1. One or more non-transitory machine readable media that includes code for execution and when executed by one or more processors is operable to perform operations comprising: intercepting, on a computing device, an application programming interface (API) associated with a network access attempt; determining a process mapped to the API; determining a plurality of software program files mapped to the process; determining a trust status of each software program file of the plurality of software program files; determining whether the network access attempt is permitted based, at least in part, on a first criterion, wherein the first criterion includes a trust status of each software program file of the plurality of software program files; and performing an action if the network access attempt is not permitted.