A computer-implemented method for controlling access to a peripheral device, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising: receiving, by one or more computing devices, an input/output request related to an application process attempting to access the peripheral device; determining, by the one or more computing devices, whether the input/output request is anomalous with respect to the application process attempting to access the peripheral device, the determination indicating that the input/output request is beyond a threshold level of abnormality for the application process; determining, by the one or more computing devices, an access state for the application process indicative of whether the process will be allowed to gain access to the peripheral device, the access state being based on a context property of the application process; and responding, by the one or more computing devices, to the input/output request with initiation of a virtual peripheral output from a virtual peripheral device if the request is beyond the threshold level of abnormality and if the access state is indicative of the application process not being allowed access to the peripheral device, wherein the virtual peripheral output is transmitted to the application process and: emulates an output of the peripheral device in an output format expected by the application process; and provides information to the application process about the access state and a reason for the access state; and generating, by the one or more computing devices, an alert to a user associated with the peripheral device that the application process has been denied access to the peripheral device. receiving, by one or more computing devices, an input/output request related to an application process attempting to access the peripheral device; determining, by the one or more computing devices, whether the input/output request is anomalous with respect to the application process attempting to access the peripheral device, the determination indicating that the input/output request is beyond a threshold level of abnormality for the application process; determining, by the one or more computing devices, an access state for the application process indicative of whether the process will be allowed to gain access to the peripheral device, the access state being based on a context property of the application process; and responding, by the one or more computing devices, to the input/output request with initiation of a virtual peripheral output from a virtual peripheral device if the request is beyond the threshold level of abnormality and if the access state is indicative of the application process not being allowed access to the peripheral device, wherein the virtual peripheral output is transmitted to the application process and: emulates an output of the peripheral device in an output format expected by the application process; and provides information to the application process about the access state and a reason for the access state; and emulates an output of the peripheral device in an output format expected by the application process; and provides information to the application process about the access state and a reason for the access state; and generating, by the one or more computing devices, an alert to a user associated with the peripheral device that the application process has been denied access to the peripheral device.