System for distributing virtual entity behavior profiling in cloud deployments

A method, comprising:

• accessing, at a hypervisor server, a log including data associated with activities performed by a virtual machine executing on the hypervisor server, wherein the activities are performed by the virtual machine during a first time period;
• determining, by utilizing instructions from a memory that are executed by a processor and by utilizing the hypervisor server, if a change in behavior for the virtual machine has occurred based on executing a behavior profiling algorithm on the data associated with the activities performed by the virtual machine, wherein the change in behavior of the virtual machine is determined to have occurred based on detecting a change in an efficiency of processing conducted by the virtual machine during the first time period when compared to a historical behavior profile for the virtual machine for a second time period, wherein the second time period comprises a sliding window of time comprising a plurality of consecutive previous days, and wherein the second time period does not include the first time period;
• providing, if the change in behavior is determined to have occurred and if the change in behavior exceeds a threshold, a report including the data associated with the activities performed by the virtual machine;
• and
• determining, if the change in behavior is determined to have occurred and if the change in behavior exceeds the threshold, that the virtual machine is compromised based on a hash value generated from a payload of a packet associated with the virtual machine matching a segment of malware code.

A computer-readable device comprising instructions, which when executed by a processor, cause the processor to perform operations comprising:

• accessing, at a hypervisor server, a log including data associated with activities performed by a virtual machine executing on the hypervisor server, wherein the activities are performed by the virtual machine during a first time period;
• determining, by utilizing the hypervisor server, if a change in behavior for the virtual machine has occurred based on executing a behavior profiling algorithm on the data associated with the activities performed by the virtual machine, wherein the change in behavior of the virtual machine is determined to have occurred based on detecting a change in an efficiency of processing conducted by the virtual machine during the first time period when compared to a historical behavior profile for the virtual machine for a second time period, wherein the second time period comprises a sliding window of time comprising a plurality of consecutive previous days, and wherein the second time period does not include the first time period;
• generating, if the change in behavior is determined to have occurred and if the change in behavior exceeds a threshold, a report including the data associated with the activities performed by the virtual machine;
• and
• determining, if the change in behavior is determined to have occurred and if the change in behavior exceeds the threshold, that the virtual machine is compromised based on a hash value generated from a payload of a packet associated with the virtual machine matching a segment of malware code.