1. An apparatus comprising: a pattern recognizer, at least partially implemented in one or more of configurable logic or fixed-functionality hardware logic, to identify a runtime behavioral pattern of an application, wherein the pattern recognizer includes a phase detector to identify one or more phases in the runtime behavioral pattern based on one or more of source markers, historical data or a search heuristic; an anomaly detector, at least partially implemented in one or more of configurable logic or fixed-functionality hardware logic, coupled to the pattern recognizer, the anomaly detector to detect an anomaly in the runtime behavioral pattern, wherein the anomaly detector includes: a control collector to obtain control phase data from the application, an anomaly collector to obtain current phase data from the application, and a comparator to compare the current phase data to the control phase data to detect the anomaly, wherein the anomaly is to be detected with regard to one or more of a library call count, a library call type, a library call argument configuration or a library call timing associated with a runtime operation of the application; and a security component, at least partially implemented in one or more of configurable logic or fixed-functionality hardware logic, coupled to the anomaly detector, the security component to trigger a security event in response to the anomaly, wherein the control phase data and the current phase data are to be obtained via function interposition, and the current phase data is compared to the control phase data after a determination is made that a current phase has ended or a new phase has started, and wherein the comparison is based at least on the library call timing.