Disclosed are various embodiments for detecting unknown software vulnerabilities and system compromises. During a learning period in which execution of a software package is monitored, invoked portions of the software package are determined. Also, during learning period, a frequency of use of at least one of the invoked portions of the software package is determined. It is determined that the frequency of use during the learning period is different from a frequency of use after the learning period, and in response, an action is performed.