Technologies are directed to a detector to identify a side channel attack between virtual machines. According to some examples, an inter-processor interrupt (IPI) rate of a first virtual machine (VM), a time stamp counter (TSC) rate of a second VM, and a cache miss ratio (CMR) of a third VM may be monitored. A side channel attack may then be detected based on the IPI rate, the TSC rate, and the CMR.