MALICIOUS BEHAVIOR DETECTION AND MITIGATION IN A DOCUMENT EXECUTION ENVIRONMENT

A document execution engine that receives a document for execution within a document execution environment. The document execution engine may also detect activity within the document execution environment associated with the received document, and apply the trained machine learned model to the detected activity to determine if the detected activity is representative of malicious behavior and, in response to determining that the detected activity is representative of malicious behavior, to identify remedial actions that can mitigate the malicious behavior. The document execution engine may also provide, to a device of a user, a recommendation to perform the identified remedial actions.