1. A method of protecting machine readable media from unauthorized storage or copying, comprising: sending a detector to a client process; receiving a response to the detector from the client process; detecting a presence of an unauthorized software behavior on the client based upon the response and a matching rule that is associated with the detector sent; and updating a database of detectors for a previously unseen and unauthorized behavior of the process such that the database of detectors evolves over time.