1. A security device, comprising: one or more processors to: receive actual behavior information associated with an object, the actual behavior information identifying a first set of behaviors associated with executing the object in a live environment; determine test behavior information associated with the object, the test behavior information identifying a second set of behaviors associated with testing the object in a test environment; compare the first set of behaviors and the second set of behaviors to determine a difference between the first set of behaviors and the second set of behaviors; identify whether the object is an evasive malicious object based on the difference between the first set of behaviors and the second set of behaviors; and provide an indication of whether the object is an evasive malicious object.