Control flow integrity monitoring for applications running on platforms

A system comprising:

• one or more processors;
• and
• one or more non-transitory computer-readable media storing computer-executable instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:
• obtaining a directed graph that represents observed executions of allowed processes that were observed during an observation phase;
• monitoring transfers of instruction pointers associated with execution of a particular process at the system;
• and
• determining that the transfers of instruction pointers include an invalid transfer based at least in part on the invalid transfer not being represented in the observed executions represented by the directed graph.

One or more non-transitory computer-readable media storing computer-readable instructions that, when executed by one or more processors, cause the one or more processors to perform operations comprising:

• obtaining a directed graph that represents observed executions of allowed processes that were observed during an observation phase;
• monitoring transfers of instruction pointers associated with execution of a particular process at a computing system;
• and
• determining that the transfers of instruction pointers include an invalid transfer based at least in part on the invalid transfer not being represented in the observed executions represented by the directed graph.