1. A computer implemented method for generating behavior based signatures for identifying applications, the method comprising the steps of: monitoring, by a computer, a non-malicious instance of an application as it executes; detecting, by a computer, specific behaviors concerning how the application interacts with critical systems; creating, by a computer, a behavior based signature representing detected behaviors concerning the execution of the application; subsequently identifying an instance of the application as malicious based on the behavior based signature of the non-malicious instance; monitoring a second application as it executes; detecting specific behaviors concerning the execution of the second application; comparing detected behaviors concerning the execution of the second application to at least one behavior based signature; performing a heuristic analysis on the second application to determine whether the second application comprises malware; and responsive to the comparing step and the heuristic analysis indications, determining whether the second application comprises malware.