1. A system, comprising: a processor configured to: analyze captured network traffic attributable to execution of a candidate malware application in a virtual machine; compare a representation of previously captured network traffic attributable to one or more benign applications executing to one or more results of analysis of the captured network traffic attributable to the execution of the candidate malware application; determine that the candidate malware application is malicious based at least in part on the comparison; and provide the determination as output; and a memory coupled to the processor and configured to provide the processor with instructions.