We collect data for selected processor and disk I/O events for the entire VM from the host machine and use a machine learning (ML) classifier to develop a detection model. This approach avoids the ...