A computer-implemented method, comprising: identifying, by a processor of a computer device, a set of program variables associated with a computer program executing on the computer device; generating, by the processor, a profile of variable writes for the computer program based on tracking, by the processor during execution of the computer program, function calls and variable write operations corresponding to the function calls and, determining, by the processor, for each respective variable in the set of program variables: a count of memory write operations for writing to the variable based on instrumenting, by a compiler, each assignment in source code of the computer program with a corresponding increment of a related shadow memory value; and timestamps associated with the memory write operations for writing to the variable; detecting, by the processor, a trigger condition associated with the set of program variables, the detecting including: monitoring, by the processor, a pattern of memory accesses by the computer program, the pattern of memory accesses indicating accesses of memory allocated to variables in the set of program variables by the computer program; and detecting, by the processor, a deviation of the pattern of memory accesses from the profile of variable writes; and in response to detecting the trigger condition, generating, by the processor, a notification indicating an attack status on the computer program. identifying, by a processor of a computer device, a set of program variables associated with a computer program executing on the computer device; generating, by the processor, a profile of variable writes for the computer program based on tracking, by the processor during execution of the computer program, function calls and variable write operations corresponding to the function calls and, determining, by the processor, for each respective variable in the set of program variables: a count of memory write operations for writing to the variable based on instrumenting, by a compiler, each assignment in source code of the computer program with a corresponding increment of a related shadow memory value; and timestamps associated with the memory write operations for writing to the variable; a count of memory write operations for writing to the variable based on instrumenting, by a compiler, each assignment in source code of the computer program with a corresponding increment of a related shadow memory value; and timestamps associated with the memory write operations for writing to the variable; detecting, by the processor, a trigger condition associated with the set of program variables, the detecting including: monitoring, by the processor, a pattern of memory accesses by the computer program, the pattern of memory accesses indicating accesses of memory allocated to variables in the set of program variables by the computer program; and detecting, by the processor, a deviation of the pattern of memory accesses from the profile of variable writes; and monitoring, by the processor, a pattern of memory accesses by the computer program, the pattern of memory accesses indicating accesses of memory allocated to variables in the set of program variables by the computer program; and detecting, by the processor, a deviation of the pattern of memory accesses from the profile of variable writes; and in response to detecting the trigger condition, generating, by the processor, a notification indicating an attack status on the computer program.