A method, system, and computer program product, include extracting information related to one or more processes of one or more applications running on a virtual machine from a memory of the virtual machine, building at least one first application signature based on the extracted information, and identifying the one or more applications running on the virtual machine by matching the at least one first application signature with one or more second application signatures previously stored.