A computer-implemented method includes receiving, by a processor, real time operation data related to an application, identifying components of the application based on the operation data, extracting relationships and interdependencies between the components, and generating a graph of the identified components, the relationships and the interdependencies. The method also includes determining one or more dynamic metrics of the identified components, the one or more dynamic metrics indicative of interactions between the components, extracting statistical information describing at least one of performance and resource consumption based on the operation data, incorporating the dynamic metrics into the graph, determining a behavior of at least one component based on a pattern of appearance of the at least one component in the graph, and generating a model of the application based on the identified components and the determined behaviors.