Abstract: A system including a hypervisor and a guest virtual machine. The hypervisor is configured to communicate a measurement request that identifies virtual machine operating characteristics metadata, to receive packets comprising virtual machine operating characteristics, and to communicate packets comprising virtual machine operating characteristics to a virtual vault machine for processing. The guest virtual includes one or more virtual machine measurement points and a hypervisor control point. The hypervisor control point is configured to receive the measurement request, to determine one or more of the one or more virtual machine measurement points to collect the virtual machine operating characteristics metadata, and to receive virtual machine operating characteristics metadata from the determined one or more virtual machine measurement points.

Abstract: A system that includes a guest virtual machine is in communication with a hypervisor. The guest virtual machine comprises virtual machine measurement points and a hypervisor control point. The hypervisor control point is configured to collect virtual machine memory metadata from the guest virtual machine and from the hypervisor, and to compare the virtual machine memory metadata to the hypervisor memory metadata. The hypervisor control point is further configured to determine whether the virtual machine memory metadata is the same as the hypervisor memory metadata and to communicate the virtual machine memory metadata to the virtual vault machine in response to determining that the virtual machine memory metadata is the same as the hypervisor memory metadata. The virtual vault machine is in communication with the hypervisor and configured to classify the state of the guest virtual based on the virtual machine memory metadata.

Abstract: A system that includes a trusted measurement machine comprising a profiling tool, a semantics virtual machine profiling engine interface, a semantics virtual machine profiling engine. The profiling tool is configured to receive virtual machine operating characteristics metadata for a guest virtual machine and to communicate the virtual machine operating characteristics metadata to the semantics virtual machine profiling engine using the semantics virtual machine profiling engine interface. The profiling tool is further configured to compare the virtual machine operating characteristics metadata to a target profile comprising known configurations for guest virtual machines, to determine a classification for the guest virtual machine, and to communicate the determined classification to the vault management console.

Abstract: A system that includes a hypervisor configured to communicate packets comprising virtual machine operating characteristics metadata for guest virtual machines. The system further includes a virtual vault machine comprising a hypervisor device driver, a hypervisor device driver interface, and an analysis tool. The hypervisor device driver is configured to receive a packet comprising virtual machine operating characteristics metadata for a guest virtual machine and to communicate the virtual machine operating characteristics metadata to an analysis tool using the hypervisor device driver interface. The analysis tool is configured to correlate the virtual machine operating characteristics metadata to one of a cluster of known healthy guest virtual machines or a cluster of known compromised guest virtual machines using a machine learning algorithm and to classify the guest virtual machine.

Abstract: A system that includes a vault management console configured to determine a measurement request for virtual machine operating characteristics metadata. The system further includes a guest virtual machine that includes virtual machine measurement points and a hypervisor control point. The system further includes a hypervisor associated with the guest virtual machine that is configured to communicate the measurement request to the hypervisor control point. The hypervisor is further configured to receive a packet with the virtual machine operating characteristics metadata and to communicate the packet to the virtual vault machine. The hypervisor device driver is configured to receive the packet from the hypervisor and to communicate the virtual machine operating characteristics to an analysis tool.

Abstract: A system including a guest virtual machine with one or more virtual machine measurement points configured to collect virtual machine operating characteristics metadata and a hypervisor control point configured to receive virtual machine operating characteristics metadata from the virtual machine measurement points. The hypervisor control point is further configured to send the virtual machine operating characteristics metadata to a hypervisor associated with the guest virtual machine. The system further includes the hypervisor configured to receive the virtual machine operating characteristics metadata and to forward the virtual machine operating characteristics metadata to a hypervisor device driver in a virtual vault machine. The system further includes the virtual vault machine configured to determine a classification for the guest virtual machine based on the virtual machine operating characteristics metadata and to send the determined classification to a vault management console.

Abstract: A system including a guest virtual machine with one or more virtual machine measurement points configured to collect virtual machine operating characteristics metadata and a hypervisor control point configured to receive virtual machine operating characteristics metadata from the virtual machine measurement points. The hypervisor control point is further configured to send the virtual machine operating characteristics metadata to a hypervisor associated with the guest virtual machine. The system further includes the hypervisor configured to receive the virtual machine operating characteristics metadata and to forward the virtual machine operating characteristics metadata to a hypervisor device driver in a virtual vault machine. The system further includes the virtual vault machine configured to determine a classification for the guest virtual machine based on the virtual machine operating characteristics metadata and to send the determined classification to a vault management console.

Abstract: A system that includes a hypervisor configured to communicate packets comprising virtual machine operating characteristics metadata for guest virtual machines. The system further includes a virtual vault machine comprising a hypervisor device driver, a hypervisor device driver interface, and an analysis tool. The hypervisor device driver is configured to receive a packet comprising virtual machine operating characteristics metadata for a guest virtual machine and to communicate the virtual machine operating characteristics metadata to an analysis tool using the hypervisor device driver interface. The analysis tool is configured to correlate the virtual machine operating characteristics metadata to one of a cluster of known healthy guest virtual machines or a cluster of known compromised guest virtual machines using a machine learning algorithm and to classify the guest virtual machine.

Abstract: A system that includes a vault management console configured to determine a measurement request for virtual machine operating characteristics metadata. The system further includes a guest virtual machine that includes virtual machine measurement points and a hypervisor control point. The system further includes a hypervisor associated with the guest virtual machine that is configured to communicate the measurement request to the hypervisor control point. The hypervisor is further configured to receive a packet with the virtual machine operating characteristics metadata and to communicate the packet to the virtual vault machine. The hypervisor device driver is configured to receive the packet from the hypervisor and to communicate the virtual machine operating characteristics to an analysis tool.

Abstract: A system that includes a trusted measurement machine comprising a profiling tool, a semantics virtual machine profiling engine interface, a semantics virtual machine profiling engine. The profiling tool is configured to receive virtual machine operating characteristics metadata for a guest virtual machine and to communicate the virtual machine operating characteristics metadata to the semantics virtual machine profiling engine using the semantics virtual machine profiling engine interface. The profiling tool is further configured to compare the virtual machine operating characteristics metadata to a target profile comprising known configurations for guest virtual machines, to determine a classification for the guest virtual machine, and to communicate the determined classification to the vault management console.

Abstract: A system including a hypervisor and a guest virtual machine. The hypervisor is configured to communicate a measurement request that identifies virtual machine operating characteristics metadata, to receive packets comprising virtual machine operating characteristics, and to communicate packets comprising virtual machine operating characteristics to a virtual vault machine for processing. The guest virtual includes one or more virtual machine measurement points and a hypervisor control point. The hypervisor control point is configured to receive the measurement request, to determine one or more of the one or more virtual machine measurement points to collect the virtual machine operating characteristics metadata, and to receive virtual machine operating characteristics metadata from the determined one or more virtual machine measurement points.

Abstract: A system that includes a guest virtual machine is in communication with a hypervisor. The guest virtual machine comprises virtual machine measurement points and a hypervisor control point. The hypervisor control point is configured to collect virtual machine memory metadata from the guest virtual machine and from the hypervisor, and to compare the virtual machine memory metadata to the hypervisor memory metadata. The hypervisor control point is further configured to determine whether the virtual machine memory metadata is the same as the hypervisor memory metadata and to communicate the virtual machine memory metadata to the virtual vault machine in response to determining that the virtual machine memory metadata is the same as the hypervisor memory metadata. The virtual vault machine is in communication with the hypervisor and configured to classify the state of the guest virtual based on the virtual machine memory metadata.