# US 2013/0160128 A1 · Application monitoring through collective record and replay > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2013/0160128 A1 - Document ID: US20130160128A1 - Status: Published application - Kind: A1 - Application number: 13/325,062 - Filed: 2011-12-14 - Published: 2013-06-20 - Earliest claimed: 2011-12-14 - Assignees: Microsoft Corporation - Inventors: Brendan Dolan-Gavitt; David Alexander Molnar; Weidong Cui - Web page: https://patentgrep.com/patent/US20130160128A1 ## CPC - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - G06F 11/3414: {Workload generation, e.g. scripts, playback} - G06F 11/3466: {Performance evaluation by tracing or monitoring} - G06F 21/52: during program execution, e.g. stack integrity {; Preventing unwanted data erasure; Buffer overflow} - G06F 21/552: {involving long-term monitoring or reporting} - G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities} - G06F 21/6281: {at program execution time, where the protection is within the operating system} - G06F 11/3476: {Data logging (G06F11/14, G06F11/2205 take precedence)} - G06F 2201/865: Monitoring of software - G06F 2221/033: Test or assess software - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Methods and systems for application monitoring through collective record and replay are disclosed herein. The method includes recording a number of execution traces for an application from a number of user devices at a runtime library, wherein the number of execution traces relates to non-deterministic data. The method also includes replaying the number of execution traces to determine whether a behavior of the application creates a security risk. ## Claims ### Claim 1 A method for application monitoring through collective record and replay, comprising: recording a plurality of execution traces for an application from a plurality of user devices at a runtime library, wherein the plurality of execution traces relates to a plurality of non-deterministic data; and replaying the plurality of execution traces to determine whether a behavior of the application creates a security risk. ### Claim 2 (depends on 1) The method of claim 1, wherein recording the plurality of execution traces comprises sending the plurality of execution traces from the plurality of user devices to the runtime library through a network. ### Claim 3 (depends on 1) The method of claim 1, wherein replaying the plurality of execution traces comprises analyzing the plurality of execution traces recorded within the runtime library to determine whether the application is utilizing the plurality of non-deterministic data in an unauthorized manner. ### Claim 4 (depends on 3) The method of claim 3, wherein utilizing the plurality of non-deterministic data in the unauthorized manner comprises sharing the plurality of non-deterministic data with an unapproved third party. ### Claim 5 (depends on 1) The method of claim 1, wherein recording the plurality of execution traces for the application comprises probabilistically logging each of the plurality of execution traces for a given event from each of a plurality of individual user devices. ### Claim 6 (depends on 1) The method of claim 1, wherein recording and replaying the plurality of execution traces comprises writing to and reading from a memory device coupled to the runtime library. ### Claim 7 (depends on 1) The method of claim 1, wherein recording the plurality of execution traces for the application comprises redirecting an application programming interface (API) call from an API to the runtime library, wherein the runtime library is configured to log the plurality of execution traces relating to the API call. ### Claim 8 (depends on 7) The method of claim 7, comprising returning the API call to the application from the runtime library and enabling a normal execution of the API call. ### Claim 9 (depends on 1) The method of claim 1, wherein replaying the plurality of execution traces comprises executing an application programming interface (API) call using the plurality of execution traces recorded by the runtime library and utilizing a result of the API call to analyze the behavior of the application. ### Claim 10 (depends on 1) The method of claim 1, wherein replaying the plurality of execution traces comprises maintaining an original ordering and latency of application programming interface (API) calls within each of the plurality of execution traces. ### Claim 11 A system for application monitoring through collective record and replay, comprising: an application configured to send a plurality of execution traces to an application programming interface (API) from a plurality of user devices, wherein the plurality of execution traces relates to a plurality of non-deterministic data; and a runtime library configured to: redirect the plurality of execution traces from the API to the runtime library; record the plurality of execution traces on a memory device; and replay the plurality of execution traces to determine whether the application is functioning as expected. ### Claim 12 (depends on 11) The system of claim 11, wherein the plurality of execution traces comprises a sequence of API calls and non-deterministic data related to the API calls. ### Claim 13 (depends on 11) The system of claim 11, wherein the plurality of non-deterministic data comprises a plurality of variable data. ### Claim 14 (depends on 11) The system of claim 11, wherein the plurality of non-deterministic data comprises a plurality of user-private data, and wherein the plurality of user-private data comprises a name, a day of the week, a day of the month, a gender, an age, a phone number, an email address, a contact list, a message inbox, a message outbox, a global positioning system (GPS) location, a birthday, or a credit card number, or any combinations thereof. ### Claim 15 (depends on 11) The system of claim 11, wherein the plurality of execution traces comprises a plurality of partial execution traces. ### Claim 16 (depends on 15) The system of claim 15, wherein the runtime library is configured to replay the plurality of partial execution traces by combining the plurality of partial execution traces with recorded data of the API from other execution traces. ### Claim 17 (depends on 11) The system of claim 11, comprising a network configured to communicably couple the runtime library, the application, the API, and the memory device, or any combinations thereof. ### Claim 18 (depends on 11) The system of claim 11, wherein the runtime library is configured to determine a probability that an execution trace relating to a particular application will be recorded from an individual user device. ### Claim 19 (depends on 11) The system of claim 11, wherein the runtime library is configured to replay the plurality of execution traces from the plurality of user devices by recombining each of the plurality of execution traces recorded from each of the plurality of user devices to generate a replay of an event relating to the application. ### Claim 20 One or more non-transitory, computer-readable storage media for storing computer readable instructions, the computer-readable instructions providing a collective record and replay system when executed by one or more processing devices, the computer-readable instructions comprising code configured to: perform probabilistic logging for an application to record a plurality of execution traces relating to a plurality of non-deterministic data from a plurality of user devices; and determine whether the application is utilizing the plurality of non-deterministic data for an unauthorized purpose by replaying the plurality of executions traces.