A computer-implemented method comprising: obtaining a base memory-write profile description for a binary code, wherein the base memory-write profile description comprises: a base memory-write profile for each of a plurality of Application Programming Interface, API, calls in the binary code, wherein the base memory-write profile comprises a count of memory updates for each of a plurality of memory locations of random access memory, RAM, during an execution of a corresponding API call, wherein the base memory-write profile for each of the plurality of API calls included in the binary code is obtained using a shadow memory, and is generated or refined based on feedback from a memory-write profile generated for a previous execution request that invoked the respective API call included in the binary code, wherein each API call included in the binary code is identified by a respective identifier included in the base memory-write profile description; receiving an execution request that invokes the binary code; generating an execution memory-write profile for the execution request, wherein the execution memory-write profile comprises a count of memory updates for each of the plurality of memory locations of random access memory, RAM, during an execution of the execution request, wherein the execution memory-write profile is generated using the shadow memory; determining, based on a comparison between the execution memory-write profile and the base memory-write profiles in the base memory-write profile description, an API call in the binary code that corresponds to the execution request by finding a match between the execution memory-write profile and one of the base memory-write profiles in the base memory-write profile description if two compared memory-write profiles satisfy a similarity threshold; generating a notification that indicates the determined API call, wherein the notification further indicates a risk level of the execution request based on a comparison between the execution memory-write profile and the base memory-write profile of the determined API call, and, wherein the risk level is positively correlated with a difference between the execution memory-write profile and the base memory-write profile of the determined API call, such that the risk level of the execution request is used to detect safety and security attacks. obtaining a base memory-write profile description for a binary code, wherein the base memory-write profile description comprises: a base memory-write profile for each of a plurality of Application Programming Interface, API, calls in the binary code, wherein the base memory-write profile comprises a count of memory updates for each of a plurality of memory locations of random access memory, RAM, during an execution of a corresponding API call, wherein the base memory-write profile for each of the plurality of API calls included in the binary code is obtained using a shadow memory, and is generated or refined based on feedback from a memory-write profile generated for a previous execution request that invoked the respective API call included in the binary code, wherein each API call included in the binary code is identified by a respective identifier included in the base memory-write profile description; receiving an execution request that invokes the binary code; generating an execution memory-write profile for the execution request, wherein the execution memory-write profile comprises a count of memory updates for each of the plurality of memory locations of random access memory, RAM, during an execution of the execution request, wherein the execution memory-write profile is generated using the shadow memory; determining, based on a comparison between the execution memory-write profile and the base memory-write profiles in the base memory-write profile description, an API call in the binary code that corresponds to the execution request by finding a match between the execution memory-write profile and one of the base memory-write profiles in the base memory-write profile description if two compared memory-write profiles satisfy a similarity threshold; generating a notification that indicates the determined API call, wherein the notification further indicates a risk level of the execution request based on a comparison between the execution memory-write profile and the base memory-write profile of the determined API call, and, wherein the risk level is positively correlated with a difference between the execution memory-write profile and the base memory-write profile of the determined API call, such that the risk level of the execution request is used to detect safety and security attacks.