How AppDefense works to detect app and VM anomalies