Let's assume that I have an application X. I only track system calls that X issues. For example in systems like "CS-STILo". The system detects anomalous sequences of system calls to detect code reuse attacks.
If I want to prevent the attack when I detect the attack, what should I do? Can I stop the system calls before it is executed using Stackable Filesystems (e.g., Wrapfs)? If not, is there another way?