1. A computer-implemented method comprising: extracting a model of a computer application during load time, the extracting includes: identifying address transitions that map instruction addresses to respective target addresses, and adding an identified address transition to the model when a respective target address is indeterminable and adding the respective target address to the model when the respective target address is determinable; storing the model of the computer application; inserting one or more collection instructions into the computer application, including at the instruction addresses and respective determinable target addresses in the extracted model, to collect data at runtime; analyzing the data collected at runtime against the stored model of the computer application, including address transitions and target addresses, to detect one or more security events; and tracking the one or more security events using a state machine, the tracking automatically detecting a security attack of the computer application.