Forensic data collection and analysis utilizing function call stacks

A method of compiling a software program comprising:

• inserting a plurality of probes into an executable code of the software program during compile time;
• analyzing code of the software program during compile time to identify functions in the analyzed code that are stored in indirect function call variables;
• generating a behavior model of the software program using function call graphs;
• and
• generating call stack function profiles, thereby identifying a function call stack that led to an attack of the software program, wherein an executable of the software program contains function call graph information;
• wherein a hash is taken of a segment of ASCHII function names in the function call stack, wherein the segment has fewer function names than all function names in the function call stack, the hash resulting in a unique hash value of the attack of the software program,
• wherein the segment is one or a combination of ASCHII call stack function names in a function name hierarchy in the function call stack, and
• wherein the unique hash value is used to identify similar or identical attack sequences.