Determining the maliciousness of executable files using a remote sandbox environment

A non-transitory computer-readable medium comprising instructions that, when executed by a processor, cause the processor to:

• receive, at a behavior analysis engine, an executable file from a network traffic hub in a local network as the executable file is being downloaded by a networked device in the local network;
• execute the executable file in a sandbox environment operated by the behavior analysis engine and configured to replicate an operating system running by the networked device that is downloading the executable file and to execute the executable file as the networked device would execute the executable file;
• extract execution features from the execution of the executable file, the execution features corresponding to characteristics of the execution of the executable file;
• apply an execution model to the extracted execution features, the execution model to determine whether an executable file is malicious based on execution features of the executable file and
• transmit processing instructions to the network traffic hub based on the determination of whether the execution file is malicious.