Unobservable intrusion detection based on call traces in paravirtualized systems