The invention discloses a virtual machine introspection implementation (VMI) method and device, relates to the technical field of information and solves the problem that security check cannot be accurately performed on stored data in a VM (virtual machine) by a VMI system. The method includes: determining the to-be-checked data in the virtual machine; starting to read the to-be-checked data, storing copies of the read to-be-checked data, and storing a store address of the read to-be-checked data in a hardware transaction memory so as to enable the hardware transaction memory to monitor the read to-be-checked data according to the store address; when the read to-be-checked data are monitored to be rectified, stopping reading the to-be-checked data and deleting the copies; when reading of the to-be-checked data is completed and the read to-be-checked data are monitored to be rectified, performing security check on the copies. The method and device is applicable to virtual machine introspection.