Runtime application self-protection