The present technology monitors events that allocate and deallocate virtual memory regions in a device, wherein the events include system calls from user space. The system can generate a log of events, and based on the log of events, track regions of virtual memory allocated and deallocated via the events. The system can also record events with corresponding stack traces. Next, the system can group recorded events having matching stack traces to yield event groupings, and instrument functions in a compiled code associated with the process to determine retain counts of respective events associated with the functions. The system can then automatically pair at least one of a first portion of the events and a second portion of the respective events based on the event groupings and the retain counts of the respective events to yield paired events.