300; // used when the HIGH_THRESHOLD flag is set

```

### Normal vs. High Threshold Modes

VMAware operates in two distinct detection modes based on runtime configuration:

- **Normal Mode**: Uses `threshold_score` (150 points). This is the default behavior when `VM::HIGH_THRESHOLD` is not set, suitable for general-purpose scanning where balanced detection is preferred.
- **High-Threshold Mode**: Uses `high_threshold_score` (300 points). Activated by setting the `VM::HIGH_THRESHOLD` flag, this mode requires double the cumulative evidence before reporting virtualization, significantly reducing false positives in production environments.

### Runtime Threshold Evaluation

During execution, VMAware maintains a running accumulator (`points`) that sums the scores of all executed techniques. The library checks this total against the active threshold after each technique completes. As implemented in [`src/vmaware.hpp`](https://github.com/kernelwernel/vmaware/blob/main/src/vmaware.hpp) around lines 12117–12125, the logic follows this pattern:

```cpp
u16 threshold = VM::HIGH_THRESHOLD ? high_threshold_score : threshold_score;
if (points >= threshold) {
    // VM is considered detected; further techniques can be skipped
}

```

The library also implements a **shortcut** mechanism (referenced near lines 11736–11742) that short-circuits the evaluation loop once the threshold is met, improving performance by skipping unnecessary detection techniques.

## Practical Implementation Examples

### Running with Default Threshold

The following example executes all detection techniques using the standard 150-point threshold:

```cpp
#include "vmaware.hpp"

int main() {
    VM::core::run_all();               // evaluates all techniques
    if (VM::core::detected()) {
        std::cout << "Virtual machine detected!\n";
    } else {
        std::cout << "No VM detected.\n";
    }
}

```

### Enabling Strict High-Threshold Mode

To require 300 points of cumulative evidence before flagging a VM, set the `HIGH_THRESHOLD` flag before running detection:

```cpp
#include "vmaware.hpp"

int main() {
    VM::set_flags(VM::HIGH_THRESHOLD);   // raise detection bar to 300
    VM::core::run_all();                  // now requires ≥ 300 points
    std::cout << (VM::core::detected()
                  ? "VM detected (high threshold)."
                  : "No VM detected.") << '\n';
}

```

### Inspecting Cumulative Scores

For debugging or forensic analysis, retrieve the actual accumulated score and active threshold:

```cpp
#include "vmaware.hpp"

int main() {
    VM::core::run_all();
    std::cout << "Total technique score: " << VM::core::total_score() << '\n';
    std::cout << "Threshold used: "
              << (VM::flags() & VM::HIGH_THRESHOLD ? 300 : 150) << '\n';
}

```

## Summary

- VMAware calculates individual **technique scores** using a 50/50 weighting of reliability and specificity, then applies false-positive penalties that can reduce scores by up to 80%.
- The **detection threshold** is defined in [`src/vmaware.hpp`](https://github.com/kernelwernel/vmaware/blob/main/src/vmaware.hpp) as 150 points for normal operation and 300 points when `VM::HIGH_THRESHOLD` is enabled.
- A **running total** (`points`) accumulates technique scores during execution, with evaluation short-circuiting once the active threshold is reached to optimize performance.
- The scoring methodology is fully documented in [`docs/score_system.md`](https://github.com/kernelwernel/vmaware/blob/main/docs/score_system.md), while the threshold comparison logic resides in the core header file around lines 11736–11742 and 12117–12125.

## Frequently Asked Questions

### What is the default detection threshold in VMAware?

The default detection threshold is **150 points**, defined as the constant `threshold_score` in [`src/vmaware.hpp`](https://github.com/kernelwernel/vmaware/blob/main/src/vmaware.hpp). This means the cumulative score from all executed detection techniques must reach or exceed 150 before `VM::core::detected()` returns true.

### How are individual technique scores calculated?

Each technique receives a score based on **50% reliability** (consistency across tests) and **50% specificity** (uniqueness to VM environments). These percentages typically range from 5% to 40% each, summing to a raw score that is then reduced by a false-positive penalty tier (0%–80% reduction). The final score is floored at a minimum of 5 points as specified in [`docs/score_system.md`](https://github.com/kernelwernel/vmaware/blob/main/docs/score_system.md).

### When should I use the HIGH_THRESHOLD flag?

Enable `VM::HIGH_THRESHOLD` when operating in **production environments** or scenarios requiring strict false-positive tolerance. This raises the detection bar to 300 points, ensuring that only systems exhibiting strong, multi-technique virtualization indicators are flagged as VMs, reducing the risk of misidentifying bare-metal hosts.

### Can the detection threshold be customized beyond 150 and 300?

The source code in [`src/vmaware.hpp`](https://github.com/kernelwernel/vmaware/blob/main/src/vmaware.hpp) defines only two static threshold values: `threshold_score` (150) and `high_threshold_score` (300). While the library does not expose runtime threshold modification through the public API, developers can modify these constexpr values in the header and recompile to establish custom thresholds for specialized use cases.