Security event detection through virtual machine introspection

摘要

Usage of a plurality of resources is monitored 602 by a first virtual machine executing on a computing device by a monitoring agent, the monitoring agent executing on the computing device separate from the first virtual machine. A potential security event is detected 604 by comparing the usage of the plurality of resources to resource usage patterns. A severity level is assigned 606 to the detected potential security event, and a security action is initiated 608 defined for the assigned severity level. The monitoring agent preferably communicates with a hypervisor managing the first virtual machine. The security action preferably comprises migrating functionality of the first virtual machine to a second virtual machine and terminating the first virtual machine.