Tackling basic block-based anomaly execution behaviors