Patent ID: 8813240

Claim:
A computer-implemented method comprising: executing a plurality of virtual machines on a first physical machine, wherein a first virtual machine of the plurality of virtual machines executes an encryption process; detecting, on a second virtual machine of the plurality of virtual machines, execution of a hostile process that is configured to compromise the encryption process executed by the first virtual machine, the detecting comprising: determining a count representing read accesses to a clock by the hostile process, wherein the clock is within a central processing unit of the physical machine; determining a rate of clock read accesses by the hostile process; determining whether the rate of clock read accesses is beyond a clock read access threshold; and detecting the execution of the hostile process based on the determination that the rate of clock read access is beyond the clock read access threshold; and migrating at least the second virtual machine from the first physical machine to a second physical machine based on the detection of the execution of the hostile process, wherein the second physical machine is separate and distinct from the first physical machine.