Identifying virtual machines that perform inconsistent with a profile

Methods, systems and computer program products for identifying virtual machines that perform inconsistent with a profile are provided. Methods may include collecting initial virtual machine data corresponding to multiple virtual machines. Multiple virtual machine profiles are generated and each of the virtual machine profiles is associated with one of multiple virtual machine types. Ones of the virtual machines are associated with one of the virtual machine profiles based on the virtual machine data. Additional virtual machine data corresponding to ones of the virtual machines is collected. The additional virtual machine data is analyzed to detect a deviation of one of the virtual machines.

BACKGROUND

The present disclosure relates to computer systems, and in particular to managing virtual machines that are deployed in a virtualized computer environment.

Virtualized computer environments, which may include cloud computing systems, composite information technology systems and computer cluster systems, are used to provide computer resources or other computing resources to end users. In a cloud computing environment, the physical hardware configuration is hidden from the end user. Cloud computing systems may include servers, network storage devices, routers, gateways, communication links, software (e.g., applications, operating systems, web services, etc.), and other devices. However, because the physical hardware and software platforms on which cloud computing system is implemented are hidden within a “cloud,” they can be managed, upgraded, replaced or otherwise changed by a system administrator without the customer being aware of or affected by the change.

In a typical cloud computer environment, applications may be executed on virtual machines, which are isolated guest operating systems installed within a host system. Virtual machines are typically implemented with software emulation, hardware virtualization, or both. A single hardware and/or software platform may host a number of virtual machines, each of which may have access to some portion of the platform's resources, such as program code processing resources, storage resources, display resources, communication interfaces, etc.

Virtual machines may be configured and/or implemented to perform specific tasks, operations or functions or to execute specific applications or types of applications. Performance of virtual machines, both individually and aggregately, may rely on the virtual machines performing in accordance with a specific configuration. As such, performance of virtual machines in a cloud computing environment may be compromised by deviations in virtual machine behavior.

BRIEF SUMMARY

According to one aspect of the present disclosure methods of operating a computer system may include analyzing data corresponding to a virtual machine, generating a virtual machine profile corresponding to the virtual machine, and detecting a deviation of the virtual machine relative to the virtual machine profile.

In some embodiments, analyzing the data includes analyzing static data that includes attribute data corresponding to the virtual machine. Some embodiments provide that detecting the deviation includes analyzing dynamic data that includes usage data corresponding to the virtual machine and that is collected at a given temporal instant.

Some embodiments provide that generating the virtual machine profile includes generating an initial virtual machine profile. An updated virtual machine profile may be generated and the updated virtual machine profile may be compared to the initial virtual machine profile to detect a change in the virtual machine performance. In some embodiments, the virtual machine profile is updated corresponding to data received after generating the initial machine profile.

Some embodiments include analyzing data corresponding to multiple virtual machines and generating multiple virtual machine profile types. In some embodiments, the virtual machine profile types include installed software types, solution machine types, or data class types. Some embodiments provide that generating the virtual machine profile types includes generating each of the virtual machine types based on data aggregated corresponding to multiple virtual machines that correspond to the virtual machine type. In some embodiments, detecting the deviation of the virtual machine includes detecting the deviation of one of the virtual machines relative to a corresponding one of the virtual machine profiles.

Some embodiments include collecting virtual machine usage data that corresponds to the virtual machine and virtual machine attribute data that corresponds to the virtual machine.

Some embodiments include performing an automatic remediation operation responsive to detecting the deviation relative to the virtual machine profile. In some embodiments, performing the automatic remediation operation includes transmitting a message corresponding to the deviation responsive to detecting the deviation. Some embodiments provide that performing the automatic remediation includes storing data corresponding to the deviation in a data repository responsive to detecting the deviation. In some embodiments, performing the automatic remediation comprises changing an operation in the virtual machine responsive to detecting the deviation. Some embodiments provide that the operation change includes a network change, an operational status change, or a port activity change.

Some embodiments herein include methods of operating a computer system. Such methods may include collecting initial virtual machine data corresponding to multiple virtual machines and generating multiple virtual machine profiles. Each of the virtual machine profiles may be associated with one of multiple different virtual machine types. Ones of the virtual machines may be associated with one of the virtual machine profiles based on the virtual machine data. Additional virtual machine data corresponding to virtual machines may be collected and analyzed to detect a deviation of one of the virtual machines.

In some embodiments, collecting the initial virtual machine data includes collecting virtual machine usage data and virtual machine attribute data and collecting additional virtual machine data includes collecting updated virtual machine usage data and updated virtual machine attribute data.

Some embodiments provide that analyzing the additional virtual machine data includes comparing the additional virtual machine data to a corresponding one of the virtual machine profiles to detect the deviation. In some embodiments, the deviation includes a change in virtual profile type of one of the virtual machines from an initial virtual machine profile type to an updated virtual machine profile type.

Some embodiments include updating one of the virtual machine profiles responsive to collecting the additional virtual machine data or analyzing the additional virtual machine data. In some embodiments, analyzing the additional virtual machine data to detect the deviation of one of the virtual machines includes comparing the additional virtual machine data corresponding to one of the virtual machines to the virtual machine profile corresponding to that one of the virtual machines.

In some embodiments, analyzing the additional virtual machine data to detect the deviation of one of the virtual machines includes comparing the additional virtual machine data corresponding to one of the virtual machines to virtual machine data corresponding to one of the virtual machine types.

Some embodiments include automatically performing a remediation operation responsive to the virtual machine deviation analyzer detecting the deviation. In some embodiments, automatically performing the remediation operation includes causing a message corresponding to the deviation to be transmitted responsive to detecting the deviation, causing data corresponding to the deviation to be stored in a data repository responsive to detecting the deviation, or causing an operation change in the virtual machine responsive to detecting the deviation.

Some embodiments disclosed herein are directed to computer program products for operating a computer system including a virtual machine as described herein.

It is noted that aspects of the disclosure described with respect to one embodiment, may be incorporated in a different embodiment although not specifically described relative thereto. That is, all embodiments and/or features of any embodiment can be combined in any way and/or combination. These and other objects and/or aspects of the present invention are explained in detail in the specification set forth below.

DETAILED DESCRIPTION

FIG. 1illustrates a computer system100for a virtualized computing environment in which the subject matter of the present disclosure can be embodied. Although various embodiments are described in the context of a virtualized computing environment, the disclosure is not limited thereto and may be used to manage access to resources of non-virtual computer environments. The computer system100generally hosts and manages one or more virtual machines104(hereafter managed virtual machine, or managed machine), each of which runs a guest operating system106and application108. The computing needs of users102(e.g., humans and/or other virtual/non-virtual machines) drive the functionality of the virtual machines104. A virtual hypervisor110can provide an interface between the virtual machines104and a host operating system112and allow multiple guest operating systems106and associated applications108to run concurrently. The host operating system112handles the operations of a hardware platform114capable of implementing virtual machines104. A data storage space116may be accessed by the host operating system112and is connected to the hardware platform114.

The hardware platform114generally refers to any computer system capable of implementing virtual machines104, which may include, without limitation, a mainframe computer platform, personal computer, mobile computer (e.g., tablet computer), server, wireless communication terminal (e.g., cellular data terminal), or any other appropriate program code processing hardware. The hardware platform114may include computer resources such as a processing circuit(s) (e.g., central processing unit, CPU); networking controllers; communication controllers; a display unit; a program and data storage device; memory controllers; input devices (such as a keyboard, a mouse, etc.) and output devices such as printers. The processing circuit(s) is configured to execute computer program code from memory device(s), described below as a computer readable storage medium, to perform at least some of the operations and methods described herein, and may be any conventional processor circuit(s), such as the AMD Athlon™ 64, or Intel® Core™ Duo.

The hardware platform114may be further connected to the data storage space116through serial or parallel connections. The data storage space116may be any suitable device capable of storing computer-readable data and program code, and it may include logic in the form of disk drives, random access memory (RAM), or read only memory (ROM), removable media, or any other suitable memory component. According to the illustrated embodiment, the host operating system112functionally interconnects the hardware platform114and the users102and is responsible for the management and coordination of activities and the sharing of the computer resources.

Although some embodiments of the computer system100can be configured to operate as a computer server, the computer system100is not limited thereto and can be configured to provide other functionality, such as data processing, communications routing, etc.

Besides acting as a host for computing applications that run on the hardware platform114, the host operating system112may operate at the highest priority level in the system100, executing instructions associated with the hardware platform114, and it may have exclusive privileged access to the hardware platform114. The priority and privileged access of hardware resources affords the host operating system112exclusive control over resources and instructions, and may preclude interference with the execution of different application programs or the operating system. The host operating system112can create an environment for implementing a virtual machine, hosting the “guest” virtual machine. One host operating system112is capable of implementing multiple isolated virtual machines simultaneously.

A virtual hypervisor110(which may also be known as a virtual machine monitor or VMM) may run on the host operating system112and may provide an interface between the virtual machine104and the hardware platform114through the host operating system112. The virtual hypervisor110virtualizes the computer system resources and facilitates the operation of the virtual machines104. The hypervisor110may provide the illusion of operating at the highest priority level to the guest operating system106. However, the virtual hypervisor110can map the guest operating system's priority level to a priority level lower than the top most priority level. As a result, the virtual hypervisor110can intercept the guest operating system106, and execute instructions that require virtualization assistance. Alternatively, the virtual hypervisor110may emulate or actually execute the instructions on behalf of the guest operating system106. Software steps permitting indirect interaction between the guest operating system106and the physical hardware platform114can also be performed by the virtual hypervisor110.

When operating in a virtualized environment, the virtual machines104present a virtualized environment to the guest operating systems106, which in turn provide an operating environment for applications108and other software constructs.

Applications108that are implemented on the virtual machines104may be configured to access one or more data sources in accordance with the functions thereof. As discussed herein by way of example, a data source may be a file, however, the disclosure is not so limited. For example, database applications and/or applications that operate, at least in part, using data sources such as database files, may rely on access to one or more database files to perform the requisite operations. In some embodiments, such access may further include one or more settings that determine or identify a portion, format, location, path, version or other attribute of the file being accessed. For example, an access request corresponding to a database file may include query terms, among others. In some embodiments, an access request corresponding to a database file may be directed to a database120that may be included in or provided in addition to the data storage space116.

In some embodiments, a virtual machine profiler130may analyze data corresponding to a virtual machine104. In some embodiments, the data that is analyzed by the virtual machine profiler may include static data, such as attribute data corresponding to the virtual machine. Examples of static data may include version identifiers, amount of memory allocated, the identity of one or more processing resources that are dedicated to the virtual machines104, a host type, types and/or identifications of products installed on the virtual machines104, and/or configurations of ports, among others. The static data may be collected using one or more inventory applications and/or products that may provide data corresponding to configurations and installed products on the virtual machines104.

Some embodiments provide that the data that is analyzed by the virtual machine profiler130includes dynamic data that includes usage data corresponding to the virtual machine104. The dynamic data may be collected at a given temporal instant and may include values that correspond only to that instant and/or a previous instant. Examples of dynamic data may include usage data such as the quantity of memory a virtual machine104is using, the quantity of processor resources the virtual machine104is using, the quantity and/or identity of open network ports, the quantity and/or identity of applications that are accessing the network, and/or the quantity and/or identity of applications that are running, among others.

In some embodiments, the virtual machine profiler130may generate a virtual machine profile corresponding to the virtual machine104. The virtual machine profiler may generate an initial virtual machine profile based on the static and dynamic data initially collected, received and/or analyzed. In addition to the initial virtual machine profile, an updated virtual machine profile may be generated upon receipt of additional and/or updated static and/or dynamic data.

Some embodiments provide that the virtual machine profiler130analyzes data corresponding to multiple different virtual machines104and generates multiple different virtual machine profile types. For example, virtual machine profile types may correspond to the type of applications and/or software installed thereon, which may be referred to as solution machine types. Different solution machine types may include a database, a web server, a data center, a workstation, an archive, and/or a data and/or service monitoring machine profile type. In some embodiments, virtual machine profile types may correspond to whether a machine is a front end machine that is used in direct interaction with people or a back end machine that may be used in a primarily operations-based capacity.

Some embodiments provide that virtual machine profile types are characterized in terms of the sensitivity of data that the corresponding machines process, store, manage, transmit and/or otherwise access. For example, a particular machine profile type may correspond to a server that has access to credit card or other financial data. Another example may include a machine profile type that corresponds to a server that processes and/or accesses data that is subject to regulatory compliance, such as, for example, medical data. Additionally, a virtual machine104that is not utilized may be described as idle, which may be another virtual machine profile type.

In some embodiments, a data collector136may collect the data that corresponds to managed virtual machines104and provide the collected data to the virtual machine profiler130. Although illustrated as providing the collected data directly to the virtual machine profiler130, the data collector136may collect the data for transmission and/or storage to the database120and/or other portion of the data storage space116. Some embodiments provide that the data collector136is a virtual machine usage collector that collects virtual machine usage data, which may include dynamic data. In some embodiments, the data collector136is a virtual machine attributes collector that collects virtual machine attribute data, which may include static data.

The system100may include a virtual machine deviation analyzer132that detects a deviation relative to the virtual machine profile generated by the virtual machine profiler130. In some embodiments, the deviation may be a performance deviation in that the virtual machine performance has deviated from performance that corresponds to the virtual machine profile. In some embodiments, the deviation may be an operational deviation in that the virtual machine operations have deviated from those corresponding to the virtual machine profile. Some embodiments provide that the virtual machine deviation analyzer132compares the updated virtual machine profile to the initial virtual machine profile to detect the change in performance or profile of the virtual machine104.

For example, a managed virtual machine104may have been deployed by an original owner to provide a particular function and/or service, but the original owner may have overlooked, forgotten about or lost control of the managed virtual machine104. Another party, machine or application may be accessing, monitoring and/or controlling the previously deployed managed virtual machine104in a manner that is inconsistent with the original intent and/or configuration. A specific example may include a managed virtual machine104that was originally deployed as a web server machine and that has another, subsequently installed, unauthorized application or software installed thereon. The unauthorized application or software may be malware that is attempting access to other components of the original owner's network resources, which may present risk to the original owner. However, even if the unauthorized application or software is not malware, processing resources of the original owner may be misappropriated to a non-owner, which may present unnecessary additional expense to the original owner.

In some embodiments, the virtual machine deviation analyzer132detects the deviation a virtual machine104relative to a corresponding virtual machine profile that has been previously associated with the virtual machine104. For example, a machine that was previously associated with a web server virtual machine profile may have an updated virtual machine profile corresponding to an idle managed machine. In this example, the virtual machine104may be shut down, restored, tagged and/or repurposed in response to detecting a deviation in performance and/or behavior.

The system100may include an automatic remediator134that performs a remediation operation in response to the virtual machine deviation analyzer132detecting the deviation relative to a virtual machine profile. For example, some embodiments provide that the automatic remediator134causes a message corresponding to the deviation to be transmitted to an owner, administrator, and/or other party and/or application. In some embodiments, the automatic remediator134causes data corresponding to the deviation to be stored in a data repository such as the database120and/or other portion of the data storage space116. In this manner, data corresponding to any processes and/or states may be preserved. Additionally, the data corresponding to the deviation may be used to determine the source and/or remediation corresponding to the deviation.

In some embodiments, the automatic remediator134may cause the virtual machine104to be shut down and/or isolated in the case of particular types of deviations and/or virtual machine profile types. Similarly, the automatic remediator134may cause an operation change in the virtual machine104in response to the virtual machine deviation analyzer132detecting a deviation. Examples of an operation change include a network change, an operational status change, and/or a port activity change, among others. In some embodiments, virtual machines that are identified as not providing the services that they were assigned to do may be reassigned with a correct and/or modified profile, powered off or removed from the virtualization environment.

Reference is now made toFIG. 2, which illustrates a virtual computing environment according to some embodiments of the present inventive concepts. A virtual computing environment200(referred to generally as cloud200) may include one or more computer systems100(referred to as server systems) that may include one or more electronic computing devices operable to receive, transmit, process, and store data. For example, the servers in the cloud200may include one or more general-purpose personal computers, workstations, server computers, server pools, or any other suitable devices. In certain embodiments, the cloud200may include a web server. In short, the cloud200may include any suitable combination of software, firmware, and hardware.

The plurality of server systems100may be communicatively coupled via a network112. The network112facilitates wireless and/or wireline communication, and may communicate using, for example, IP packets, Frame Relay frames, Asynchronous Transfer Mode (ATM) cells, voice, video, data, and other suitable information between network addresses. The network112may include one or more local area networks (LANs), radio access networks (RANs), metropolitan area networks (MANs), wide area networks (WANs), all or a portion of the global computer network known as the Internet, and/or any other communication system or systems at one or more locations. Although referred to herein as “server systems”, it will be appreciated that any suitable computing device may be used. A network address may include an alphabetic and/or numerical label assigned to a device in a network. For example, a network address may include an IP address, an IPX address, a network layer address, a MAC address, an X.25/X.21 address, and/or a mount point in a distributed file system, among others.

WhileFIG. 2illustrates a physical configuration of servers within a cloud200, a computer system100may include a logical grouping of virtual machines104within a virtualization environment in the cloud200. Although not illustrated herein, the virtual machines104in the cloud can be organized and managed in clusters, which may also referred to herein as “grids”. A virtualization environment in the cloud200may be managed by a single hypervisor110, or a set of hypervisors110.

Virtual machines can be deployed in particular virtualization environments and organized to increase the efficiency of operating and/or managing a virtual computing environment. For example, virtual machines may be grouped into clusters in order to provide load balancing across multiple servers.

Virtual machines104that are deployed within a virtualization environment may share physical resources within a server100. For example, virtual machines104may share physical data storage116, a database120communication facilities and other resources or services of a server100. Changes in behavior and/or performance of virtual machines104may be identified by comparing a virtual machine profile that is generated by a virtual machine profiler130with collected usage and/or attribute data using a virtual machine deviation analyzer132.

Server automation/provisioning tools (also referred to as server deployment tools) may be used to manage virtual machines in a cloud computing environment. For example, server automation/provisioning tools may move virtual machines from one hypervisor to another or from one virtualization environment to the other. These tools may also be used, for example, to deploy, provision, activate, suspend, and otherwise manage the operation of virtual machines These tools may further be used to implement systems/methods according to some embodiments described herein.

FIG. 3illustrates a system according an embodiment of the present inventive subject matter. The system300includes a virtual machine usage collector236that collects usage data corresponding to virtual machines in a network. In some embodiments, the virtual usage collector236collects the data from one of more usage providers237that monitor resource usage of virtual machines and/or collect usage data. For example, usage providers237may include applications, systems and/or services that monitor and/or measure virtual machine resource usage and audit logs.

Some embodiments provide that usage data may correspond to a specific time instant or interval and may include the quantity of memory a virtual machine is using, the quantity of processor resources the virtual machine is using, the quantity and/or identity of open network ports, the quantity and/or identity of applications that are accessing the network, and/or the quantity and/or identity of applications that are running, among others. Usage data collected by the virtual machine usage collector236may be transmitted to and/or stored in a usage store225that may be provided in a data store220.

A virtual machine attributes collector238collects attribute data corresponding to virtual machines in the network. In some embodiments, the virtual machine attribute collector238collects the data from one of more attribute data providers239that may evaluate and tag virtual machines according to one or more properties. For example, attribute data providers239may include applications, systems and/or services that identify, inventory, categorize, characterize, and/or tag a virtual machine corresponding to configurations and installed products for ease of virtual environment management. Examples of attribute data may include version identifiers, amount of memory allocated, the identity of one or more processing resources that are dedicated to the virtual machines, a host type, types and/or identifications of products installed on the virtual machines, and/or configurations of ports, among others. Attribute data collected by the virtual machine attribute collector238may be transmitted to and/or stored in an attribute store226that may be provided in the data store220.

The system300may include a virtual machine profile modeler242that may analyze the collected usage and attribute data and, according to profile rules, assign virtual machine profiles to virtual machines. Some embodiments provide that that the profile models are provided to the virtual machine profile modeler242, however, the virtual machine profiler242may also generate new profile models based on an aggregation and analysis of usage and attribute data from multiple virtual machines. The virtual machine profiles may be stored in a virtual machine profile store224that may be provided in the data store220.

The profile rules may be provided in a profile rules store223that may be provided in the data store220. In some embodiments, a profile management module240may be provided for an administrator or system agent to define attributes and/or usage data that corresponds to each of multiple different virtual machine profiles. For example, a virtual machine with no applications running, no ports open and low processor utilization may be assigned an idle profile, whereas a combination of one or more specific programs running combined with certain ports open may identify the virtual machine as a particular type of database machine (e.g., an Oracle database).

Once the virtual machine profile modeler242assigns a profile to a virtual machine, if a profile change is detected from an earlier determined profile (e.g., by comparing newly assigned profiles to previously determined profiles), a deviation analyzer232may determine whether the profile change is an expected change. In some embodiments, determining whether the profile change is expected may be performed by comparing the profile change to profile changes and/or behavior of other virtual machines. A variety of analyses may be used by the deviation analyzer232to compare current virtual machine behavior to the previously assigned profile. For example, depending on the metrics used in the profile, threshold values, value ranges, statistical methods, and/or sum of differences, among others may be used.

Responsive to detecting a change in behavior or profile by the deviation analyzer232, a reports and alerts module244may generate one or more reports and/or alerts. In some embodiments, reports and/or alerts may be sent to an administrator, customer and/or agent that optionally be installed within the virtual machine. In some embodiments, alerts generated by the reports and alerts module244may be stored in an alerts store222that may be provided in the data store220.

In some embodiments, reports and/or alerts may result in one or more automatic actions or responses. For example, automatic remediation operations may be performed such as shutting the virtual machine down, closing, activating and/or inactivating one or more network ports, changing a network and/or a network identifier, sending one or more messages (e.g., email, telephone, short message service (SMS), etc.) and/or logging data corresponding to the change in a log file, among others.

Reference is now made toFIG. 4, which is a flowchart illustrating operations for systems/methods according to an embodiment of the present inventive subject matter. Data corresponding to a virtual machine may be analyzed (block302). The analyzed data may include static data that includes attribute data corresponding to the virtual machine. Attribute data may include version identifiers, amount of memory allocated, the identity of one or more processing resources that are dedicated to the virtual machines, a host type, types and/or identifications of products installed on the virtual machines, and/or configurations of ports, among others. In some embodiments, the analyzed data may include dynamic data that includes usage data corresponding to the virtual machine and that corresponds to a specific time instant and/or interval. For example, usage data may include the quantity of memory a virtual machine is using, the quantity of processor resources the virtual machine is using, the quantity and/or identity of open network ports, the quantity and/or identity of applications that are accessing the network, and/or the quantity and/or identity of applications that are running, among others.

A virtual machine profile may be generated based on the analysis of the attribute and/or usage data corresponding to the virtual machine (block304). In some embodiments, generating the virtual machine profile includes generating an initial virtual machine profile. Some embodiments provide that, based on the analysis of the attribute and/or usage data, a previously defined virtual machine profile is assigned to the corresponding virtual machine. Whether a new virtual machine profile is generated for a virtual machine or an existing virtual machine profile is assigned to the virtual machine, a time stamp may also be generated corresponding to the association between the virtual machine and the virtual machine profile.

In some embodiments, generating the virtual machine profile includes generating or assigning an initial virtual machine profile to the virtual machine. An updated virtual machine profile may be generated and/or assigned based on attribute and/or usage data that collected after the initial virtual machine profile is generated and/or assigned. The updated virtual machine profile may be used to detect a deviation of the virtual machine relative to the virtual machine profile (block306). For example, if an initially assigned profile indicates that a virtual machine is a database server and an updated virtual machine profile indicates that the virtual machine is idle, a virtual machine deviation may be detected by comparing the updated virtual machine profile to the initial virtual machine profile.

In addition to comparing individual virtual machine profiles corresponding to specific virtual machines, the attribute and/or usage data corresponding to multiple virtual machines may be analyzed (block310). The analysis of data corresponding to multiple virtual machines may provide a basis for generating different virtual machine profiles and/or profile types (block312). For example, virtual machine profile types may include software types that correspond to the type of major or primary software that is installed thereon. Different solution machine types may include a database, a web server, a data center, a workstation, an archive, and/or a data and/or service monitoring machine profile type. In some embodiments, virtual machine profile types may correspond to whether a machine is a front end machine that is used in direct interaction with people or a back end machine that may be used in a primarily operations-based capacity.

Some embodiments provide that virtual machine profile types are characterized in terms of the sensitivity and/or class of data that the corresponding machines process, store, manage, transmit and/or otherwise access. For example, a particular machine profile type may correspond to a server that has access to credit card or other financial data. Another example may include a machine profile type that corresponds to a server that processes and/or accesses data that is subject to regulatory compliance, such as, for example, medical data. Additionally, a virtual machine that is not utilized may be described as idle, which may be another virtual machine profile type. In some embodiments, the virtual machine types may be generated based on data aggregated corresponding to multiple different virtual machines that are the same virtual machine profile type. In this manner, models of virtual machine profiles may be generated and/or revised according to additional attribute and/or usage data from different virtual machines. Some embodiments provide that by using data from multiple machines and updating a virtual machine profile user additional data, the virtual machine profiles may reflect differences in virtual machine usage and attributes over time. Some embodiments provide that the deviation of a virtual machine relative to a corresponding one of the virtual machine profiles may be detected.

Some embodiments include collecting virtual machine usage data that corresponds to the virtual machine and virtual machine attribute data that corresponds to the virtual machine (block314). The collected data may be used to analyze one or more virtual machines In some embodiments, the collected data may be transmitted to a database or other data repository. Some embodiments provide that a virtual machine usage collector may collect virtual machine usage data and/or a virtual machine attributes collector may collect virtual machine attribute data.

Some embodiments include performing an automatic remediation operation in response to detecting a deviation (block316). By performing an automatic remediation operation, risks, inefficiencies and/or costs associated with a change in operation, function and/or behavior of a virtual machine may be mitigated. Brief reference is made toFIG. 5, which is a flowchart illustrating operations for performing automatic remediation according to some embodiments herein. Some embodiments provide that the automatic remediation includes transmitting a message corresponding to the deviation (block320). For example, responsive to detecting the deviation an message may be transmitted to an owner, administrator, and/or other party and/or application. In some embodiments, data corresponding to the deviation of a virtual machine may be stored in a data repository such as a database and/or other portion of a data storage space (block322). In this manner, data corresponding to any processes and/or states may be preserved. Additionally, the data corresponding to the deviation may be used to determine the source and/or remediation corresponding to the deviation.

In some embodiments, automatic remediation may include changing a virtual machine operation (block324). For example, automatic remediation may include shutting the virtual machine down, and/or isolating the virtual machine in the case of particular types of deviations and/or virtual machine profile types. For example, where a deviation and/or virtual machine profile type indicates a potential risk to other network, system, owner and/or organization assets, resources and/or security, a virtual machine may be isolated from other network resources and/or nodes. In some embodiments, an operation change may include a network change, an operational status change, and/or a port activity change, among others. In some embodiments, virtual machines that are identified as not providing the services that they were assigned to do may be reassigned with a correct and/or modified profile.

Reference is now made toFIG. 6, which is a flowchart illustrating operations for systems/methods according to an embodiment of the present inventive subject matter. Some embodiment include collecting initial virtual machine data corresponding to multiple virtual machines in one or more virtual environments (block340). The initial virtual machine data may include virtual machine usage data and/or virtual machine attribute data.

Multiple virtual machine profiles may be generated (block342). Some embodiments provide that each of the virtual machine profiles may be associated with a particular type of virtual machine. For example, a virtual machine type may be determined based on a major or primary software installed thereon, a type of data stored on and/or accessed by the virtual machine, and/or a level of accessibility, exposure and/or interaction with people. Based on the collected usage and/or attribute data, different virtual machines may be associated with corresponding virtual machine profiles (block344).

Additional virtual machine data corresponding to ones of the virtual machines may be collected (block346). For example updated virtual machine usage data and updated virtual machine attribute data may be collected. The additional virtual machine data may be analyzed to detect a deviation of individual ones of the virtual machines (block348). A detected deviation may include a change in virtual profile and/or profile type of a virtual machine from an initial virtual machine type, virtual machine profile and/or virtual machine profile type. In some embodiments, the change in profile and/or profile type may correspond to an updated virtual machine profile and/or profile type.

Some embodiments provide that deviations may be detected by comparing the additional virtual machine data to previously assigned and/or associated virtual machine profiles. In some embodiments, the analysis may include detecting a deviation from the profile type that is not specific to a particular virtual machine. However, some embodiments provide that the analysis may include detecting a deviation relative to a profile previously generated, associated and/or assigned to the same virtual machine.

In some embodiments, the collected data may not indicate a deviation sufficient to trigger a detection but may provide additional data that may be used to update and/or modify one or more virtual machine profiles (block350). In this manner, the virtual machine profiles may evolve in accordance with changes in technology, usage and/or application trends. Some embodiments provide that a virtual machine profile may be updated in response to collecting the additional virtual machine data and/or analyzing the additional virtual machine data.

In some embodiments, a detected deviation may be sufficient to warrant subsequent action or inquiry. In such embodiments, a remediation operation may be performed automatically in response to the virtual machine deviation analyzer detecting the deviation (block352). Some embodiments provide that a remediation operation includes transmitting a message corresponding to the deviation. Some embodiments provide that a remediation operation includes causing data corresponding to the deviation to be stored in a data repository. In some embodiments, a remediation operation may include causing an operation change in the virtual machine.