Option Volatility Explained

Best Binary Options Brokers 2020:

    The Best Binary Options Broker 2020!
    Perfect For Beginners and Middle-Leveled Traders!
    Free Education.
    Free Demo Account.
    Get Your Sign-Up Bonus Now!


    Recommended Only For Experienced Traders!

Volatility Usage

Table of Contents

The most basic Volatility commands are constructed as shown below. Replace plugin with the name of the plugin to use, image with the file path to your memory image, and profile with the name of the profile (such as Win7SP1x64).

Here is an example:

For everything beyond this example, such as controlling the output format, listing the available plugins and profiles, or supplying plugin-specific options, see the rest of the text below.

There are several command-line options that are global (i.e. they apply to all plugins). This section is for folks who are new to Volatility or anyone who wants to become more familiar with what functionality can be tweaked.

You can display the main help menu by passing -h or –help on command-line. This shows the global options and lists the plugins available to the currently specified profile. If you do not specify a profile, you’ll be working with the default, WinXPSP2x86 , thus you’ll only see plugins that are valid for that operating system and architecture (for example, you won’t see linux plugins or windows plugins that only work on Vista). To specify a profile other than the default, see Selecting a Profile below.

The remainder of this section will discuss the various options in greater detail.

Selecting a Profile

Volatility needs to know what type of system your memory dump came from, so it knows which data structures, algorithms, and symbols to use. A default profile of WinXPSP2x86 is set internally, so if you’re analyzing a Windows XP SP2 x86 memory dump, you do not need to supply –profile at all. However, for all others, you must specify the proper profile name.

Note: If you do not know what type of system the memory dump is from, use the [imageinfo](Command Reference23#imageinfo) or [kdbgscan](Command Reference23#kdbgscan) plugins for a suggestion. These plugins are Windows-only.

If you want to see a list of supported profile names, do the following:

Best Binary Options Brokers 2020:

    The Best Binary Options Broker 2020!
    Perfect For Beginners and Middle-Leveled Traders!
    Free Education.
    Free Demo Account.
    Get Your Sign-Up Bonus Now!


    Recommended Only For Experienced Traders!

Alternatives to Command Line Options

If you’re about to enter a lengthy engagement and don’t want to type common plugin flags, there are two alternatives: environment variables and configuration files. If an option is not supplied on command-line, Volatility will try to get it from an environment variable and if that fails – from a configuration file.

Note also that to avoid confusion, the ( -h/–help ) option also lists the current value of each parameter so you can easily check what value is being used (from the environment or the config files).

On a Linux or OS X system you can set options by exporting them in your shell, as shown below:

Configuration files are typically ” volatilityrc ” in the current directory or

/.volatilityrc (user’s home directory), or at user specified path (using the –conf-file option). An example of the file contents is shown below:

Configuration files are particularly useful when processing several memory samples in one sitting.


  • Other plugin flags may be utilized in this way, for example KPCR , DTB or PLUGINS . When exporting variables, simply prefix VOLATILITY_ before the flag name (e.g. VOLATILITY_KPCR ). Otherwise, the flag name remains the same when adding it to the configuration file.
  • If you have a path with a space or more in the name, spaces should be replaced with %20 instead (e.g. LOCATION=file:///tmp/my%20image.img ).

Enabling Debug Messages

If something isn’t happening in Volatility the way you’d expect, try running the command with -d/–debug . This will enable the printing of debug messages to standard error. If you really need to debug Volatility (as in using pdb debugger), then add -d -d -d to your commands.

Using the Cache

Note: Caching has been disabled at this time.

The cache allows Volatility to store arbitrary objects and constants for later retrieval. This can include, DTB, KDBG, or KPCR addresses, entire x86 page translation tables, or even hibernation decompression data structures. To enable use of the cache, add –cache to your commands. This feature pickles (serializes) the data in files on your disk, so if you want to choose the location of cache files, use –cache-directory . For more information, see the caching system page in the developer guide for your release version.

Setting the Timezone

Timestamps extracted from memory can either be in system-local time, or in Universal Time Coordinates (UTC). If they’re in UTC, Volatility can be instructed to display them in a time zone of the analyst’s choosing. To choose a timezone, use one of the standard timezone names (such as Europe/London, US/Eastern or most Olson timezones) with the –tz=TIMEZONE flag. Volatility attempts to use pytz if installed, otherwise it uses tzset.

Please note that specifying a timezone will not affect how system-local times are displayed. If you identify a time that you know is UTC-based, please file it as an issue in the issue tracker.

By default the _EPROCESS CreateTime and ExitTime timestamps are in UTC. Below is output from Volatility with pytz installed:

Below is output from the same sample using the –tz=America/Chicago option to get Central Standard Time:

Below is the same output above, but without the pytz library installed:

Setting the DTB

The DTB (Directory Table Base) is what Volatility uses to translate virtual addresses to physical addresses. By default, a kernel DTB is used (from the Idle/System process). If you want to use a different process’s DTB when accessing data, supply the address to –dtb=ADDRESS .

Setting the KDBG Address

This is a Windows-only option

Volatility scans for the _KDDEBUGGER_DATA64 structure using hard-coded signatures “KDBG” and a series of sanity checks. These signatures are not critical for the operating system to function properly, thus malware can overwrite them in attempt to throw off tools that do rely on the signature. Additionally, in some cases there may be more than one _KDDEBUGGER_DATA64 (for example if you apply a major OS update and don’t reboot), which can cause confusion and lead to incorrect process and module listings, among other problems. If you know the address add _KDDEBUGGER_DATA64 , you can specify it with –kdbg=ADDRESS and this override the automated scans. For more information, see the [kdbgscan](Command Reference#kdbgscan) plugin.

For Windows 8 and above, the –kdbg parameter should be the address of KdCopyDataBlock instead. For more information, see Windows 8 Memory Forensics.

Setting the KPCR Address

This is a Windows-only option

There is one KPCR (Kernel Processor Control Region) for each CPU on a system. Some Volatility plugins display per-processor information. Thus if you want to display data for a specific CPU, for example CPU 3 instead of CPU 1, you can pass the address of that CPU’s KPCR with –kpcr=ADDRESS . To locate the KPCRs for all CPUs, see the [kpcrscan](Command Reference#kpcrscan) plugin. Also note that starting in Volatility 2.2, many of the plugins such as [idt](Command Reference#idt) and [gdt](Command Reference#gdt) automatically iterate through the list of KPCRs.

Enabling Write Support

Write support in Volatility should be used with caution. Therefore, to actually enable it, you must not only type –write on command-line but you must type a “password” in response to a question that you’ll be prompted with. In most cases you will not want to use write support since it can lead to corruption or modification of data in your memory dump. However, special cases exist that make this feature really interesting. For example, you could cleanse a live system of certain malware by writing to RAM over firewire, or you could break into a locked workstation by patching bytes in the winlogon DLLs.

Specifying Additional Plugin Directories

Volatility’s plugin architecture can load plugin files and profiles from multiple directories at once. In the Volatility source code, most plugins are located in volatility/plugins . However, there is another directory ( volatility/contrib ) which is reserved for contributions from third party developers, or weakly supported plugins that simply aren’t enabled by default. To access these plugins you just type –plugins=contrib/plugins on command-line. It also enables you to create a separate directory of your own plugins that you can manage without having to add/remove/modify files in the core volatility directories.


  • Subdirectories will also be traversed as long as there is an __init__.py file (which can be empty) within them.
  • The parameter to –plugins can also be a zip file containing the plugins such as –plugins=myplugins.zip .
  • If the specified directory contains profiles, these will also be loaded. This is convenient for using generated Linux/Android/Mac profiles with the standalone executable of Volatility.

Due to the way plugins are loaded, the external plugins directory or zip file must be specified before any plugin-specific arguments (including the name of the plugin). Example:

Choosing an Output Format

By default, plugins use text renderers to standard output. If you want to redirect to a file, you can of course use the console’s redirection (i.e. > out.txt ) or you could use –output-file=out.txt . The reason you can also choose –output=FORMAT is for allowing plugins to also render output as HTML, JSON, SQL, or whatever you choose. However, there are no plugins with those alternate output formats pre-configured for use, so you’ll need to add a function named render_html , render_json , render_sql , respectively to each plugin before using –output=HTML .

Plugin Specific Options

Many plugins accept arguments of their own, which are independent of the global options. To see the list of available options, type both the plugin name and -h/–help on command-line.

Using Volatility as a Library

Although its possible to use Volatility as a library, we hope to support it better in the future. Currently, if you need to import volatility from one of your other python scripts, you can use the following example code:

What is Implied Volatility?

Implied volatility (IV) is one of the most important concepts for options traders to understand for two reasons. First, it shows how volatile the market might be in the future. Second, implied volatility can help you calculate probability. This is a critical component of options trading which may be helpful when trying to determine the likelihood of a stock reaching a specific price by a certain time. Keep in mind that while these reasons may assist you when making trading decisions, implied volatility does not provide a forecast with respect to market direction.

Although implied volatility is viewed as an important piece of information, above all it is determined by using an option pricing model, which makes the data theoretical in nature. There is no guarantee these forecasts will be correct.

Understanding IV means you can enter an options trade knowing the market’s opinion each time. Too many traders incorrectly try to use IV to find bargains or over-inflated values, assuming IV is too high or too low. This interpretation overlooks an important point, however. Options trade at certain levels of implied volatility because of current market activity. In other words, market activity can help explain why an option is priced in a certain manner. Here we’ll show you how to use implied volatility to improve your trading. Specifically, we’ll define implied volatility, explain its relationship to probability, and demonstrate how it measures the odds of a successful trade.

Historical vs. implied volatility

There are many different types of volatility, but options traders tend to focus on historical and implied volatilities. Historical volatility is the annualized standard deviation of past stock price movements. It measures the daily price changes in the stock over the past year.

In contrast, implied volatility (IV) is derived from an option’s price and shows what the market implies about the stock’s volatility in the future. Implied volatility is one of six inputs used in an options pricing model, but it’s the only one that is not directly observable in the market itself. IV can only be determined by knowing the other five variables and solving for it using a model. Implied volatility acts as a critical surrogate for option value – the higher the IV, the higher the option premium.

Since most option trading volume usually occurs in at-the-money (ATM) options, these are the contracts generally used to calculate IV. Once we know the price of the ATM options, we can use an options pricing model and a little algebra to solve for the implied volatility.

Some question this method, debating whether the chicken or the egg comes first. However, when you understand the way the most heavily traded options (the ATM strikes) tend to be priced, you can readily see the validity of this approach. If the options are liquid then the model does not usually determine the prices of the ATM options; instead, supply and demand become the driving forces. Many times market makers will stop using a model because its values cannot keep up with the changes in these forces fast enough. When asked, What is your market for this option? the market maker may reply What are you willing to pay? This means all the transactions in these heavily traded options are what is setting the option’s price. Starting from this real-world pricing action, then, we can derive the implied volatility using an options pricing model. Hence it is not the market markers setting the price or implied volatility; it’s actual order flow.

Implied volatility as a trading tool

Implied volatility shows the market’s opinion of the stock’s potential moves, but it doesn’t forecast direction. If the implied volatility is high, the market thinks the stock has potential for large price swings in either direction, just as low IV implies the stock will not move as much by option expiration.

To option traders, implied volatility is more important than historical volatility because IV factors in all market expectations. If, for example, the company plans to announce earnings or expects a major court ruling, these events will affect the implied volatility of options that expire that same month. Implied volatility helps you gauge how much of an impact news may have on the underlying stock.

How can option traders use IV to make more informed trading decisions? IV offers an objective way to test forecasts and identify entry and exit points. With an option’s IV, you can calculate an expected range – the high and low of the stock by expiration. Implied volatility tells you whether the market agrees with your outlook, which helps you measure a trade’s risk and potential reward.

Defining standard deviation

First, let’s define standard deviation and how it relates to IV. Then we’ll discuss how standard deviation can help set future expectations of a stock’s potential high and low prices – values that can help you make more informed trading decisions.

To understand how implied volatility can be useful, you first have to understand the biggest assumption made by people who build pricing models: the statistical distribution of prices. There are two main types which are used, normal distribution or lognormal distribution. The image below is of normal distribution, sometimes known as the bell-curve due to its appearance. Plainly stated, normal distribution gives equal chance of prices occurring either above or below the mean (which is shown here as $50). We are going to use normal distribution for simplicity’s sake. However, it is more common for market participants to use the lognormal variety.

Why, you ask? If we consider a stock at a price of $50, you could argue there is equal chance that the stock may increase or decrease in the future. However, the stock can only decrease to zero, whereas it can increase far above $100. Statistically speaking, then, there are more possible outcomes to the upside than the downside. Most standard investment vehicles work this way, which is why market participants tend to use lognormal distributions within their pricing models.
With that in mind, let’s get back to the bell-shaped curve (see Figure 1). A normal distribution of data means most numbers in a data set are close to the average, or mean value, and relatively few examples are at either extreme. In layman’s terms, stocks trade near the current price and rarely make an extreme move.

Let’s assume a stock trades at $50 with an implied volatility of 20% for the at-the-money (ATM) options. Statistically, IV is a proxy for standard deviation. If we assume a normal distribution of prices, we can calculate a one standard-deviation move for a stock by multiplying the stock’s price by the implied volatility of the at-the-money options:

One standard deviation move = $50 x 20% = $10
The first standard deviation is $10 above and below the stock’s current price, which means its normal expected range is between $40 and $60. Standard statistical formulas imply the stock will stay within this range 68% of the time (see Figure 1).

All volatilities are quoted on an annualized basis (unless stated otherwise), which means the market thinks the stock would most likely neither be below $40 or above $60 at the end of one year. Statistics also tell us the stock would remain between $30 and $70 – two standard deviations — 95% of the time. Furthermore it would trade between $20 and $80 – three standard deviations – 99% of the time. Another way to state this is there is a 5% chance that the stock price would be outside of the ranges for the second standard deviation and only a 1% chance of the same for the third standard deviation.

Keep in mind these numbers all pertain to a theoretical world. In actuality, there are occasions where a stock moves outside of the ranges set by the third standard deviation, and they may seem to happen more often than you would think. Does this mean standard deviation is not a valid tool to use while trading? Not necessarily. As with any model, if garbage goes in, garbage comes out. If you use incorrect implied volatility in your calculation, the results could appear as if a move beyond a third standard deviation is common, when statistics tell us it’s usually not. With that disclaimer aside, knowing the potential move of a stock which is implied by the option’s price is an important piece of information for all option traders.

Standard deviation for specific time periods

Since we don’t always trade one-year options contracts, we must break down the first standard deviation range so that it can fit our desired time period (e.g. days left until expiration). The formula is:

(Note: it’s usually considered more accurate to use the number of trading days until expiration instead of calendar days. Therefore remember to use 252 – the total number of trading days in a year. As a short cut, many traders will use 16, since it is a whole number when solving for the square root of 256.)

Let’s assume we are dealing with a 30 calendar-day option contract. The first standard deviation would be calculated as:

A result of Ա 1.43 means the stock is expected to finish between $48.57 and $51.43 after 30 days (50 Ա 1.43). Figure 2 displays the results for 30, 60 and 90 calendar-day periods. The longer the time period, the increased potential for wider stock price swings. Remember implied volatility of 10% will be annualized, so you must always calculate the IV for the desired time period.

Final thought

Hopefully by now you have a better feel for how useful implied volatility can be in your options trading. Not only does IV give you a sense for how volatile the market may be in the future, it can also help you determine the likelihood of a stock reaching a specific price by a certain time. That can be crucial information when you’re choosing specific options contracts to trade.

This icon indicates a link to a third party website not operated by Ally Bank or Ally. We are not responsible for the products, services or information you may find or provide there. Also, you should read and understand how that site’s privacy policy, level of security and terms and conditions may impact you.

Comment on this article


cory on March 14, 2020 at 5:50pm

why do we take the square root of 30/365, and not just multiply by 30/365?

Balakumar R. on June 8, 2020 at 1:45am

This is an amazing explanation of IV and SD. Relation between both. hats off..thanks..

Ally on June 18, 2020 at 9:48am

We love comments like this. Thanks for reading.��

Diego on August 20, 2020 at 12:28pm

Why do you divide by 365 if as mentioned there is only 252 trading days? If so you get a +/- 1.725 instead. Is this a more accurate model?

Ally on August 21, 2020 at 4:23pm

Hi Diego, it’s usually considered more accurate to use the number of trading days until expiration instead of calendar days. Thanks for your comment!

David D. on January 13, 2020 at 4:53pm

If in calculation we use 256 days instead of 365, for a 30 calendar days option contract, should we use sqrt(30/252) or sqrt(21/256) because there is 21 working days in 30 calendar days period. ?

Difference between Implied, Realized and Historical Volatility

This page explains the differences between types of volatility – implied, realized, historical. There are other types and terms which we will also explain, including forecast volatility, future volatility, and statistical volatility.

How They Differ

Volatility, typically expressed as a percentage and interpreted as standard deviation of returns, measures how much a security moves over a certain period. The individual types of volatility differ mainly in two things:

  1. What that period is (historical volatility is for some period in the past, while future or forecast volatility is forward looking).
  2. How we find or calculate the volatility (implied volatility is calculated from option prices, while realized volatility is calculated from underlying price changes).

Implied vs. Realized Volatility

Volatility is particularly important for option traders, because it affects options prices (or option values?). In general, higher volatility makes options more valuable, and vice versa.

The subtle difference between an option’s price and its value is key to understanding the difference between implied and realized volatility.

Price is what you pay. Value is what you get.

To make a profit you must buy high value for low price (or sell low value for high price). This is true when trading options like it is when trading stocks (or anything else).

Implied volatility is what you pay – it is the volatility implied (contained or reflected) in an option’s price.

Option pricing models such as the Black-Scholes model can calculate exact option price for a particular level of volatility (assuming we also know the other factors, such as the option’s strike price, time to expiration, or underlying price). They can also be reversed to find the exact volatility that is implied in a particular option price. This is how we calculate implied volatility – from option prices. Therefore, implied volatility is the future volatility expected by the options market. This expectation may be correct, or it may not.

Realized volatility is what you get – it is the volatility actually realized in the underlying market. It can be calculated from underlying price moves (e.g. daily stock price changes). Although there are various approaches, the most common way is to calculate realized volatility as standard deviation of daily logarithmic returns. This is why realized volatility is sometimes called statistical volatility.

Option prices don’t affect realized volatility in any way.

In fact, you can calculate realized volatility even for securities without any options on them. On the contrary, there is no implied volatility without options. At the same time, when there are multiple options listed on the same underlying and same expiration (calls and puts, different strikes), each of these options can have different implied volatility (this is in fact very common and known as volatility skew or smile).

Historical vs. Future Volatility

While implied volatility is always forward looking (it is the expected volatility from now until the option’s expiration), realized volatility can relate either to the past (then it is called historical volatility) or the future (then it is called future realized volatility).

Another important characteristic of realized volatility (historical or future) is the length of the period over which it is measured. For example, “20-day historical volatility” measures realized volatility over last 20 days (it is typically calculated as standard deviation of last 20 daily price changes).

Future vs. Forecast Volatility

When talking about future volatility, we must distinguish between our opinion (before it happens) or prediction of what the future volatility will be – this is often called forecast volatility – and the reality, which we will only know after it happens – the future realized volatility.

Our ability to forecast volatility (not an easy task!) is essential for successful option trading – we want our forecast volatility (what we think will happen) to be as close as possible to the future realized volatility (what actually happens). If we can do that consistently, we only need to buy options which are underpriced relative to our expectation (the option’s implied volatility is lower than our forecast volatility) or sell options which are overpriced (implied volatility is higher than our forecast volatility). This won’t guarantee that we make a profit on one particular trade (besides volatility there are other factors affecting option prices, including particularly underlying price direction, though these can be hedged). However, it should make us profitable in the long run, over a large number of trades.


We have explained the differences between individual types of volatility:

Implied volatility is calculated from an option’s price. It is the volatility that the buyers and sellers of this particular option expect to be realized in the period from now until the option’s expiration. Different options can have different implied volatilities, even when they are on the same underlying and with the same expiration date.

Realized volatility is calculated from underlying price changes over a certain period (exact calculation explained here). If this certain period is in the past, we call it historical volatility. If it is in the future, we call it future realized volatility.

What does implied volatility mean? What is the intuition behind the dependence of volatility and option price?

a I d R AhUC b qu y Gs vUNK T DhvOr o xpvih p gexzF t p a t l EjCw

You have many options, here are the most relevant in my opinion:

1) Work with freelancer platforms to help you pick the right CFO for your startup on demand. I suggest Toptal , th.

Speaking as someone who has been trading options for quite some time, I’ll give a very elementary description of what Implied Volatility (IV) is because most people (even 99.999999% of people in finance) do not know how IV and options work.

Implied volatility is a metric to measure how much an underlying stock’s price has moved recently.

Think of Implied volatility in terms of Auto Insurance:

Person A pays a premium to insure his/her vehicle (option premium).

Person A has a spotless driving record over the past 10 years, which is why his premium is low (low option premium due to low Implied .

Best Binary Options Brokers 2020:

    The Best Binary Options Broker 2020!
    Perfect For Beginners and Middle-Leveled Traders!
    Free Education.
    Free Demo Account.
    Get Your Sign-Up Bonus Now!


    Recommended Only For Experienced Traders!

Like this post? Please share to your friends:
Binary Options Brokers, Signals and Strategies
Leave a Reply

;-) :| :x :twisted: :smile: :shock: :sad: :roll: :razz: :oops: :o :mrgreen: :lol: :idea: :grin: :evil: :cry: :cool: :arrow: :???: :?: :!: