A network infrastructure element (300) can be configured to, upon determining (101) that an end-user platform (305) seeks to download an executable program, execute (103) the program to develop a corresponding model that represents corresponding operating system call-based behavior. The network infrastructure element can then use (104) this model to vet the operating system call-based behavior of the program with respect to end-user platform policies. When the operating system call-based behavior vets acceptably with respect to these policies, the end-user platform can then be permitted to download (106) the executable program. If desired, the network infrastructure element can provide (107) the model to the end-user platform to permit vetting of the modeled behavior with respect to locally-maintained policies. The model provided to the end-user platform can comprise a size-reduced sliced model.