1. A method for detecting malicious program behavior, the method comprising: emulating at least a part of a computer program in an isolated computing environment, detecting events being generated by one or more executable components of the emulated computer program; determining, substantially in real time, whether one or more detected events are associated with a malicious program behavior; storing in a data structure only detected events associated with the malicious program behavior; and comparing events stored in the data structure for the emulated computer program with one or more event patterns associated with the malicious program behaviors to detect malicious program behavior of the emulated computer program.