Pecan is a context-sensitive anomaly-based intrusion detector that uses probabilistic calling context to achieve efficient context sensitivity. The PLAS 2010 paper "Efficient, Context-Sensitive Detection of Real-World Semantic Attacks" describes Pecan in detail. Questions and feedback are welcome.
Patch against Jikes RVM 2.9.2 and a README