1. A computer program product embodied in a computer readable medium that, when executing on one or more computers, performs the steps of: A) monitoring an executing computer process for an indication of malicious behavior, wherein the indication of the malicious behavior is a result of comparing an operation with a predetermined behavior, referred to as a gene, where the gene is stored for reference in a database; B) performing step A) a number of times to collect a plurality of malicious behavior indications; C) comparing the plurality of malicious behavior indications to a predetermined collection of malicious behaviors, referred to as a phenotype, which comprises a grouping of specific genes that are typically present in a type of malicious code; and D) causing an action based on a prediction that the executing computer process is the type of malicious code as indicated by the phenotype.