1. A computer-implemented method comprising: extracting a model of a computer application during load time; storing the model of the computer application; inserting instructions into the computer application to collect data at runtime; analyzing the data collected at runtime against the stored model of the computer application to detect one or more security events; and tracking the one or more security events using a state machine.