1. A method, comprising: identifying execution of an interface, including identifying that a code segment internal to the interface has been executed; in response to the execution of the interface, determining whether the interface was executed as a result of executing a defined entry point of the interface; and determining whether the execution is malicious based upon whether the entry point was invoked prior to execution of the code segment; wherein the entry point is located logically before the code segment.