Security event detection through virtual machine introspection

摘要

Methods and apparatus for detecting security events through virtual machine inspection are disclosed. Exemplary methods include monitoring by a monitoring agent the usage of multiple resources by a first virtual machine running on a computing device, wherein the monitoring agent is executed on the computing device separately from the first virtual machine. Exemplary methods further include detecting a potential security event by comparing the usage of the multiple resources with resource usage behavior. Exemplary methods further include associating a severity level with the identified potential security event and initiating a security action defined for the associated severity level.