1. A method of detecting malware present on a computer system, the method comprising: a) predefining a set of applications as benign; b) providing profiles for respective benign applications, each profile identifying one or more procedures known to be performed by the associated benign application, each procedure being identified by a characteristic action and one or more expected actions; c) monitoring behaviour of the computer system when a benign application appears to be running; d) maintaining a log of actions; e) detecting performance, by the running application, of a characteristic action of a procedure defined for the benign application; f) upon detection of performance of a characteristic action, using the profile provided for the associated benign application, and said log of actions, to detect a previous deviation from the expected actions of the procedure; and g) using the detection of a deviation to identify the running application as a modified version of a benign application or an application masquerading as a benign application and therefore as being malicious or suspicious.