The invention relates to a method for detecting attacks on at least one virtual machine in a system including at least one host server (10) hosting a set of virtual machines (VM1, VM2, VM3, etc.), the method including the steps of: receiving (E2) an alert indicating a breakdown in performance in a virtual machine; verifying (E3) that a mechanism for managing resource contention has been implemented for the virtual machine; detecting (E5), over a given time interval, at least one time correlation between the breakdown in performance that occurred in the virtual machine and a variation in the use of at least one resource of the host server by at least one other virtual machine, data representing the use of resources being collected at regular intervals.