SOFTWARE BEHAVIOR MODELING DEVICE, SOFTWARE BEHAVIOR MODELING METHOD, SOFTWARE BEHAVIOR VERIFICATION DEVICE, AND SOFTWARE BEHAVIOR VERIFICATION METHOD

• US 20110154487A1
• Filed: 03/28/2008
• Published: 06/23/2011
• Est. Priority Date: 03/28/2007
• Status: Active Grant

• Current Assignee: NTT Docomo Incorporated (Nippon Telegraph and Telephone Corporation)
• Original Assignee: NTT Docomo Incorporated (Nippon Telegraph and Telephone Corporation)
• Inventors: Nakayama, Takehiro, Takeshita, Atsushi, Kato, Kazuhiko, Suzuki, Katsuhiro, Ikebe, Yuka, Abe, Hirotake
• Granted Patent: US 8,407,799 B2
• Time in Patent Office: Days
• US Class Current: 726/22
• CPC Class Codes: G06F 11/3612 by runtime analysis performance monitoring G06F11/3466
• CPC Class Codes: G06F 21/52 during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow

Abstract

A software behavior modeling device which forms a model of a behavior of software includes; an event information acquisition unit configured to acquire event information indicating a specific event which occurs during execution of the software; a stack information acquisition unit configured to acquire stack information stored in a call stack at a time of occurrence of the specific event; a score setting unit configured to set a score in accordance with a storage location in which each element included in the stack information is stored in the call stack; and a model generating unit configured to form a model of a relationship between the specific event and the element by using the score, and to generate a behavior model of the software.

Claims

1. A software behavior modeling device which forms a model of a behavior of software, comprising:

an event information acquisition unit configured to acquire event information indicating a specific event which occurs during execution of the software;

a stack information acquisition unit configured to acquire stack information stored in a call stack at a time of occurrence of the specific event;

a score setting unit configured to set a score in accordance with a storage location in which each element included in the stack information is stored in the call stack; and

a model generating unit configured to form a model of a relationship between the specific event and the element by using the score, and to generate a behavior model of the software.

2. The software behavior modeling device according to claim 1, wherein the model generating unit extracts modeling object elements to be used for generating the behavior model from the elements stored in the call stack, and generates the behavior model by using the storage location and the score corresponding to the modeling object element.

3. The software behavior modeling device according to claim 2, wherein the modeling object elements are a predetermined number of elements which are extracted in descending order from the elements stored in the call stack.

4. The software behavior modeling device according to claim 2, wherein the modeling object elements are elements, whose scores are not less than a predetermined threshold, among the elements stored in the call stack.

5. The software behavior modeling device according to claim 1, wherein the model generating unit forms a model of a relationship between the specific event and a processing order of the elements so as to generate the behavior model.

6. A software behavior modeling method for forming a model of a behavior of software, comprising:

a step A of acquiring event information indicating a specific event which occurs during execution of the software;

a step B of acquiring stack information stored in a call stack at a time of occurrence of the specific event;

a step C of setting a score in accordance with a storage location in which each element included in the stack information is stored in the call stack; and

a step D of forming a model of a relationship between the specific event and the element by using the score and thereby generating a behavior model of the software.

7. A software behavior verification device which verifies a behavior of software, comprising:

an event information acquisition unit configured to acquire event information indicating a specific event which occurs during execution of the software;

a stack information acquisition unit configured to acquire stack information stored in a call stack at a time of occurrence of the specific event;

a behavior model acquisition unit configured to acquire a behavior model in which a model of a relationship between the specific event and the element is formed in advance; and

a behavior verification unit configured to verify if the behavior of the software is different from the behavior model, based on the specific event acquired by the event information acquisition unit and the stack information acquired by the stack information acquisition unit,

wherein the behavior model is generated by using a score set in accordance with a storage location where each element included in the stack information is stored in the call stack when the software is normally executed in advance, and

the behavior verification unit verifies if the behavior of the software is different from the behavior model, based on the score.

8. The software behavior verification device according to claim 7, wherein the behavior verification unit cumulatively adds the score and detects an abnormal behavior of the software based on the cumulatively added score.

9. A software behavior verification method for verifying a behavior of software, comprising:

a step A of acquiring event information indicating a specific event which occurs during execution of the software;

a step B of acquiring stack information stored in a call stack at a time of occurrence of the specific event;

a step C of acquiring a behavior model in which a model of a relationship between the specific event and the element is formed in advance; and

a step D of verifying if the behavior of the software is different from the behavior model, based on the specific event acquired at the step A and the stack information acquired at step B,

wherein the behavior model is generated by using a score set in accordance with a storage location where each element included in the stack information is stored in the call stack when the software is normally executed in advance, and

at the step D, it is verified if the behavior of the software is different from the behavior model, based on the score.