System and method for threat detection and identification

A digital device for detecting malware, comprising:

• one or more processors;
• and
• a memory communicatively coupled to the one or more processors, the memory comprises software that, when executed by the one or more processors, performs operations including
• determining whether data received by the digital device is suspicious resulting from an analysis of the received data, the analysis of the received data is based upon a plurality of policies selected to identify whether the received data is suspicious that represents a first likelihood that the received data is associated with malware,
• responsive to the received data being determined to be suspicious, executing the received data within a virtual machine,
• monitoring information during the execution of the received data within the virtual machine, the monitored information includes information produced by the virtual machine during the execution of the received data,
• determining whether the information produced by the virtual machine during the execution of the received data constitutes an unauthorized activity, the unauthorized activity representing a second likelihood that the received data is associated with malware and the second likelihood is greater than the first likelihood, and
• generating data for use in subsequent detection of malware within data provided to the digital device for analysis.