1. A method for analysing system behavior comprising the steps of: storing a set of predetermined system behaviors as respective records of traces relating to system execution; recording, during system execution, actual system behavior as a record of traces of system execution; and determining one or more differences between the recorded system behavior and at least one predetermined system behavior.