1. A method for assembling an execution profile of an event, the method comprising: monitoring a process invoked in response to the event for a branch instruction; generating a callback to a security module upon execution of the branch instruction; filtering the callback according to filtering criteria that is dependent on a plurality of identifiers associated with the event; and validating, by the security module in response to the filtering criteria being met, a code segment associated with the branch instruction, the code segment including code executed before the branch instruction and code executed after the branch instruction, the validation including determining whether the code segment is associated with a manipulation of return addresses associated with branch instructions.