1. A method of analyzing a software application operating in a processor of a computing device, the method comprising: monitoring in the processor activities of the software application by collecting behavior information from a log of actions stored in a memory of the computing device; generating a behavior vector that characterizes the monitored activities of the software application based on the collected behavior information; and determining whether the generated behavior vector includes a distinguishing behavior identifying the software application as being from a known vendor.