1. A non-transitory machine readable medium on which instructions for detecting computing application malfunctions are stored, comprising instructions that when executed by a machine, cause the machine to: receive an event trace of a computing application, the event trace comprising a plurality of computing events and a plurality of memory addresses respectively associated with the plurality of computing events; construct at least one sample fingerprint associated with the computing application by grouping the plurality of computing events and the respective plurality of memory addresses according to different memory address ranges and tracking locality of code execution over time, the tracking based on the grouping; generate a deviation score by comparing the at least one sample fingerprint with at least one fingerprint reference stored in a storage device, wherein the at least one fingerprint reference represents an expected execution behavior of the computing application; determine whether the deviation score satisfies a deviation criteria; and trigger an in-depth application analysis of the computing application to determine whether the plurality of computing events indicate a computing application malfunction, responsive to a determination that the deviation score satisfies the deviation criteria.