A method for detecting malicious applications, the method comprising: providing a library of handler functions (104; 104a; 104b) associated with a container (301; 301a; 301b) on a memory accessible by a processor, wherein the handler functions control an access of one or more applications to protected resources on a computer device; placing a plurality of applications into the container (301; 301a; 301b), wherein the container is configured to isolate the plurality of applications from an execution environment of the computer device; associating a same security policy with the plurality of applications in the container (301; 301a; 301b); modifying, via the processor, a plurality of function calls of the one or more applications when loading the one or more applications to be controlled by the handler functions, to access the library of handler functions (104; 104a; 104b) instead of corresponding application program interface functions of the computer device by replacing one or more classes or methods of the one or more applications that perform function calls to the protected resources with one or more function calls to corresponding handler functions contained in the library (104, 104a, 104b); receiving, by the handler functions, one of the plurality of function calls from a modified application; accessing a remote security server that analyzes the received function call for malicious behavior characteristics by using a remote database and that indicates to the computer device whether the received function call contains malicious behavior characteristics; performing by the handler functions the received function call to the protected resources if the received function call contains no malicious behavior characteristics; and preventing the modified application to access the protected resources if the received function call contains malicious behavior characteristics. providing a library of handler functions (104; 104a; 104b) associated with a container (301; 301a; 301b) on a memory accessible by a processor, wherein the handler functions control an access of one or more applications to protected resources on a computer device; placing a plurality of applications into the container (301; 301a; 301b), wherein the container is configured to isolate the plurality of applications from an execution environment of the computer device; associating a same security policy with the plurality of applications in the container (301; 301a; 301b); modifying, via the processor, a plurality of function calls of the one or more applications when loading the one or more applications to be controlled by the handler functions, to access the library of handler functions (104; 104a; 104b) instead of corresponding application program interface functions of the computer device by replacing one or more classes or methods of the one or more applications that perform function calls to the protected resources with one or more function calls to corresponding handler functions contained in the library (104, 104a, 104b); receiving, by the handler functions, one of the plurality of function calls from a modified application; accessing a remote security server that analyzes the received function call for malicious behavior characteristics by using a remote database and that indicates to the computer device whether the received function call contains malicious behavior characteristics; performing by the handler functions the received function call to the protected resources if the received function call contains no malicious behavior characteristics; and preventing the modified application to access the protected resources if the received function call contains malicious behavior characteristics.