1. A method for detecting anomalous program executions, comprising: executing at least a part of a program in an emulator; comparing a function call made in the emulator to a model of function calls for the at least a part of the program; identifying the function call as anomalous based on the comparison; and upon identifying the anomalous function call, notifying an application community that includes a plurality of computers of the anomalous function call.