Patent US 11,625,318

A method including performing tests for a computer software that emulate user or application behavior when using the computer software, detecting a first set of resource properties when performing the tests on the computer software, identifying behavior patterns based on a series the event records created from the resource properties detected when running the tests, detecting a second set of properties of resources running the computer software following release of the computer software, comparing the behavior patterns extracted from the tests with a second behavior pattern extracted from real-life operation after release of the computer software, detecting normal software behavior and unnormal software behavior based on the differences between the behavior patterns extracted from the tests and second behavior pattern.