# US 11,113,412 B2 · System and method for monitoring and verifying software behavior

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 11,113,412 B2
- Document ID: US11113412B2
- Status: Granted
- Kind: B2
- Application number: 16/245,212
- Filed: 2019-01-10
- Published: 2019-05-30
- Granted: 2021-09-07
- Earliest claimed: 2014-01-06
- Assignees: Tongji University
- Applicants: Tongji University
- Inventors: Changjun Jiang; Hongzhong Chen; Chungang Yan; Zhijun Ding; Wangyang Yu; Junzhu Zhong
- Web page: https://patentgrep.com/patent/US11113412B2

## CPC

- G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database}
- G06Q 20/3829: {involving key management}
- G06Q 20/40: Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
- G06Q 20/405: {Establishing or using transaction specific rules}
- H04L 63/1416: {Event detection, e.g. attack signature detection}
- H04L 63/1425: {Traffic logging, e.g. anomaly detection}
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

The present invention discloses a method and system configured for monitoring and verifying software behavior, comprising: receiving, by a software behavior verification system based on a physical hardware system, legal user behavior data containing user activities performed during legal electronic transactions and storing the legal user behavior data as a software behavior model; monitoring, by a software behavior monitor, data packets transmitted in a transaction, and sending data packets to the software behavior verification system; retrieving, by the behavior verification system, expected key sequences and information in the data packets; comparing the key sequences and information retrieved from the data packets with that of the software behavior model; if the key sequences and information retrieved from the data packets does not consistence with the software behavior model, it is determined that the transaction is an illegal electronic transactions, and the transaction is closed.

## Claims

### Claim 1

A method for monitoring and verifying software behavior, comprising:
the method is executed by a processor;
receiving, by a software behavior verification system based on a physical hardware system, legal user behavior data containing user activities performed during legal electronic transactions and storing the legal user behavior data as a software behavior model;
monitoring, by a software behavior monitor, data packets transmitted in a transaction, and sending data packets to the software behavior verification system;
retrieving, by the behavior verification system, expected key sequences and information in the data packets;
comparing, by the behavior verification system, the key sequences and information retrieved from the data packets with that of the software behavior model;
if the key sequences and information retrieved from the data packets does not consistence with the software behavior model, it is determined that the transaction is an illegal electronic transactions, and the transaction is closed;
the software behavior in the software behavior model has behavior logic;
the software behavior in the software behavior model has behavior nodes, wherein the behavior nodes are arranged according to a transaction sequence.

### Claim 2 (depends on 1)

The method for monitoring and verifying software behavior according to claim 1, the software behavior model comprises behaviors of an E-Commerce website, a third-party payment platform, and a user client, and interaction modes between two of the above three terms.

### Claim 3 (depends on 1)

The method for monitoring and verifying software behavior according to claim 1, the data packets comprises URL address, a serial number of the E-Commerce website and a serial number of the third-party payment platform.

### Claim 4 (depends on 1)

The method for monitoring and verifying software behavior according to claim 1, the user receiving message prior to sending message.

### Claim 5 (depends on 3)

The method for monitoring and verifying software behavior according to claim 3, the data packets further comprises a subject name.

### Claim 6 (depends on 1)

The method for monitoring and verifying software behavior according to claim 1, the software behavior monitor is based on jpcap.

### Claim 7 (depends on 1)

The method for monitoring and verifying software behavior according to claim 1, the software behavior monitor has a socket connection with the behavior verification system.

### Claim 8

A system for monitoring and verifying software behavior comprising:
a memory, and a processor in communication with the memory;
a software behavior monitor, monitoring data packets transmitted in a transaction, and sending data packets to the software behavior verification system;
a software behavior verification module, wherein the software behavior verification module comprises a software behavior model module, receiving legal user behavior data containing user activities performed during legal electronic transactions based, and storing the legal user behavior data as a software behavior model, an information extracting module, retrieving expected key sequences and information in the data packets, a comparing module, configure for comparing the key sequences and information retrieved from the data packets with that of the software behavior model, a warning module, closing the transaction when the key sequences and information retrieved from the data packets does not consistence with the software behavior model;
the software behavior in the software behavior model has behavior logic;
the software behavior in the software behavior model has behavior nodes, wherein the behavior nodes are arranged according to a transaction sequence.

### Claim 9 (depends on 8)

The system for monitoring and verifying software behavior according to claim 8, the software behavior model comprises behaviors of an E-Commerce website, a third-party payment platform, and a user client, and interaction modes between two of the above three terms.

### Claim 10 (depends on 8)

The system for monitoring and verifying software behavior according to claim 8, the data packets comprises URL address, a serial number of the E-Commerce website and a serial number of the third-party payment platform.

### Claim 11 (depends on 8)

The system for monitoring and verifying software behavior according to claim 8, the user receiving message prior to sending message.

### Claim 12 (depends on 10)

The system for monitoring and verifying software behavior according to claim 10, the data packets further comprises a subject name.

### Claim 13 (depends on 8)

The system for monitoring and verifying software behavior according to claim 8, the software behavior monitor is based on jpcap.

### Claim 14 (depends on 10)

The system for monitoring and verifying software behavior according to claim 10, the software behavior monitor has a socket connection with the behavior verification system.

### Claim 15

A non-transitory computer-readable storage medium, containing a set of instructions which, when executed by a processor, cause the processor to perform a method for monitoring and verifying software behavior, the method comprising:
the method is executed by a processor;
receiving, by a software behavior verification system based on a physical hardware system, legal user behavior data containing user activities performed during legal electronic transactions and storing the legal user behavior data as a software behavior model;
monitoring, by a software behavior monitor, data packets transmitted in a transaction, and sending data packets to the software behavior verification system;
retrieving, by the behavior verification system, expected key sequences and information in the data packets;
comparing, by the behavior verification system, the key sequences and information retrieved from the data packets with that of the software behavior model;
if the key sequences and information retrieved from the data packets does not consistence with the software behavior model, it is determined that the transaction is an illegal electronic transactions, and the transaction is closed;
the software behavior in the software behavior model has behavior logic;
the software behavior in the software behavior model has behavior nodes, wherein the behavior nodes are arranged according to a transaction sequence.