Patent ID: 8443440

Claim:
An intrusion-detection and intrusion-prevention system in a virtual server system, comprising: a processor, and a non-transitory computer readable storage medium having computer readable instructions stored thereon for execution by the processor, forming: a virtualization platform including a hypervisor; one or more guest virtual machines deployed on top of the virtualization platform; a security virtual machine deployed on top of the virtualization platform, the security virtual machine being configured to determine if the guest virtual machines have respective security agents installed and running on the guest virtual machines; the security virtual machine comprising a plurality of virtual security agents, each virtual security agent being associated with a respective guest virtual machine through a corresponding networking driver, associated with the respective guest virtual machine, and linking the respective guest virtual machine to a network and intercepting packet data traffic of the respective guest virtual machine; each networking driver comprising a fast path driver for passing the packet data traffic through provided the respective guest virtual machine has a security agent installed and running on the respective guest virtual machine, for processing the packet stream in the security agent of the respective guest virtual machine; each networking driver being configured to route the packet data traffic through a respective virtual security agent in the security virtual machine outside of the respective guest virtual machine provided the respective guest virtual machine does not have the security agent installed and running.