1. A method, comprising: classifying a file based at least in part on one or more behaviors associated with an execution of the file; and generating a malware signature corresponding to the file based at least in part on the classification.