System and method for creating a process invocation tree

摘要

A computer-implemented method for creating a process invocation tree includes identifying an event indicating that a parent process of interest has invoked a child process, suspending execution of the child process, collecting information-of-interest associated with the invocation of the child process, and resuming execution of the child process.