According to one embodiment, a method comprises receiving a first portion of network traffic by a virtual machine that is configured to simulate operations of a destination device. Thereafter, one or more anomalous behaviors are observed as the virtual machine processing the first portion of the network traffic. The one or more anomalous behaviors include an unexpected behavior of the virtual machine while the first portion of the network traffic is being processed. As a result, a signature that is associated with the one or more anomalous behaviors is generated for detection of a presence of malicious code within the network traffic.