System call trace reconstruction

A computing system, comprising:

• a memory;
• and
• one or more processors, coupled to the memory, to:
• determine a set of memory locations of a kernel memory structure, wherein the set of memory locations store data indicative of one or more parameters of a user-associated process;
• determine that a first value of a first memory location of the set of memory locations has changed;
• determine an execution of a first system call associated with the user-associated process and the kernel memory structure;
• retrieve one or more values corresponding to individual memory locations of the set of memory locations associated with the first system call;
• and
• provide an output identifying the first system call based on the one or more values corresponding to the individual memory locations.

A non-transitory computer-readable storage medium comprising instructions that, when executed by one or more processors, cause the one or more processors to perform operations comprising:

• determining a set of memory locations of a kernel memory structure, wherein the set of memory locations store data indicative of one or more parameters of a user-associated process;
• determining that a first value of a first memory location of the set of memory locations has changed;
• determining an execution of a first system call associated with the user-associated process and the kernel memory structure;
• retrieving one or more values corresponding to individual memory locations of the set of memory locations associated with the first system call;
• and
• providing an output identifying the first system call based on the one or more values corresponding to the individual memory locations.