For building a representation of behavior of a container, an apparatus is able to: inject a probe in an operating system associated with the container to monitor system calls coming from the container, produce records for respective system calls, each record containing an identifier of a system call and a stack size used by the container for the system call, the records being put in an ordered queue, process the records in the ordered queue into a graph comprising nodes respectively associated with used stack sizes and edges respectively associated with identifiers of system call between nodes, wherein an edge from one record is associated with the identifier of the system call of the one record and links a node associated with a previous record to the node associated with the one record.