Software behavior modeling apparatus, software behavior monitoring apparatus, software behavior modeling method, and software behavior monitoring method

A software behavior monitoring apparatus, comprising:

• a model obtaining unit configured to obtain a function model for each specific events issued by a software to be monitored, the function model indicating a co-occurrence relation between a function call and an order of an issuance of an arbitrary function return, executed between specific events issued by a software to be monitored;
• a termination information obtaining unit configured to obtain termination information of the software to be monitored under a software execution environment;
• a stack information obtaining unit configured
• to obtain i-th stack frame information for identifying a first stack frame stacked on a call stack at a time when a specific event occurs and (i−1)-th stack frame information for identifying a second stack frame stacked on a call stack at a time before the specific event occurs in executing the software, while specifying an order that the first and second stack frame are stacked on the call stack,
• to suspend obtaining the first stack frame information from the call stack when the termination information transmitted from the termination information obtaining unit is detected in searching the call stack, and to record the first stack frame information in an order of an occurrence of the specific event;
• a stack difference information generating unit configured to generate, by a computer, stack difference information formed between the (i−1)-th stack information and the i-th stack information, the stack difference information being a combination of a portion of the (i−1)-th stack information and a portion of the i-th stack information, both of the (i−1)-th stack information and the i-th stack information being obtained by the stack information obtaining unit;
• and
• a behavior monitoring unit configured to determine a difference between the stack difference information generated by the stack difference information generating unit and the software behavior model obtained by the model obtaining unit.

A software behavior modeling method implemented by a software behavior modeling apparatus, comprising:

• obtaining i-th stack frame information for identifying a first stack frame stacked on a call stack at a time when a specific event occurs and (i−1)-th stack frame information for identifying a second stack frame stacked on a call stack at a time before the specific event occurs during the execution of software under a software execution environment, while specifying an order that the first and second stack frame are stacked on the call stack;
• recording the i-th stack frame information in an order of an occurrence of the specific event;
• comparing, sequentially from a bottom of the call stack, (i−1)-th stack information with i-th stack information, where i represents a natural number;
• recording termination information indicating a boundary between an identical portion and a non-identical portion, the identical portion indicating a portion where the (i−1)-th stack information and a i-th stack information are identical and have a same position on the call stack, the non-identical portion indicating a portion following a stack frame in which a difference is detected between the (i−1)-th stack information and the i-th stack information;
• generating, by a computer and as stack difference information, information formed between the (i−1)-th stack information and the i-th stack information, the stack difference information being a combination of a portion of the (i−1)-th stack information with a portion of the i-th stack information, both of the portions being located from an uppermost stack frame to the termination information;
• and
• generating a software behavior model by taking a hash value of the stack difference information or deriving a correlation rule between an identifier of the specific event and the stack difference information.

A software behavior monitoring method implemented by a software behavior modeling apparatus, comprising:

• obtaining specific events, and a behavior model for each specific event, the behavior model indicating a co-occurrence relation between a function call and an order of an issuance of an arbitrary function return, executed between the specific events issued by a software to be monitored;
• obtaining termination information of the software to be monitored, under a software execution environment;
• obtaining i-th stack frame information for identifying a first stack frame stacked on a call stack at a time when a specific event occurs and (i−1)-th stack frame information for identifying a second stack frame stacked on a call stack at a time before the specific event occurs in executing a software, while specifying an order that the first stack frame is stacked on the call stack;
• suspending obtaining of the first stack frame information from the call stack when the termination information transmitted from the termination information obtaining unit is detected in searching the call stack;
• recording the first stack frame information in an order of an occurrence of the specific event;
• generating, by a computer and as stack difference information, information formed between the (i−1)-th stack information and the i-th stack information, the stack difference information being a combination of a portion of (i−1)-th stack information and a portion of i-th stack information, both of the (i−1)-th stack information and the i-th stack information being obtained by the stack information obtaining unit;
• and
• determining a difference between the stack difference information generated by the stack difference information generating unit, and the software behavior model obtained by the model obtaining unit.