Patent attributes
Disclosed are various embodiments for detecting unknown software vulnerabilities and system compromises. In a first implementation, a monitoring service records an indication of which portions of an imported software package are invoked by a service during a learning period. After the learning period, the monitoring service determines that a different portion of the imported software package is invoked by the service. The portion is different than those invoked by the service during the learning period. An action is then performed in response to determining that the different portion of the imported software package is invoked by the service.