After first installation of an application program on a computing device, the computing devices monitors a behavior of the application program for a period of time and then builds a behavior profile of the application program from the behavior. After the period of time has elapsed, such as specified period of time, the computing device may prevent the application program from deviating from the behavior profile. After the period of time has elapsed, such as when an update or patch to the application program has been applied or installed, the computing device may continue to monitor the behavior of the application program, and in response to determining that the behavior of the application program after the period of time deviates from the behavior profile, perform an action with respect to the application program.
Please help me write a proper abstract based on the patent claims. CLAIM: 1. A method comprising: after first installation of an application program on a computing device, monitoring, by the computing device, a behavior of the application program for a period of time and building a behavior profile of the application program from the behavior; and after the period of time, performing one of: preventing, by the computing device, the application program from deviating from the behavior profile; continuing to monitor the behavior of the application program, by the computing device, and in response to determining that the behavior of the application program after the period of time deviates from the behavior profile, performing an action with respect to the application program. 2. The method of claim 1, wherein the period of time is a specified period of time, the application program being unchanged from the first installation thereof to just after the specified period of time elapses. 3. The method of claim 2, further comprising: receiving, by the computing device, the specified period of time from a user of the computing device. 4. The method of claim 1, wherein the period of time is an unspecified period of time, elapsing of the specified period of time occurring when an update or patch of the application program is applied or installed. 5. The method of claim 1, wherein the behavior of the application program comprises when and for how long the application program communicates over a network to which the computing device is communicatively connected. 6. The method of claim 1, wherein the behavior of the application program comprises one or more of: types of data the application program accesses, when and for how long the application program accesses the data, locations of the data the application program accesses, and how the application program accesses the data. 7. The method of claim 1, wherein the behavior of the application program comprises one or more of: types of hardware resources the application program accesses, and when and for how long the application program accesses the hardware resources. 8. The method of claim 1, wherein building the behavior profile of the application program from the behavior of the application program comprises: performing a statistical analysis on the behavior of the application program that has been monitored for the period of time, wherein results of the statistical analysis constitute the behavior profile of the application program. 9. The method of claim 1, wherein building the behavior profile of the application program from the behavior of the application program comprises: retrieving a second behavior profile of the application program built from the behavior of the application program on one or more other computing devices; modifying the behavior profile of the application program based on the second behavior profile. 10. The method of claim 1, further comprising: uploading, by the computing device, the behavior profile to a central computing device from which other computing devices download the behavior profile of the application program. 11. The method of claim 1, further comprising, after preventing the application program from deviating from the behavior profile: permitting a user to enable a given behavior of the application program with respect to the behavior profile so that the given behavior does not result in deviation from the behavior profile. 12. The method of claim 1, wherein performing the action with respect to the application program comprises one or more of: notifying, by the computing device, a user of the computing device that the behavior of the application program is deviating from the behavior profile; transmitting, by the computing device, data regarding a deviation of the behavior of the application program from the behavior profile to a developer of the application program; disabling, by the computing device, the application program and requesting the user to provide explicit authorization for the application program to be reenabled. 13. A non-transitory computer-readable data storage medium storing computer-executable code performable by a computing device to perform a method comprising: after first installation of an application program on the computing device, monitoring a behavior of the application program for a specified period of time; after the specified period of time has elapsed, constructing a behavior profile of the application program based on the behavior that has been monitored for the specified period of time; after the behavior profile has been constructed, preventing the application program from engaging in behavior that deviates from the behavior profile. 14. The non-transitory computer-readable data storage medium of claim 13, wherein the behavior of the application program comprises one or more of: when and for how long the application program communicates over a network to which the computing device is communicatively connected; one or more of: types of data the application program accesses, when and for how long the application program accesses the data, locations of the data the application program accesses, and how the application program accesses the data; one or more of: types of hardware resources the application accesses, and when and for how long the application program accesses the hardware resources. 15. The non-transitory computer-readable data storage medium of claim 13, wherein the method further comprises, after constructing the behavior profile and before preventing the application program from engaging in behavior that deviates from the behavior profile: uploading the behavior profile that has been constructed to a central computing device; downloading from the central computing device a second behavior profile of the application program constructed from the behavior of the application program on one or more other computing devices; and modifying the behavior profile of the application program based on the second behavior profile. 16. The non-transitory computer-readable data storage medium of claim 13, wherein the method further comprises: permitting a user to enable a given behavior of the application program with respect to the behavior profile so that the given behavior does not result in deviation from the behavior profile. 17. A computing device comprising: hardware resources, including a processor; and a non-transitory computer-readable data storage medium storing computer-executable code that is executable by the processor to: after first installation of an application program on the computing device, monitor a behavior of the application program; after an update or patch of the application program has been applied or installed, construct a behavior profile of the application program from the behavior that has been monitored until the update or patch was applied or installed; after the behavior profile has been constructed, in response to determining that the behavior of the application program after the update or patch has been applied or installed deviates from the behavior profile, perform an action with respect to the application program. 18. The computing device of claim 17, wherein the behavior of the application program comprises one or more of: when and for how long the application program communicates over a network to which the computing device is communicatively connected; one or more of: types of data the application program accesses, when and for how long the application program accesses the data, locations of the data the application program accesses, and how the application program accesses the data; one or more of: types of the hardware resources the application accesses, and when and for how long the application program accesses the hardware resources. 19. The computing device of claim 17, wherein the computer-executable code is executable by the processor to further, after the behavior profile has been constructed: upload the behavior profile that has been constructed to a central computing device; download from the central computing device a second behavior profile of the application program constructed from the behavior of the application program on one or more other computing devices; and modify the behavior profile of the application program based on the second behavior profile. 20. The computing device of claim 17, wherein the computer-executable code is executable by the processor to perform the action with respect to the application program by one or more of: notifying a user of the computing device that the behavior of the application program is deviating from the behavior profile; transmitting data regarding a deviation of the behavior of the application program from the behavior profile to a developer of the application program; disabling the application program and requesting the user to provide explicit authorization for the application program to be reenabled.