1. A method for detecting an anomalous operation of a computer system, comprising: (a) monitoring transitions between and among program instrumentation points within an internal operating environment on the computer system and producing program execution trace data; (b) comparing the program execution trace data with data indicative of a nominal operation of the computer system; and (c) identifying an anomalous operation of the computer system based on the result of the comparison.