Data tracking in user space

A way to track data from an untrusted source as it moves through memory in original or modified form. A probe is placed on a data reception call of a program. When the probe is triggered by execution of the data reception call for a piece of data, a location where the piece of data is to be stored is marked. When a program instruction requests access to the marked location, instrumentation code is injected subsequent to the program instruction to track the flow of the piece of data. When the instrumentation code is executed, the next location where the piece of data will be stored is determined and marked as well. A threat analyzer is invoked to analyze the marked locations for threats.