1. A system, comprising: one or more memory locations configured to store applications configured to execute on a host with a host operating system; one or more interceptors configured to intercept calls to the host operating system, and configured to generate one or more statistical events based on said intercepted calls; a statistical fault detector configured to determine one or more distributions for said one or more statistical events and configured to maintain a hierarchy of events and event groups; wherein fault detection for said applications is performed by detection of statistically significant deviation of recent events from the corresponding one or more distributions; and wherein faults are detected with a most-specific fault detector first.