Security event detection through virtual machine introspection

An apparatus comprising:

• a memory;
• a resource monitor, executed via a hardware processor and machine readable instructions stored in the memory, to:
• monitor usage of a plurality of resources by a first virtual machine executing on a computing device, the resource monitor being separate from the first virtual machine, and
• detect a first potential security event at a first time by comparing a first usage of the plurality of resources to predetermined security event resource usage patterns determine a first severity level for the first potential security event based on comparing the first usage of the plurality of resources to the predetermined security event resource usage patterns, the first severity level indicative of a first likelihood that the first virtual machine has been compromised by malware;
• and
• a security event handler, executed via the hardware processor and machine readable instructions stored in the memory, to:
• reduce an integrity level assigned to the first virtual machine based on the first severity level;
• detect a second potential security event at a second time by comparing a second usage of the plurality of resources to the predetermined security event resource usage patterns;
• determine a second severity level for the second potential security event based on comparing the second usage of the plurality of resources to the predetermined security event resource usage patterns, the second severity level indicative of a second likelihood that the first virtual machine has been compromised by malware;
• reduce the integrity level assigned to the first virtual machine based on the second severity level, the integrity level indicative of a combined effect on the first virtual machine of the second potential security event and the first potential security event;
• and
• in response to determining the integrity level is below a threshold, initiate a security action, wherein the security action is defined in connection with the predetermined security event resource usage patterns.

A tangible computer readable storage medium comprising instructions which, when executed, cause a monitoring agent to at least:

• monitor usage of a plurality of resources by a first virtual machine executing on a computing device, the monitoring agent to execute on the computing device separate from the first virtual machine;
• detect a first potential security event at a first time by comparing a first usage of the plurality of resources to predetermined security event resource usage patterns;
• determine a first severity level for the first potential security event based on comparing the first usage of the plurality of resources to the predetermined security event resource usage patterns, the first severity level indicative of a first likelihood that the first virtual machine has been compromised by malware;
• reduce an integrity level assigned to the first virtual machine based on the first severity level;
• detect a second potential security event at a second time by comparing a second usage of the plurality of resources to the predetermined security event resource usage patterns;
• determine a second severity level for the second potential security event based on comparing the second usage of the plurality of resources to the predetermined security event resource usage patterns, the second severity level indicative of a second likelihood that the first virtual machine has been compromised by malware;
• reduce the integrity level assigned to the first virtual machine based on the second severity level, the integrity level indicative of a combined effect on the first virtual machine of the second potential security event and the first potential security event;
• and
• in response to determining the integrity level is below a threshold, initiate a security action, wherein the security action is defined in connection with the predetermined security event resource usage patterns.