Patent attributes
A method is described that includes operations for receiving an application, identifying a region of interest of the application based on rules or analysis of the application, and determining specific stimuli that will cause one or more state transitions within the application to reach the region of interest. Thereafter, the stimuli is applied to the application. One or more behaviors of the application are monitored by a central intelligence engine during virtual execution of the application in response to the applied stimuli to determine whether the one or more behaviors identify that the region of interest corresponds to improperly behaving code.