1. A method, comprising: accessing stored virtual machine snapshots, the virtual machine snapshots having been captured from one or more executing virtual machines; and automatically forming a pool of features comprised of features obtained from the accessed virtual machine snapshots; and performing automated analysis on the pool of features to identify one or more traits of one or more of the virtual machine snapshots.