presented the importance of examining the order of function calls for forensic analysis and showed its usefulness in isolating the causes and effects of the attack through intrusion detection systems. This analysis, not only detects unexpected events in the order of function calls, but also detects absence of expected events.