A system that is configured to detect attacks with respect to a data center, the system comprising: a server computing device (212, 214, 216) that is included in a shim layer in the data center, the server computing device (212, 214, 216) comprises at least one processor and at least one memory, the server computing device (212, 214, 216) configured to execute virtual machines, VMs, the at least one memory comprises instructions that, when executed by the at least one processor, cause the at least one processor to perform acts comprising: receiving, from the VMs, traffic flow data, the traffic flow data indicative of a feature of traffic transmitted between: a first computing device in the data center or a first service hosted by the data center; and a second computing device or a second service that is external to the data center, the traffic flow data received over a time window; and a controller component that is in communication with the server computing device (212, 214, 216), the controller component configured to perform acts comprising: identifying an attack based upon the traffic flow data, the attack on the second computing device or second service from the first computing device or first service; and generating an alarm in response to identifying the attack, monitoring, by said controller component, load at each respective instant of an analyzer component of each of the VMs, wherein each VM (706, 708, 710, 712) has a respective analyzer component executing therein, wherein each of said respective analyzer component is configured to passively collects and analyze said traffic flow, causing at least one virtual machine to be newly instantiated on the server computing device (212, 214, 216) based on said monitoring, and dynamically reallocating, by said controller component, the traffic transmitted across existing and the at least one newly instantiated virtual machine. a first computing device in the data center or a first service hosted by the data center; and a second computing device or a second service that is external to the data center, the traffic flow data received over a time window; and a controller component that is in communication with the server computing device (212, 214, 216), the controller component configured to perform acts comprising: identifying an attack based upon the traffic flow data, the attack on the second computing device or second service from the first computing device or first service; and generating an alarm in response to identifying the attack, monitoring, by said controller component, load at each respective instant of an analyzer component of each of the VMs, wherein each VM (706, 708, 710, 712) has a respective analyzer component executing therein, wherein each of said respective analyzer component is configured to passively collects and analyze said traffic flow, causing at least one virtual machine to be newly instantiated on the server computing device (212, 214, 216) based on said monitoring, and dynamically reallocating, by said controller component, the traffic transmitted across existing and the at least one newly instantiated virtual machine. identifying an attack based upon the traffic flow data, the attack on the second computing device or second service from the first computing device or first service; and generating an alarm in response to identifying the attack, monitoring, by said controller component, load at each respective instant of an analyzer component of each of the VMs, wherein each VM (706, 708, 710, 712) has a respective analyzer component executing therein, wherein each of said respective analyzer component is configured to passively collects and analyze said traffic flow, causing at least one virtual machine to be newly instantiated on the server computing device (212, 214, 216) based on said monitoring, and dynamically reallocating, by said controller component, the traffic transmitted across existing and the at least one newly instantiated virtual machine.