1. A computer-implemented method comprising: monitoring, by a processor, events that allocate and deallocate virtual memory regions in a device, wherein the events comprise system calls from user space associated with a process at the device; generating, by the processor, a log of the events; and based on the log of the events, tracking regions of virtual memory allocated and deallocated via the events.