1. At least one non-transitory computer readable storage medium comprising a set of instructions which, when executed by a computing device, cause the computing device to: interpose one or more functions in response to a control library call from an application to obtain control data from the application; identify a runtime behavioral pattern of the application based at least on the control data; interpose one or more functions in response to a current library call from the application to obtain current data from the application; detect an anomaly in the runtime behavioral pattern, wherein the current data is to be compared to the runtime behavioral pattern to detect the anomaly, and wherein the anomaly is to be indicative of an insertion of malicious code, and is to be detected with regard to one or more of a library call count, a library call type, a library call argument configuration or a library call timing associated with a runtime operation of the application; and trigger a security event in response to the anomaly.