A method for protecting a computer system from software vulnerabilities, the method comprising: detecting, by a processor of the computer system, execution of a software application; determining whether the detected application includes one or more vulnerabilities associated with one or more errors in the application; performing a process of at least the following three stages for protecting the computer system from the one ore more software vulnerabilities: in a first stage, compiling a first list of typical actions performed by the application based on response information collected from a query sent to a plurality of external information sources, including at least a remote antivirus server, wherein if an action was not discovered from all external information sources, then the action is not added to the first list of typical actions; in a second stage, compiling a second list of typical actions performed by the application by removing one or more anomalous actions of the application performed by at least one known exploit that utilizes one or more vulnerabilities of the application from a list of actions performed by the application, wherein the second list of typical actions is collected at least through analysis during the execution of the application by emulation in a virtual environment; in a third stage, comparing the first and second lists of the typical actions compiled in the first and second stages and compiling a definitive list of typical actions based on the comparison of the first and second lists of the typical actions; configuring one or more restriction rules based on the definitive list of typical actions to eliminate the one or more vulnerabilities, wherein a restriction rule allows the application to perform typical actions and blocks anomalous actions; and controlling execution of the application using the restriction rules. detecting, by a processor of the computer system, execution of a software application; determining whether the detected application includes one or more vulnerabilities associated with one or more errors in the application; performing a process of at least the following three stages for protecting the computer system from the one ore more software vulnerabilities: in a first stage, compiling a first list of typical actions performed by the application based on response information collected from a query sent to a plurality of external information sources, including at least a remote antivirus server, wherein if an action was not discovered from all external information sources, then the action is not added to the first list of typical actions; in a second stage, compiling a second list of typical actions performed by the application by removing one or more anomalous actions of the application performed by at least one known exploit that utilizes one or more vulnerabilities of the application from a list of actions performed by the application, wherein the second list of typical actions is collected at least through analysis during the execution of the application by emulation in a virtual environment; in a third stage, comparing the first and second lists of the typical actions compiled in the first and second stages and compiling a definitive list of typical actions based on the comparison of the first and second lists of the typical actions; configuring one or more restriction rules based on the definitive list of typical actions to eliminate the one or more vulnerabilities, wherein a restriction rule allows the application to perform typical actions and blocks anomalous actions; and controlling execution of the application using the restriction rules. in a first stage, compiling a first list of typical actions performed by the application based on response information collected from a query sent to a plurality of external information sources, including at least a remote antivirus server, wherein if an action was not discovered from all external information sources, then the action is not added to the first list of typical actions; in a second stage, compiling a second list of typical actions performed by the application by removing one or more anomalous actions of the application performed by at least one known exploit that utilizes one or more vulnerabilities of the application from a list of actions performed by the application, wherein the second list of typical actions is collected at least through analysis during the execution of the application by emulation in a virtual environment; in a third stage, comparing the first and second lists of the typical actions compiled in the first and second stages and compiling a definitive list of typical actions based on the comparison of the first and second lists of the typical actions; configuring one or more restriction rules based on the definitive list of typical actions to eliminate the one or more vulnerabilities, wherein a restriction rule allows the application to perform typical actions and blocks anomalous actions; and controlling execution of the application using the restriction rules.