US Patent 10255432 Detecting malicious instructions on a virtual machine using profiling

A system that includes a trusted measurement machine comprising a profiling tool, a semantics virtual machine profiling engine interface, a semantics virtual machine profiling engine. The profiling tool is configured to receive virtual machine operating characteristics metadata for a guest virtual machine and to communicate the virtual machine operating characteristics metadata to the semantics virtual machine profiling engine using the semantics virtual machine profiling engine interface. The profiling tool is further configured to compare the virtual machine operating characteristics metadata to a target profile comprising known configurations for guest virtual machines, to determine a classification for the guest virtual machine, and to communicate the determined classification to the vault management console. The semantics virtual machine profiling engine is configured to generate the target profile based on the virtual machine operating characteristics metadata and to communicate the target profile to the profiling tool using the semantics virtual machine profiling interface.