Example embodiments of the present disclosure relate to graph comparison-based behavior analysis. A plurality of score trends is determined between a target graph corresponding to execution of an application and a plurality of reference graph associated with a plurality of behaviors of the application. A graph comprises nodes and edges. A node represents an inferred state during an event and retains a timestamp of occurrence of the corresponding event. An edge represents a transition between states represented by the nodes. A first reference graph is determined based on the plurality of score trends. The first reference graph matches with at least a part of the target graph corresponding to a first period of time during the execution of the application. A behavior analysis result is provided which indicates that the application performs a first behavior associated with the first reference graph during the first period of time.