Detecting operation of a virtual machine (US patent 9384034)