1. A device for using information on malicious application behaviors, the device comprising: a capability-monitoring unit that monitors application capabilities; a behavior-monitoring unit that monitors application behaviors; an mBDL-generating unit that generates a document in a formal language specifying the application capabilities and the application behaviors; and a controlling unit that controls execution of an application using the formal language.