# US 12,223,045 B1 · Protecting customers against supply chain attacks by detecting a behavior change between versions of an application program > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,223,045 B1 - Document ID: US12223045B1 - Status: Granted - Kind: B1 - Application number: 17/894,690 - Filed: 2022-08-24 - Granted: 2025-02-11 - Earliest claimed: 2022-08-24 - Assignees: VicOne Corporation - Applicants: VicOne Corporation - Inventors: Shih-Han Hsu; Wei-Jen Chang; Yao-Tang Chang; Yi-Li Cheng - Web page: https://patentgrep.com/patent/US12223045B1 ## CPC - G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities} - G06F 2221/033: Test or assess software - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Versions of an application program are evaluated to protect a customer from a supply chain attack. The versions of the application program are executed in to identify behaviors exhibited by the versions of the application program, each of the behaviors including activities that perform computer operations. A behavior change is detected by identifying a behavior that is not common to the versions of the application program. ## Claims ### Claim 1 A method of evaluating an application program to protect a customer against a supply chain attack, the method comprising: executing a first version of the application program to identify a first set of behaviors exhibited by the first version of the application program during execution, each behavior of the first set of behaviors comprising activities that perform computer operations; executing a second version of the application program to identify a second set of behaviors exhibited by the second version of the application program during execution, each behavior of the second set of behaviors comprising activities that perform computer operations; identifying a first behavior in the first set of behaviors that is not present in the second set of behaviors; identifying a second behavior in the second set of behaviors that is not present in the first set of behaviors; identifying a third behavior in the first set of behaviors that is not present in the second set of behaviors; merging the second behavior and the third behavior together in response to determining that the second behavior is similar to the third behavior; after merging the second behavior and the third behavior together, detecting a behavior change of the application program in response to identifying the first behavior; and issuing a behavior change notification in response to detecting the behavior change of the application program. ### Claim 2 (depends on 1) The method of claim 1, further comprising, before detecting the behavior change of the application program: identifying the second behavior in the second set of behaviors that is not present in the first set of behaviors; determining that the first behavior is not similar to the second behavior. ### Claim 3 (depends on 2) The method of claim 2, wherein each behavior in the first and second set of behaviors is represented as a vector and determining that the first behavior is not similar to the second behavior includes calculating a distance between a first vector that represents the first behavior and a second vector that represents the second behavior. ### Claim 4 (depends on 1) The method of claim 1, wherein the application program is provided by a supplier to the customer over the Internet. ### Claim 5 (depends on 4) The method of claim 4, wherein the first and second versions of the application program are evaluated in an evaluation system that is external to the supplier and the customer. ### Claim 6 A method of evaluating an application program to protect a customer against a supply chain attack, the method comprising: executing a first version of the application program to detect a plurality of activities of the first version of the application program that perform computer operations; representing the plurality of activities as a plurality of activity vectors; clustering the plurality of activity vectors into a plurality of clusters, a center of each cluster being designated as a behavior vector that represents a behavior of the first version of the application program; receiving a second version of the application program; identifying a first behavior vector of the second version of the application program that is not common to both the first and second versions of the application program; identifying a second behavior vector of the second version of the application program that is not common to both the first and second versions of the application program; identifying a first behavior vector of the first version of the application program that is not common to both the first and second versions of the application program; merging the second behavior vector of the second version of the application program and the first behavior vector of the first version of the application program to generate a behavior vector that is common to both the first and second versions of the application program in response to determining that the second behavior vector of the second version of the application program is within a predetermined distance to the first behavior vector of the first version of the application program; and after merging the second behavior vector of the second version of the application program and the first behavior vector of the first version of the application program, detecting a behavior change of the application program in response to identifying the first behavior vector of the second version of the application program that is not common to both the first and second versions of the application program. ### Claim 7 (depends on 6) The method of claim 6, further comprising, before detecting the behavior change of the application program, determining that the first behavior vector of the first version of the application program is not within a predetermined distance to the first behavior vector of the second application program. ### Claim 8 (depends on 6) The method of claim 6, wherein the application program is provided by a supplier to the customer over the Internet.