1. An apparatus comprising: a pattern recognizer to identify a runtime behavioral pattern of an application, wherein the pattern recognizer includes a phase detector to identify one or more phases in the runtime behavioral pattern based on one or more of source markers, historical data or a search heuristic; an anomaly detector coupled to the pattern recognizer, the anomaly detector to detect an anomaly in the runtime behavioral pattern, wherein the anomaly detector includes: a control collector to obtain control phase data from the application, an anomaly collector to obtain current phase data from the application, and a comparator to compare the current phase data to the control phase data to detect the anomaly, wherein the anomaly is to be detected with regard to one or more of a library call count, a library call type, a library call argument configuration or a library call timing associated with a runtime operation of the application; and a security component coupled to the anomaly detector, the security component to trigger a security event in response to the anomaly.