A system determines a first volume of out-calls of a first out-call type made by a software container that is executing an application during a time period. The system determines a second volume of out-calls of a second out-call type made by the software container. The system determines a first ratio of the first volume to a combined volume of out-calls of all out-call types made by the software container. The system determines a second ratio of the second volume to the combined volume of out-calls of all out-call types made by the software container. The system determines a measure by comparing the first ratio to a third ratio associated with the first out-call type, and by comparing the second ratio to a fourth ratio associated with the second out-call type. The system identifies any behavior or any application type associated with the application, based on the measure.