1. A system comprising: a device that includes at least one processor, the device including a virtualization detection engine comprising instructions tangibly embodied on a computer readable storage medium for execution by the at least one processor, the virtualization detection engine including: an environment state determination component configured to: obtain a baseline set of graph information associated with a predefined execution environment of a program, the baseline set associated with a baseline time interval, the predefined execution environment including predefined environment objects, at least a portion of the predefined environment objects being dynamically mutatable, and obtain a second set of graph information associated with the predefined execution environment, the second set associated with a second time interval that is later in time than the baseline time interval; and an environment state comparison component configured to compare the baseline set and the second set to detect virtualization activity associated with a dynamic runtime.