1. A computer-implemented method, comprising: collecting performance data for one or more executions of a process on one or more computing devices, the performance data describing memory allocation for a plurality of executions of the process on the computing devices; accessing the performance data collected on the computing devices; employing a statistical distribution to the performance data collected on the computing devices to establish a pattern for memory allocation for a plurality of executions of a process on the computing devices; setting the pattern of the statistical distribution as a baseline of memory allocation for the plurality of executions of the process; analyzing the performance data describing the memory allocation for the plurality of executions of the process on the computing devices by comparing a memory allocation for the executing process to the baseline using a machine learning algorithm; identifying at least one anomalous execution instance of the process on at least one computing device of the computing devices that is outside a predetermined number of statistical variances of the baseline; and sending an alert that designates the at least one anomalous execution instance of the process as a security risk based on the anomalous memory allocation for the at least one anomalous execution instance of the process, the security risk including an injection of malicious code into the process on the at least one computing device.