US Patent 9917855 Mixed analysys-based virtual machine sandbox

A sandbox system includes a mixed analysis engine that allows for dynamic and static analysis of a sample process for malware. The sample process is executed in a virtual machine and interrupted to allow the mixed analysis engine to identify functions that are called by malware to perform a malicious behavior. The functions are correlated to identify a behavior node that is indicative of the malicious behavior, and behavior nodes are correlated to identify a behavior net. The behavior net is scored to determine if the sample process is malware.