Back to results
US 12,223,045 B1Granted
Protecting customers against supply chain attacks by detecting a behavior change between versions of an application program
AssigneeVicOne Corporation
InventorsShih-Han Hsu, Wei-Jen Chang, Yao-Tang Chang, Yi-Li Cheng
Life of this patent
Estimating the term…
Abstract
Versions of an application program are evaluated to protect a customer from a supply chain attack. The versions of the application program are executed in to identify behaviors exhibited by the versions of the application program, each of the behaviors including activities that perform computer operations. A behavior change is detected by identifying a behavior that is not common to the versions of the application program.
Claims8
A method of evaluating an application program to protect a customer against a supply chain attack, the method comprising:
- executing a first version of the application program to identify a first set of behaviors exhibited by the first version of the application program during execution, each behavior of the first set of behaviors comprising activities that perform computer operations;
- executing a second version of the application program to identify a second set of behaviors exhibited by the second version of the application program during execution, each behavior of the second set of behaviors comprising activities that perform computer operations;
- identifying a first behavior in the first set of behaviors that is not present in the second set of behaviors;
- identifying a second behavior in the second set of behaviors that is not present in the first set of behaviors;
- identifying a third behavior in the first set of behaviors that is not present in the second set of behaviors;
- merging the second behavior and the third behavior together in response to determining that the second behavior is similar to the third behavior;
- after merging the second behavior and the third behavior together, detecting a behavior change of the application program in response to identifying the first behavior;
- and
- issuing a behavior change notification in response to detecting the behavior change of the application program.
6 more elements
A method of evaluating an application program to protect a customer against a supply chain attack, the method comprising:
- executing a first version of the application program to detect a plurality of activities of the first version of the application program that perform computer operations;
- representing the plurality of activities as a plurality of activity vectors;
- clustering the plurality of activity vectors into a plurality of clusters, a center of each cluster being designated as a behavior vector that represents a behavior of the first version of the application program;
- receiving a second version of the application program;
- identifying a first behavior vector of the second version of the application program that is not common to both the first and second versions of the application program;
- identifying a second behavior vector of the second version of the application program that is not common to both the first and second versions of the application program;
- identifying a first behavior vector of the first version of the application program that is not common to both the first and second versions of the application program;
- merging the second behavior vector of the second version of the application program and the first behavior vector of the first version of the application program to generate a behavior vector that is common to both the first and second versions of the application program in response to determining that the second behavior vector of the second version of the application program is within a predetermined distance to the first behavior vector of the first version of the application program;
- and
- after merging the second behavior vector of the second version of the application program and the first behavior vector of the first version of the application program, detecting a behavior change of the application program in response to identifying the first behavior vector of the second version of the application program that is not common to both the first and second versions of the application program.
7 more elements
Dependencies are inferred from the claim text.