Effective method for intrusion model reconstruction from execution-trace