1. A system, comprising: a processor; and a memory coupled to the processor, wherein the memory comprises instructions which, when executed by the processor, cause the processor to: receive an application to be tested, a set of intrusive monitoring capabilities, and a set of external monitoring capabilities; execute the application in a clean environment to generate unmonitored application behavior of the application; execute the application with intrusive monitoring using one or more of the set of intrusive monitoring capabilities based on two randomly generated seeds to generate trigger events, wherein a trigger time of the intrusive monitoring is based on a first random seed and a monitoring type of the intrusive monitoring is based on a second random seed; execute external monitoring using one or more of the set of external monitoring capabilities to detect changes in application behavior of the application in response to executing the intrusive monitoring, wherein the detected changes in the application behavior of the application comprise a detected difference between the unmonitored behavior of the application and the application behavior of the application after the intrusive monitoring is executed; compute a correlation measure between the trigger events and the detected changes in the application behavior of the application; and responsive to the correlation measure exceeding a threshold correlation value, modify the application by removing one or more blocks of code of the application associated with the detected difference between the unmonitored behavior of the application and application behavior of the application after intrusive monitoring is executed.