A method, apparatus and system including selecting a phase threshold value, receiving a plurality of sequenced buffers, determining a distance between centers of at least two consecutive histogram bins, comparing the distance with the selected threshold value, and determining major execution phases of an executable process based on the comparison.