1. A computer-implemented method comprising: monitoring a process of an application program running in a computer; collecting a plurality of read files read by the process; collecting a plurality of write files written by the process; generating fingerprints of the plurality of read files to generate a plurality of read fingerprints; generating fingerprints of the plurality of write files to generate a plurality of write fingerprints; determining a similarity between the plurality of read files and the plurality of write files by comparing the plurality of read fingerprints and the plurality of write fingerprints; and determining if the application program is an obfuscation tool that is either an encryption or compression application based on the similarity.