1. A computer-enabled method of learning behavior of a program, comprising: (a) using a processor to execute a target program during a learning interval while varying a plurality of stimuli provided to the target program, the stimuli affecting execution of the target program, so as to produce a multiplicity of different sequences of events, the event sequences differing in combinations of types of events in respective sequences, orders in which the types of events occur in respective sequences, or in the combinations and in the orders in which the types of events occur; (b) recording the multiplicity of event sequences; and (c) executing a second program by a processor to: (i) determine a plurality of clusters based on similarities between the recorded event sequences in their entirety; and (ii) determine a plurality of signatures corresponding to the plurality of clusters, each signature being a sequence of events representative of a respective cluster, wherein each of the plurality of signatures is a benchmark representative of acceptable behavior of the target program.