Embodiments are disclosed for identifying a suspect application based on multiple operating factors from use of multiple applications. The embodiments can generate a representative distribution of a selected factor based on collected information corresponding to multiple operating factors from use of multiple applications. The embodiments can compare a representative distribution of a target factor with the representative distribution of the selected factor and identify a suspect application when these distributions are different.