Monitoring execution of software using online path signatures
AssigneeArm Limited
InventorMichael Bartling
Life of this patent
Estimating the term…
Abstract
Techniques, supported by corresponding apparatuses and methods, are disclosed for monitoring execution of software and generating path signatures which are characteristic of the behaviour of the software. Multiple approximate nearest neighbour searching hash tables are generated in dependence on such path signatures. Observed path signatures are also compared against the previously generated content of these runtime multiple approximate nearest neighbour searching hash tables and a behavioural classification is determined in dependence on hash collision-based similarity between the observed path signature and the content of the multiple approximate nearest neighbour searching hash tables.
Claims19
Apparatus comprising:
- event capturing circuitry to monitor execution of software and to generate a series of event data in dependence on the execution of the software:
- path signature generation circuitry to generate an observed path signature dependent on the series of event data;
- runtime hash table storage to store runtime approximate nearest neighbour searching hash tables;
- hashing circuitry to perform a query-and-conditional-insert process on the runtime approximate nearest neighbour searching hash tables in dependence on the observed path signature;
- and
- behaviour indication circuitry to indicate a behavioural classification of the observed path signature in dependence on hash collision-based similarity between the observed path signature and content of the runtime approximate nearest neighbour searching hash tables.
A method of data processing comprising:
- monitoring execution of software;
- generating a series of event data in dependence on the execution of the software;
- generating an observed path signature dependent on the series of event data;
- storing runtime approximate nearest neighbour searching hash tables;
- performing a query-and-conditional-insert process on the runtime approximate nearest neighbour searching hash tables in dependence on the observed path signature;
- and
- indicating a behavioural classification of the observed path signature in dependence on hash collision-based similarity between the observed path signature and content of the runtime approximate nearest neighbour searching hash tables.
A computer-readable storage medium storing in a non-transient fashion software which when executed on a computing device causes the computing device to carry out the steps of:
- monitoring execution of software;
- generating a series of event data in dependence on the execution of the software;
- generating an observed path signature dependent on the series of event data;
- storing runtime approximate nearest neighbour searching hash tables;
- performing a query-and-conditional-insert process on the runtime approximate nearest neighbour searching hash tables in dependence on the observed path signature;
- and
- indicating a behavioural classification of the observed path signature in dependence on hash collision-based similarity between the observed path signature and content of the runtime approximate nearest neighbour searching hash tables.
Dependencies are inferred from the claim text.