Abstract: In one embodiment, a method includes receiving, by a network component, application performance data. The application performance data is associated with one or more applications. The method also includes determining to transform, by the network component, the application performance data into application security data, generating, by the network component, a baseline for the application security data, and detecting, by the network component, an anomaly in the baseline. The method further includes determining, by the network component, a potential security threat based on the anomaly.

Abstract: A computing system for identifying and scoring problems associated with call stacks. The computing system identifies call stacks associated with an application and determines a problem occurs in the application. The computer system compares a call stack of a first set of applications with a call stack of a second set of applications, wherein the call stack of the first set of applications includes the problem and the call stack of the second set of applications does not include the problem. The computer system generates a score indicating a likelihood that a particular call stack caused the problem based on whether the particular call stack is included in the call stack of the first set of applications, the call stack of the second set of applications, or both. The computing system generates a notification comprising the score indicating the likelihood that the particular call stack caused the problem.