18. The at least one computer-readable memory of claim 16 , wherein the recognition information comprising at least one of a process name, a thread starting function, at least one function on a stack, a start and end indicators that define an operation of an application, and at least one file name.
16. At least one computer-readable memory encoded with computer-executable instructions that, when executed by at least one processor, implement a method for defining at least one behavior descriptor, the method comprising: receiving first user input specifying recognition information on the at least one behavior descriptor, the recognition information defining characteristics of a trace; receiving second user input specifying identification information on the at least one behavior descriptor, the identification information identifying information on an event indicative of a match between the at least one behavior descriptor and the trace; and generating a behavior descriptor based on the first and second user inputs.