Software operation modeling device, software operation monitoring device, software operation modeling method, and software operation monitoring method

A software operation modeling method implemented by software operation modeling device implemented by a processor, comprising:

• determining an issuing order of function calls executed in each of specific events in the course of executing software, the specific events each being assigned an identifier;
• obtaining return addresses loaded on a stack at the time of occurrence of the specific events thereby defining an order in which the return addresses are loaded on the stack;
• recording the return addresses in an order of occurrence of the specific events:
• defining the recorded return addresses as the issuing order of the function calls:
• statistically determining a co-occurrence relationship between the specific event and the issuing order of the function calls by determining differences between specific events having the same identifier;
• and
• recording the co-occurrence relationship as an operation model of the software.

A software operation monitoring device comprising:

• an operation model obtaining unit implemented by a processor and configured
• to statistically determine a co-occurrence relationship between each of specific events each having an assigned identifier and an issuing order of function calls executed in the specific events by determining differences between specific events having the same identifier, the specific events being issued by software which is monitored, and
• to obtain an operation model indicating the co-occurrence relationship;
• a function call order obtaining unit configured to determine the issuing order of the function calls executed by the software in the course of executing the software, the function call order obtaining unit including a stack information obtaining unit configured
• to obtain return addresses loaded on a stack at the time of occurrence of the specific events thereby defining an order in which the return addresses are loaded on the stack,
• to record the return addresses in order of occurrence of the specific events, and
• to define the recorded return addresses as the issuing order of the function calls;
• and
• an operation monitor configured to determine a deviation, from the operation model, of the co-occurrence relationship between the specific events and the issuing order of the function calls.

A software operation monitoring method implemented on a software operation monitoring device, comprising:

• statistically determining, via a processor of the software operation monitoring device, a co-occurrence relationship between each of specific events each having an assigned identifier and an issuing order of function calls executed in the specific events by determining the difference between specific events having the same identifier, the specific events being issued by software which is monitored;
• obtaining an operation model indicating the co-occurrence relationship;
• determining the issuing order of the function calls executed by the software in the course of executing the software;
• obtaining return addresses loaded on a stack at the time of occurrence of the specific events thereby defining an order in which the return addresses are loaded on the stack;
• recording the return addresses in order of occurrence of the specific events;
• defining the recorded return addresses as the issuing order of the function calls;
• and
• determining a deviation, from the operation model, of the co-occurrence relationship between the specific events and the issuing order of the function calls.