1. A method of detecting malware present on a computer system, the method comprising: a) predefining a set of applications as benign; b) providing profiles for respective benign applications, each profile identifying one or more procedures known to be performed by the associated benign application, each procedure being identified by a characteristic action and one or more expected actions; c) monitoring behaviour of the computer system to detect performance, by a running application, of a characteristic action of a procedure of a benign application; d) upon detection of performance of a characteristic action, using the profile provided for the associated benign application to detect a deviation from the expected actions of the procedure; and e) using the detection of a deviation to identify the running application as malicious or suspicious.