Threat Detection System

A computer system comprising:

• a memory configured to store computer program code, and
• a processor configured to read and execute computer program code stored in the memory,
• wherein the processor is configured to cause the computer system to perform:
• a) monitoring installation and operation of multiple different versions of the same application in a computer system;
• b) analysing evolutionary changes between the behaviours of the different versions of the same application;
• c) detecting and monitoring a new version of the same application in a computer system;
• d) monitoring the behavior of the computer system to detect one or more procedures of the monitored application that do not match expected behaviors of the monitored application on the basis of the analysis;
• and
• e) upon detection of one or more procedures not matching the expected behaviors of the monitored application, identifying the monitored application as malicious or suspicious.