Patent ID: 8336099

Claim:
A method for implementing introspection data comparison utilizing hypervisor guest introspection data, the method comprising: constructing one or more workload management components for a plurality of guest operating systems using a hypervisor shim that requires no instrumentation on a participating pool member of a pool comprising the plurality of guest operating systems, wherein the pool is associated with the hypervisor shim, wherein the participating pool member comprises a guest having a guest memory, a guest memory layout and a guest operating system, and wherein the one or more workload management components are constructed by: performing introspection of the guest memory, accepting an operating system (OS) memory map, and comparing the guest memory layout with the OS memory map wherein, when the guest memory layout matches the OS memory map; the hypervisor shim collecting a first set of data using the OS memory map that matches the guest memory layout to obtain one or more interested memory segments from the guest memory layout, wherein the one or more interested memory segments correspond to resource utilization by the guest, wherein the first set of data is obtained without information reported by the guest; the guest sending a second set of data comprising guest memory data corresponding to resource utilization from the guest memory; comparing the first set of data with the second set of data to detect at least one of a potential security intrusion or an anomalous deviation between the first set of data and the second set of data; and a policy manager taking action based upon a result of the comparison of the first and second sets of data.