Systems and methods for categorizing virtual-machine-aware applications for further analysis

Abstract

The disclosed computer-implemented method for categorizing virtual-machine-aware applications for further analysis may include (1) identifying a plurality of virtual-machine-aware applications, where each of the plurality of virtual-machine-aware applications exhibits different behavior when the virtual-machine-aware application detects that the virtual-machine-aware application is executing in a physical computing environment rather than in a virtual computing environment, (2) identifying a plurality of non-virtual-machine-aware applications that do not exhibit different behavior when executed in the physical computing environment rather than in the virtual computing environment, (3) determining at least one characteristic that differentiates the virtual-machine-aware applications from the non-virtual-machine-aware applications, (4) analyzing an uncategorized application to determine whether the uncategorized application includes the characteristic, and (5) preventing the uncategorized application from evading complete analysis by sending the uncategorized application to the physical computing environment for further analysis. Various other methods, systems, and computer-readable media are also disclosed.