Performing threat detection by synergistically combining results of static file analysis and behavior analysis

A non-transitory computer-readable storage medium embodying a set of instructions, which when executed by one or more processing resources associated with a network security platform protecting a private network, causes the one or more processing resources to perform a method comprising:

• maintaining, by the network security platform, information regarding a static analysis threshold and a mapping of each of a plurality of behaviors to corresponding weighting factors, wherein the network security platform includes an endpoint security solution, wherein the static analysis threshold specifies a threshold for a particular process to be considered malicious when compared to a particular score assigned to the particular process as a result of performing static file analysis on one or more files associated with the particular process, and wherein the weighting factors are indicative of a significance of the corresponding behavior of the plurality of behaviors to an inference of malicious intent;
• responsive to an attempt to execute a process on an endpoint device and prior to permitting execution of the process on the endpoint device, generating a static analysis score by performing, by the endpoint security solution running on the endpoint device, a static file analysis on one or more files associated with the process;
• when the static analysis score meets or exceeds the static analysis threshold, then treating the process as malicious and blocking execution of the process;
• when the static analysis score is less than the static analysis threshold, then
• obtaining a dynamic analysis score for the process;
• and
• treating the process as malicious and causing execution of the process to be blocked based on a function of the static analysis score and the dynamic analysis score.