The stable operation of virtual machine is an important support of cloud service. Because of the tremendous amount of virtual machine and their changing status, it is hard for management system to train classifier for each virtual machine individually. In order to improve the performance of real-time performance and detection ability, a new dividing mechanism based on modified k-medoids clustering algorithm for dividing virtual machine detection region was proposed, the iterate process of clustering was optimized to improve the speed of dividing detection region, and the efficiency and accuracy of anomaly detection were enhanced consequently by using this proposed detecting region strategy. Experiments and analysis show that the modified clustering algorithm has lower time complixity, the detection method with dividing detection region performs better than the original algorithm in efficiency and accuracy.