1. A method for detecting an anomaly in a computer that is part of a population of networked computers, the method comprising: receiving snapshots from a plurality of computers within the population of computers, wherein individual snapshots include a state of assets and runtime processes of a respective computer; generating an asset normalization model from the snapshots that serves as a baseline model for detecting an anomaly in the state of assets and runtime processes of a respective computer, wherein detecting an anomaly comprises detecting a behavioral anomaly comprising one or more of changes in code, changes in execution stack and changes in thread execution; and comparing a snapshot from at least one of the computers to the asset normalization model to determine whether an anomaly is present in a state of static assets and runtime processes of the at least one of the computers.