METHOD AND SYSTEM FOR MALWARE DETECTION IN VIRTUAL MACHINES

Example embodiments relate to methods, systems, and a computer program product for detecting and responding to the presence of malware persistently executing in a monitored virtual machine of a virtual computing platform. The method includes logging I/O requests at a hypervisor kernel in a kernel log and at a virtual machine (VM) managed by the hypervisor in a VM log. The logged I/O requests then may be compared to detect evidence of malware according to differences between the I/O requests logged in the VM log and the kernel log.