# US 10,769,250 B1 · Targeted security monitoring using semantic behavioral change analysis > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,769,250 B1 - Document ID: US10769250B1 - Status: Granted - Kind: B1 - Application number: 15/794,757 - Filed: 2017-10-26 - Granted: 2020-09-08 - Earliest claimed: 2017-10-26 - Assignees: Amazon Technologies, Inc. - Applicants: Amazon Technologies, Inc. - Inventors: Michael Tautschnig; John Cook - Web page: https://patentgrep.com/patent/US10769250B1 ## CPC - G06F 21/12: Protecting executable software - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - G06F 8/42: {Syntactic analysis} - G06F 8/436: {Semantic checking} - G06F 8/71: Version control (security arrangements therefor G06F21/57); Configuration management - G06F 8/75: Structural analysis for program understanding - G06F 11/3466: {Performance evaluation by tracing or monitoring} - G06F 2221/033: Test or assess software - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Techniques for targeted security monitoring using semantic behavioral change analysis are described. A mutation monitor can use a code repository to generate a build of a software project prior to a code commit and another build after the code commit. An instruction-difference between the builds can be generated and used to perform a change impact analysis to identify control-flow and data dependencies changed as a result of the code commit. A semantic difference can be generated by annotating a syntactic difference for the code commit based on the identified control-flow and data dependency changes to allow for the behavioral changes to be easily shown to a user. Security impact analysis can be performed on parts of the software impacted by the code commit to quickly determine the security impacts introduced by the code commit. ## Claims ### Claim 1 A computer-implemented method comprising: generating a first build of a software project from a first one or more source files; obtaining a code commit for the software project that changes the software project to yield a second one or more source files that result from an application of the code commit to the first one or more source files; generating a second build of the software project from the second one or more source files; performing an instruction-level comparison of the first build with the second build to yield an instruction difference; generating a change impact, based at least in part on the instruction difference, that indicates behavioral differences between the first build of the software project and the second build of the software project; performing a security analysis of one or more parts of the software project at locations identified based on the behavioral differences indicated by the change impact to determine a security risk value for the code commit, wherein the security analysis is performed on less than all of the software project, the security analysis including: identifying, based at least in part on a strongly-connected analysis, a plurality of parts of the software project having behavioral impacts due to the code commit; performing, by a first compute instance, a first program analysis of a first part of the plurality of parts of the software project; and performing, by a second compute instance, a second program analysis of a second part of the plurality of parts of the software project; and transmitting, to an electronic device, the security risk value for the code commit. ### Claim 2 (depends on 1) The computer-implemented method of claim 1, further comprising: generating a syntactic difference that reflects line-by-line differences between the first one or more source files and the second one or more source files that result from the application of the code commit to the first one or more source files; generating a semantic difference by annotating the syntactic difference with indicators of control or data dependencies introduced by changes of the code commit detected based on an analysis of the instruction difference; and transmitting, to the electronic device, the semantic difference. ### Claim 3 (depends on 1) The computer-implemented method of claim 1, further comprising: performing a plurality of security analyses of parts of a plurality of software projects at locations identified based on behavioral differences indicated by a plurality change impacts to yield a plurality of security risk values; and transmitting, to the electronic device, the plurality of security risk values. ### Claim 4 A computer-implemented method comprising: performing an instruction-level comparison between a first build of a software project and a second build of the software project to yield an instruction difference, wherein the first build was generated using a first one or more source files and the second build was generated using a second one or more source files that resulted from a code commit being applied to the first one or more source files; generating a change impact, based at least in part on the instruction difference, that indicates behavioral differences between the first build of the software project and the second build of the software project; performing a security analysis of one or more parts of the software project identified based at least in part on the behavioral differences indicated by the change impact to determine a security risk value for the code commit, the security analysis including: identifying, based at least in part on a strongly-connected analysis, a plurality of parts of the software project having behavioral impacts due to the code commit; performing, by a first compute instance, a first program analysis of a first part of the plurality of parts of the software project; and performing, by a second compute instance, a second program analysis of a second part of the plurality of parts of the software project; and transmitting, to an electronic device, the security risk value for the code commit. ### Claim 5 (depends on 4) The computer-implemented method of claim 4, further comprising: generating a syntactic difference that reflects line-by-line differences between the first one or more source files and the second one or more source files that result from an application of the code commit to the first one or more source files; generating a semantic difference by annotating the syntactic difference with one or more indicators of control or data dependencies introduced by changes of the code commit detected based on an analysis of the instruction difference; and transmitting, to the electronic device, the semantic difference. ### Claim 6 (depends on 4) The computer-implemented method of claim 4, further comprising: performing a plurality of security analyses for a plurality of software projects at parts of the plurality of software projects identified based at least in part on behavior differences indicated by a plurality of semantic differences to yield a plurality of security risk values; and transmitting, to the electronic device, the plurality of security risk values. ### Claim 7 (depends on 6) The computer-implemented method of claim 6, further comprising: transmitting, to the electronic device, a security description corresponding to at least one of the plurality of security risk values that identifies a security condition detected to result from a corresponding code commit, wherein the security condition was identified as a result of the security analysis of the corresponding software project. ### Claim 8 (depends on 4) The computer-implemented method of claim 4, wherein the first compute instance and the second compute instance are executed by separate electronic devices. ### Claim 9 (depends on 4) The computer-implemented method of claim 4, wherein the first program analysis and the second program analysis each comprise computing invariants that describe traces of the software project. ### Claim 10 (depends on 9) The computer-implemented method of claim 9, further comprising: receiving, via an application programming interface (API), a request to subscribe to security update information related to the software project. ### Claim 11 (depends on 4) The computer-implemented method of claim 4, wherein the security analysis checks for an existence of one or more of: a memory corruption; an uncaught exception; an incorrect usage of a security-related application programming interface (API); or a logic bomb. ### Claim 12 A non-transitory computer-readable storage medium storing instructions which, when executed by one or more processors of one or more computing devices, cause the one or more computing devices to: generate an instruction difference between a first build of a software project and a second build of the software project, wherein the second build was generated after a code commit was applied to the software project and the first build was generated before the code commit was applied to the software project; generate a change impact, based at least in part on the instruction difference, that indicates behavioral differences between the first build and the second build; perform a security analysis of one or more parts of the software project identified based at least in part on the behavioral differences indicated by the change impact to determine a security risk value for the code commit, the security analysis including: performing a strongly-coupled component analysis to identify a plurality of weakly connected parts of the software project having behavioral impacts resulting from the code commit; performing, by a first compute instance, a first program analysis of a first part of the plurality of weakly connected parts of the software project; and performing, by a second compute instance, a second program analysis of a second part of the plurality of weakly connected parts of the software project, wherein the second program analysis is performed at least partially in parallel with the first program analysis; and transmit, to an electronic device, the security risk value for the code commit. ### Claim 13 (depends on 12) The non-transitory computer-readable storage medium of claim 12, wherein the instructions further cause the one or more computing devices to: generate a syntactic difference that reflects line-by-line differences between source files of the software project before and after the application of the code commit; generate a semantic difference by annotating the syntactic difference with one or more indicators of control or data dependencies introduced by changes of the code commit detected based on an analysis of the instruction difference; and transmit, to the electronic device, the semantic difference. ### Claim 14 (depends on 12) The non-transitory computer-readable storage medium of claim 12, wherein the instructions further cause the one or more computing devices to: perform a plurality of security analyses for a plurality of software projects at parts of the plurality of software projects identified based at least in part on behavior differences indicated by a plurality of semantic differences to yield a plurality of security risk values; and transmit, to the electronic device, the plurality of security risk values. ### Claim 15 (depends on 14) The non-transitory computer-readable storage medium of claim 14, wherein the instructions further cause the one or more computing devices to: transmit, to the electronic device, a security description corresponding to at least one of the plurality of security risk values that identifies a security condition detected to result from a corresponding code commit, wherein the security condition was identified as a result of the security analysis of the corresponding software project. ### Claim 16 (depends on 12) The non-transitory computer-readable storage medium of claim 12, wherein the first compute instance and the second compute instance are executed by separate computing devices. ### Claim 17 (depends on 12) The non-transitory computer-readable storage medium of claim 12, wherein the first program analysis and the second program analysis each comprise computing invariants that describe traces of the software project. ### Claim 18 (depends on 12) The non-transitory computer-readable storage medium of claim 12, wherein the security analysis checks for an existence of one or more of: a memory corruption; an uncaught exception; an incorrect usage of a security-related application programming interface (API); or a logic bomb.