1. A system comprising: a device that includes at least one processor, and a computer readable storage medium storing instructions for execution by the at least one processor, for implementing a virtualization detection engine that: obtains a baseline set of graph information associated with a predefined execution environment of a program, the baseline set associated with a baseline time interval, the predefined execution environment including predefined environment objects, at least a portion of the predefined environment objects being dynamically mutatable; obtains a second set of graph information associated with the predefined execution environment, the second set associated with a second time interval that is later in time than the baseline time interval; initiates storage of the baseline set of graph information in a private storage location that is privately available to the predefined execution environment; and detects virtualization activity associated with a dynamic runtime by comparing the baseline set and the second set.