A monitored computing device, comprising: at least one processing unit, and at least one computer-readable medium storing instructions executable by the at least one processing unit to cause the at least one processing unit to perform operations comprising: detecting, at the monitored computing device, a sequence of the events, individual events having respective event types and taking place at the monitored computing device; locating a loop within the sequence of events based at least in part on relative frequencies of the event types, wherein the loop is defined at least partly by a boundary; determining a distribution of event types of the events within the loop; and determining that the sequence of events is associated with malware based at least in part on the distribution of event types within the loop; the operations further comprise: selecting a first portion of the sequence of events; selecting a second portion of the sequence of events; determining a first distribution of event types of the events within the first portion; determining a second distribution of event types of the events within the second portion; determining that a difference between the first distribution and the second distribution satisfies a predetermined boundary criterion; and in response, locating the boundary in the sequence of events between the first portion and the second portion and wherein the first portion and the second portion comprise respective back-to-back fixed-size sliding windows. at least one processing unit, and at least one computer-readable medium storing instructions executable by the at least one processing unit to cause the at least one processing unit to perform operations comprising: detecting, at the monitored computing device, a sequence of the events, individual events having respective event types and taking place at the monitored computing device; locating a loop within the sequence of events based at least in part on relative frequencies of the event types, wherein the loop is defined at least partly by a boundary; determining a distribution of event types of the events within the loop; and determining that the sequence of events is associated with malware based at least in part on the distribution of event types within the loop; detecting, at the monitored computing device, a sequence of the events, individual events having respective event types and taking place at the monitored computing device; locating a loop within the sequence of events based at least in part on relative frequencies of the event types, wherein the loop is defined at least partly by a boundary; determining a distribution of event types of the events within the loop; and determining that the sequence of events is associated with malware based at least in part on the distribution of event types within the loop; the operations further comprise: selecting a first portion of the sequence of events; selecting a second portion of the sequence of events; determining a first distribution of event types of the events within the first portion; determining a second distribution of event types of the events within the second portion; determining that a difference between the first distribution and the second distribution satisfies a predetermined boundary criterion; and in response, locating the boundary in the sequence of events between the first portion and the second portion and wherein the first portion and the second portion comprise respective back-to-back fixed-size sliding windows. selecting a first portion of the sequence of events; selecting a second portion of the sequence of events; determining a first distribution of event types of the events within the first portion; determining a second distribution of event types of the events within the second portion; determining that a difference between the first distribution and the second distribution satisfies a predetermined boundary criterion; and in response, locating the boundary in the sequence of events between the first portion and the second portion and wherein the first portion and the second portion comprise respective back-to-back fixed-size sliding windows.