A method is described that includes generating a representation of an application that describes specific states of the application and specific state transitions of the application. The method also includes identifying a region of interest of the application based on rules and observations of the application's execution. The method also includes determining specific stimuli that will cause one or more state transitions within the application to reach said region of interest. The method also includes enabling one or more monitors within the application's run time environment and applying the stimuli within the application's run time environment, where, the application's run time environment is existing on a mobile device that the application is installed on. The method also includes generating monitoring information from said one or more monitors. The method also includes applying rules to the monitoring information to determine a next set of stimuli to be applied to the application in pursuit of determining whether the region of interest corresponds to improperly behaving code.