1. A method of analyzing a software application operating on a computing device, the method comprising: monitoring in a processor of the computing device activities of the software application by collecting behavior information from a log of actions stored in a memory of the computing device; generating a behavior vector that characterizes the monitored activities of the software application based on the collected behavior information; and determining whether the generated behavior vector includes a distinguishing behavior caused by a performance of a special operation by the software application in the computing device that identifies the software application to the computing device as being from a known vendor.