Techniques for detecting unauthorized use (e.g., malicious attacks) of the
computing systems (e.g., computing devices) are disclosed. Unauthorized use can be detected based on patterns of use (e.g., behavioral patterns of use typically associated with a
human being) of the
computing systems. Acceptable
behavioral pattern data can be generated for a computing
system by monitoring the use of a
support system (e.g., an
operating system, a virtual environment) operating on the computing
system. For example, a plurality of
system support provider components of a
support system (e.g., system calls, device drivers) can be monitored in order to generate the acceptable
behavioral pattern data in a form which effectively defines an acceptable pattern of use (usage pattern) for the monitored system support provider components, thereby allowing detection of unauthorized use of a computing system by detecting any deviation from the acceptable pattern of use of the monitored system support provider components.