1. A method of determining that protected software is running in a virtualized environment, comprising the following actions performed by a processing device: a. obtaining a set of baseline measurements of system call timings for the protected software in native operating system environments with a mix of system loads; b. establishing statistical thresholds based on the baseline measurements such that there is a predetermined probability that protected software running in a native environment will experience system call durations that exceed the thresholds; c. analyzing the protected software with respect to the established statistical thresholds, to provide a threshold analysis; d. incorporating instructions within the protected software such that particular system calls, demonstrated to be differentiating using the set of baseline measurements and the threshold analysis, are executed during the normal running of the protected software; e. using the incorporated instructions to estimate the parameter values that are to be compared with the established statistical thresholds; f. executing repeated comparisons of the estimates obtained during the normal running of the protected software; and g. determining whether the protected software is running in a virtualized environment, based on results of the repeated comparisons.