1. A method for protecting software, the method comprising: executing protected software on a computer; running a protective software framework on the computer, the protective software framework monitoring the protected software while the protected software is executing on the computer, the protective software framework enforcing a security policy; detecting, by the protective software framework, a security event caused by the protected software, the security event being a violation of the security policy; determining whether the security event is a learned event or an unlearned event, a learned event being a security event that has previously been recorded by the protective software framework when the protective software framework ran in a passive state; allowing the protected software to continue running when the security event is determined to be a learned event; and when the security event is determined to be an unlearned event and the protective software framework is in an active state, performing one of killing at least one thread of the protected software which caused the security event, killing a process of the protected software which caused the security event, or throwing an exception.