Computing device application program behavior profile

A non-transitory computer-readable data storage medium storing computer executable code performable by a computing device to perform a method comprising:

• after first installation of an application program on the computing device, monitoring a behavior of the application program during execution of the application program for a specified period of time, the period of time expiring at least after execution of a plurality actions of the application program;
• constructing a behavior profile of the application program based on the behavior that has been monitored while executing the plurality of actions during the specified period of time;
• after expiration of the period of time, comparing behavior of the application program during execution of an additional action by the application program with execution behavior of the application program in the behavior profile;
• and
• in response to determining that execution behavior of the additional action of the application program is attempting to deviate from execution behavior of the behavior profile, preventing the application program from engaging in behavior that deviates from the behavior profile.

A computing device comprising:

• hardware resources, including a processor;
• and
• a non-transitory computer-readable data storage medium storing computer-executable code that is executable by the processor to:
• after first installation of an application program on the computing device, monitor a behavior of the application program during execution of the application program for at least execution of a plurality actions of the application program;
• after an update and/or patch of the application program has been applied or installed, construct a behavior profile of the application program from the behavior that has been monitored until the update or patch was applied or installed, the behavior profile comprising behavior of the application program while executing the plurality of actions;
• and
• after the behavior profile has been constructed, in response to determining that the behavior during execution of an additional action of the application program after the update or patch has been applied and/or installed deviates from the behavior profile, perform an action with respect to the application program.