1. A computer implemented method of identifying unauthorized activities on a computer system attached to a computer network, wherein the system comprises: one or more processors; and memory storing: a virtual machine; and a virtual machine monitor supervising the virtual machine, the method comprising, at the virtual machine monitor: monitoring activity on the virtual machine; identifying a plurality of activities being performed at the virtual machine, wherein each of the activities includes an activity source, an activity target, and an association between the activity source and the activity target; storing in the memory the activity sources, activity targets, and associations; and transmitting one or more of the activity sources, activity targets, and associations to prevent future attacks.