A method for executing a virtualized application on a computing system that includes a user-space and a kernel-space is disclosed. In an embodiment, the method involves executing an application in the user-space, executing a user-level virtualization layer in the user-space, the user-level virtualization layer including a set of rules, performing, via the user-level virtualization layer, user-level hooking of events that are generated by the executing application according to the set of rules to identify events of interest, storing events that are identified as events of interest in a database, applying a pattern recognition process to the events that are stored in the database, generating a rule for the set of rules in the user-level virtualization layer based on the pattern recognition process, and applying the generated rule through the user-level virtualization layer.