A method of analyzing the behavior of a computer program, the computer program being executable in an operating system by processing means of a computing device, wherein the execution of predetermined parts of the computer program is triggered by events of at least one interface of the computer program, and leads the computer program to request access to computing resources, which are accessible by said computing device, the method comprising the steps of: a) executing the computer program by processing means of a computing device; b) using said processing means to automatically generate a plurality of events of said at least one interface; characterized by the further steps: c) identifying for each generated event, using said processing means, to which computing resources the computer program requests access as a consequence of the event; d) storing, for each event, a description of the identified computing resources in a memory element, thereby associating the identified computing resources with the event; e) providing an input to the computer program on at least one interface thereof, which results in an event triggering the execution of a predetermined part of the computer program; f) identifying, for said event, using said processing means, the computing resources to which the computer program requests access as a consequence of the event; g) comparing a description of the identified computing resources to all of the descriptions of computing resources associated with said event in said memory element; h) if an associated description, which at least partially matches the description of the identified computing resources, is found in said memory element, concluding that the computer program exhibits a first behavior; i) if no such associated description is found, concluding that the computer program exhibits a second behavior, which is different from said first behavior. a) executing the computer program by processing means of a computing device; b) using said processing means to automatically generate a plurality of events of said at least one interface; c) identifying for each generated event, using said processing means, to which computing resources the computer program requests access as a consequence of the event; d) storing, for each event, a description of the identified computing resources in a memory element, thereby associating the identified computing resources with the event; e) providing an input to the computer program on at least one interface thereof, which results in an event triggering the execution of a predetermined part of the computer program; f) identifying, for said event, using said processing means, the computing resources to which the computer program requests access as a consequence of the event; g) comparing a description of the identified computing resources to all of the descriptions of computing resources associated with said event in said memory element; h) if an associated description, which at least partially matches the description of the identified computing resources, is found in said memory element, concluding that the computer program exhibits a first behavior; i) if no such associated description is found, concluding that the computer program exhibits a second behavior, which is different from said first behavior.