1. A computer implemented method comprising the steps of: inserting code into a software system with logic to detect an execution of unexpected code and recovery of call paths when the execution happens by maintaining, in a software system, a program's calling context correct even when a monitoring of the program goes out of a scope of a program analysis by validating function call transitions and recovering partial paths before and after the violation of the program's control flow, the maintaining comprising: i) detecting a violation of control flow invariants in the software system including validating a source and destination of a function call in the software system and validating a function call on a caller side where an expected callee value is stored in a shared variable and the callee value is checked whether for matching the callee at an entry of the callee function; ii) preserving pre and post violation states; iii) interpreting a pre-violation partial path responsive to a failure of the validating; and iv) interpreting a post violation path after a violation of program flow; and when the code out of program analysis executes in an incident, detecting the incident by the code and recovering partial paths before and after the incident.