1. A method, implemented by a computing system programmed to perform the following, comprising: determining, by the computing system, a block of dynamically allocated memory in an inferior process memory space corresponds to a structure; casting the block of memory as an instance of the structure; determining a field type of a field in the instance of the structure; determining whether memory data pertaining to the block of dynamically allocated memory satisfies one or more criteria in heuristics data associated with the field type; and categorizing the block of dynamically allocated memory based on the determination of whether the memory data satisfies the one or more criteria of the field type.