Determining existence of a network attack

1 . A method of determining if a virtual machine is executing a network attack, the method comprising, using a computing device operating a processor:

receiving a plurality of jobs from a plurality of virtual machines being executed across time slices on a host computer in a computer network;

executing the plurality of jobs using the processor;

receiving counts of hardware-related activities from hardware counters of the processor;

determining which of the counts of hardware-related activities are caused by execution of jobs of the plurality of jobs received from a respective virtual machine, the determination indicating which virtual machine of the plurality of virtual machines is consuming processing slices of which internal units of the computing device and for what period or periods of time; and

based on the processing slices consumed by each of the virtual machines of the plurality of virtual machines and the period or periods of time, determining whether or not a virtual machine of the plurality of virtual machines is executing a network attack.

2 . The method of claim 1 , wherein if it is determined that a virtual machine is executing a network attack, transmitting information concerning the respective virtual machine to an authorized entity.

3 . The method of claim 1 , comprising, if it is determined that a virtual machine is executing a network attack, terminating the respective virtual machine.

4 . The method of claim 1 , wherein the computing device is a network interface controller.

5 . The method of claim 1 , wherein the determining comprises providing the counts of hardware-related activities to a machine learning algorithm.

6 . The method of claim 1 , wherein the determining comprises providing the counts of hardware-related activities to a machine learning classifier algorithm.

7 . The method of claim 1 , wherein based on the counts of hardware-related activities, determining whether or not the virtual machine of the plurality of virtual machines is executing the network attack comprises providing the counts of hardware-related activities to a machine learning algorithm trained to determine whether or not the virtual machine is executing the network attack.

8 . A device comprising:

a memory; and

one or more processors to:

receive a plurality of jobs from a plurality of virtual machines being executed across time slices on a host computer in a computer network;

execute the plurality of jobs;

receive counts of hardware-related activities from hardware counters of the one or more processors;

determine which of the counts of hardware-related activities are caused by execution of jobs of the plurality of jobs received from a respective virtual machine of the plurality of virtual machines, the determination indicating which virtual machine of the plurality of virtual machines is consuming processing slices of which internal units of the one or more processors and for what period or periods of time; and

based on the processing slices consumed by each of the virtual machines of the plurality of virtual machines and the period or periods of time, determine whether or not a virtual machine of the plurality of virtual machines is executing a network attack.

9 . The device of claim 8 , wherein if the one or more processors determine that a virtual machine is executing a network attack, the one or more processors to transmit information concerning the respective virtual machine to an authorized entity.

10 . The device of claim 8 , wherein if the one or more processors determine that a virtual machine is executing a network attack, the one or more processors to terminate the respective virtual machine.

11 . The device of claim 8 , wherein the device is a network interface controller.

12 . The device of claim 8 , wherein the one or more processors to determine whether or not a virtual machine is executing a network attack by providing the counts of hardware-related activities to a machine learning algorithm.

13 . The device of claim 8 , wherein the one or more processors is to: based on the counts of hardware-related activities, determine whether or not the virtual machine of the plurality of virtual machines is executing the network attack by providing the counts of hardware-related activities to a machine learning algorithm trained to determine whether or not the virtual machine is executing the network attack.

14 . A system comprising:

a host computer executing a plurality of processes; and

a network interface controller (NIC) to:

execute a plurality of jobs received from one or more of the plurality of processes;

receive counts of hardware-related activities from the NIC;

wherein the NIC or the host computer is to determine which of the counts of hardware-related activities are caused by execution of jobs of the plurality of jobs received from a respective process of the plurality of processes, wherein the determination indicates which process of the plurality of processes is consuming processing slices of which internal units of the NIC and for what period or periods of time; and

wherein the NIC or the host computer is to determine, based on the processing slices of internal units of the NIC consumed by each of the processes of the plurality of processes and the period or periods of time, whether or not a process of the plurality of processes is executing a network attack on the NIC by providing the counts of hardware-related activities to a machine learning algorithm trained to determine whether or not the process is executing the network attack based on the counts of hardware-related activities.

15 . The system of claim 14 , wherein the NIC or the host computer is to:

based on the counts of hardware-related activities, associate at least a portion of the counts of hardware-related activities of the NIC with a process of the plurality of processes; and

determine whether or not the respective process is executing the network attack based on the counts of hardware-related activities associated with the respective process.

16 . The system of claim 14 , wherein if the NIC or the host computer determines that a process is executing a network attack, the NIC or the host computer to transmit information concerning the respective process to an authorized entity.

17 . The system of claim 14 , wherein if the NIC or the host computer determines that a process is executing a network attack, the NIC or the host computer to terminate the respective process.

18 . The method of claim 7 , comprising:

causing a virtual machine of the plurality of virtual machines to execute a network attack on the processor;

obtaining training data from the hardware counters, the data comprising counts of hardware-related activities;

generating an input vector based on the training data and a label indicating which of the plurality of virtual machines is executing the network attack and which is not; and

using the input vector to train the machine learning algorithm.