A baseline set of graph information associated with a predefined execution environment of a program may be obtained, the baseline set associated with a baseline time interval. The predefined execution environment includes predefined environment objects, at least a portion of which are dynamically mutatable. A second set of graph information associated with the predefined execution environment may be obtained, the second set associated with a second time interval that is later in time than the baseline time interval. The baseline set and the second set may be compared to detect virtualization activity associated with a dynamic runtime.