13. A method of using information on malicious application behaviors in a device, the method comprising: receiving, by the device from another device, data that contains a document in a formal language specifying monitored application capabilities and monitored application behaviors of a malicious application; extracting, by the device, information on at least one of the application capabilities and the application behaviors by parsing the received data; and controlling, by the device, execution of the malicious application according to the extracted information, wherein the monitored application capabilities and the monitored application behaviors are determined at runtime of the malicious application.
13. A method of using information on malicious application behaviors in a device, the method comprising: receiving, by the device from another device, data that contains a document in a formal language specifying monitored application capabilities and monitored application behaviors of a malicious application; extracting, by the device, information on at least one of the application capabilities and the application behaviors by parsing the received data; and controlling, by the device, execution of the malicious application according to the extracted information, wherein the monitored application capabilities and the monitored application behaviors are determined at runtime of the malicious application. 19. The method of claim 13 , wherein: the extracting comprises parsing the received data and storing the parsed data in a policy table or a policy database; and the controlling comprises stopping execution of the application when content of the policy table or the policy database is different as a result of the parsing and the storing.