1. A method for detecting anomalous program executions, comprising: executing at least a portion of a program in an emulator; comparing a function call made in the emulator to a model of function calls for the at least a portion of the program, wherein the model is a combined model created from at least two models created at different times; and identifying the function call as anomalous based on the comparison.