Systems and methods for behavioral sandboxing

A system comprising:

• a computer communicatively coupled to a network, the network comprising a source of an executable application, wherein the computer comprises:
• a behavioral analysis module configured to perform behavioral analysis on the executable application downloaded from the network;
• and
• a plurality of execution environments including,
• a standard execution environment;
• and
• a protected execution environment configured to provide a self-contained execution environment that protects the computer from malicious operations performed by the executable application;
• wherein the behavioral analysis module is to evaluate a plurality of behavioral characteristics of the executable application prior to performing a first load for execution of the executable application, the evaluation to determine whether the executable application should be executed within the protected execution environment;
• and
• wherein the behavioral analysis module is to monitor execution of the executable application to determine whether the execution of the executable application should be moved from the standard execution environment to the protected execution environment or from the protected execution environment to the standard execution environment, the move to occur while the executable application is still executing in response to the first load for execution.

A non-transitory computer-readable storage medium comprising instructions stored thereon to cause one or more processors to:

• receive a executable application over a network connection;
• perform behavioral analysis, prior to execution of the executable application, on the executable application;
• determine, based on the performing behavioral analysis, whether to perform a first load for execution of the executable application in a sandbox environment;
• perform the first load for execution of the executable application within the sandbox environment;
• dynamically monitor behavioral characteristics of the executable application during the execution within the sandbox environment, the execution initiated in response to the first load;
• perform behavioral analysis on the monitored behavioral characteristics to determine whether the executable application can be moved from the sandbox environment;
• and
• move, based on the behavioral analysis of the monitored behavioral characteristics, the executable application from the sandbox environment to a standard environment prior to termination of the execution initiated by the first load.