1. A system, comprising: one or more memory locations configured to store applications executing on a host with a host operating system; one or more interceptors configured to intercept calls to the host operating system, and configured to generate one or more statistical events based on said intercepted calls; a statistical fault detector configured to calculate one or more distributions for said one or more statistical events and configured to maintain a hierarchy of events and event groups; wherein fault detection for said applications is performed by detection of statistically significant deviation of recent events from the corresponding one or more distributions; and wherein said one or more statistical events and hierarchy of event groups is traversed from individual events to said event groups, and wherein faults are detected with a most-specific fault detector first.