1. A computer-implemented method for behavior based analysis comprising: generating trace data associated with execution of a process, wherein generating trace data comprises using user level hooks to monitor execution of a suspected malware program in a safe environment; preprocessing the trace data to provide consistent context indicators for analysis of the trace data analyzing, using at least one computer processor, observable events via the trace data to identify a plurality of low level actions; analyzing the plurality of low level actions to identify at least one high level behavior; and providing an output of the at least one high level behavior.