Systems and methods for analysis of execution patterns for applications executing on remote devices. In some implementations of the system, a knowledge base stores successful traces from a plurality of instances of an application and one or more computing processors in the system receive, via a network interface, call-stack information from an instance of the application executing on a remote device, call-stack information including periodic captures of an execution status for the instance of the application, and determine whether there is a similarity between the call-stack information received from the instance of the application and the stored plurality of successful traces. Responsive to determining a similarity, the computing processors add the remote device to a population of devices likely to execute the object and facilitate further actions specific to the device population.