1. A computer-implemented method comprising: executing a plurality of virtual machines on a physical machine, wherein each virtual machine comprises a hardware virtualization of a data processing apparatus; monitoring read access of a clock by a first one of the virtual machines, wherein the clock is associated with the physical machine; determining, based on the monitored read access of the clock, a rate of clock read accesses by the first virtual machine; determining that the first virtual machine is executing a malicious process based on a determination that the rate of clock read accesses by the virtual machine is greater than a predefined threshold rate of read access; limiting read access to the clock by the first virtual machine based at least in part on the determination that the first virtual machine is executing the malicious process; and migrating a second one of virtual machines to a different physical machine in response to the determining.