1. A method for detecting an attack on an application, comprising: performing, using a digital processing device, a static analysis by comparing at least part of a document to a first detection model; determining, using the digital processing device, whether attacking code is included in the document based on the comparison of the document to the first detection model; executing, using the digital processing device, at least part of the document; determining, using the digital processing device, whether attacking code is included in the document based on the execution of the at least part of the document by performing a dynamic analysis that includes comparing behavior observed by execution of the document to a second detection model; and if attacking code is determined to be included in the document based on at least one of the comparison of the document to the first detection model and the execution of the at least part of the document, reporting the presence of an attack.