A method (and system) of modeling runtime behavior for a software application includes limiting a portion of a run to be analyzed using criteria that define an analysis scenario, structuring events of the analysis scenario as a flow of logical content through a plurality of transformations, applying labels to elements of the flow, and generating a behavior signature for the analysis scenario based on the labels.