19. The non-transitory computer-readable medium of claim 18 , wherein the one or more computer-readable instructions further cause the computing device to determine the program is malware based on the classification of the program.
18. A non-transitory computer-readable medium comprising one or more computer-readable instructions that, when executed by at least one processor of a computing device, cause the computing device to: identify a behavioral trace of a program, the behavioral trace comprising a sequence of runtime behaviors exhibited by the program; divide the behavioral trace to identify a plurality of n-grams within the behavioral trace, each runtime behavior within the sequence of runtime behaviors corresponding to an n-gram token; analyze the plurality of n-grams to generate a feature vector of the behavioral trace comprising; applying, for each given n-gram in the plurality of n-grams, a feature function to the behavioral trace that describes an occurrence characteristic of the given n-gram within the behavioral trace; including a result of the feature function in the feature vector; and classifying the program based at least in part on the feature vector of the behavioral trace to determine whether the program is malicious wherein: the feature vector comprises a plurality of dimensions, each n-gram within the plurality of n-grams corresponding to a dimension within the plurality of dimensions; the plurality of n-grams map to the plurality of dimensions according to a non-injective surjection; and including the result of the feature function in the feature vector comprises aggregating a subset of outputs of the feature function derived from a subset of the plurality of n-grams into a value and assigning the value to a dimension within the plurality of dimensions according to the non-injective surjection.