1. A method for detecting malicious network content, comprising: inspecting one or more packets of network content; identifying a suspicious characteristic of the network content; determining a score related to a probability that the network content includes malicious network content based on at least the suspicious characteristic; identifying the network content as suspicious if the score satisfies a threshold value; executing a virtual machine to process the suspicious network content; and analyzing a response of the virtual machine to detect malicious network content.