1. A method of linking a security policy stored in a policy database and which is specific to an application in the application layer with a new corresponding process launched in the Linux layer in a security system for an operating system running on a device that comprises a Linux-based kernel, and a system architecture defined by a middleware layer between the Linux layer associated with the kernel and the higher application layer comprising the applications, the method comprising: monitoring the specialization process in the Linux layer of the new process as it specializes as its intended application; extracting application identification data from the specialization process that is indicative of the application or type of application the target process is specializing as; and creating a link between the new process and a security policy from the policy database based on the application identification data.