On Gray-Box Program Tracking for Anomaly Detection