Extracting Malicious Instructions on a Virtual Machine in a Network Environment

A system comprising:

• a guest virtual machine comprising:
• one or more virtual machine measurement points implemented by a processor, and configured to collect virtual machine operating characteristics metadata;
• and
• a hypervisor control point implemented by the processor, and configured to:
• receive virtual machine operating characteristics metadata from the one or more virtual machine measurement points;
• and
• send the virtual machine operating characteristics metadata to a hypervisor associated with the guest virtual machine using a hypervisor connecting interface;
• the hypervisor in data communication with the guest virtual machine, and configured to:
• receive the virtual machine operating characteristics metadata;
• and
• forward the virtual machine operating characteristics metadata to a hypervisor device driver in a virtual vault machine using a secure virtual network connection;
• and
• the virtual vault machine in data communication with the hypervisor, and configured to:
• determine a classification for the guest virtual machine based on the virtual machine operating characteristics metadata, wherein the classification is one of a healthy state and a compromised state;
• and
• send the determined classification to a vault management console.

A virtual machine intrusion detection method comprising:

• collecting, using virtual machine measurement points operably coupled to a hypervisor control point, virtual machine operating characteristics metadata from a guest virtual machine, wherein the virtual machine measurement points and the hypervisor control point are implemented by a processor;
• generating, by the hypervisor control point, a packet that comprises the virtual machine operating characteristics metadata;
• sending, by the hypervisor control point, the packet to a hypervisor associated with the guest virtual machine via a hypervisor connecting interface;
• forwarding, by the hypervisor, the packet to a hypervisor device driver in a virtual vault machine via a secure virtual connection;
• determining, by the virtual vault machine, a classification for the guest virtual machine based on the virtual machine operating characteristics metadata;
• and
• sending, by the virtual vault machine, the determined classification to a vault management console.