DETECTING ANOMALOUS FUNCTION EXECUTION IN A PROGRAM

• US 20150347285A1
• Filed: 05/28/2014
• Published: 12/03/2015
• Est. Priority Date: 05/28/2014
• Status: Active Grant

• Current Assignee: Nintendo Company Limited
• Original Assignee: Nintendo Company Limited
• Inventors: RABIN, Steve
• Granted Patent: US 10,592,390 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 11/0721 within a central processing unit [CPU]
• CPC Class Codes: G06F 11/0736 in functional embedded systems, i.e. in a data processing system designed as a combination of hardware and software dedicated to performing a certain function testing or monitoring of automated control systems G05B23/02
• CPC Class Codes: G06F 11/0751 Error or fault detection not based on redundancy power supply failures G06F1/30; network fault management H04L41/06
• CPC Class Codes: G06F 11/0772 Means for error signaling, e.g. using interrupts, exception flags, dedicated error registers
• CPC Class Codes: G06F 11/3013 where the computing system is an embedded system, i.e. a combination of hardware and software dedicated to perform a certain function in mobile devices, printers, automotive or aircraft systems testing or monitoring of control systems or parts thereof G05B23/02
• CPC Class Codes: G06F 11/3024 where the computing system component is a central processing unit [CPU]
• CPC Class Codes: G06F 11/321 Display for diagnostics, e.g. diagnostic result display, self-test user interface
• CPC Class Codes: G06F 11/34 Recording or statistical evaluation of computer activity, e.g. of down time, of input/output operation ; Recording or statistical evaluation of user activity, e.g. usability assessment
• CPC Class Codes: G06F 11/3616 using software metrics
• CPC Class Codes: G06F 11/362 Software debugging
• CPC Class Codes: G06F 2201/865 Monitoring of software

Abstract

Methods and systems for detecting anomalous function execution in a program, such as a video game or simulation program, are described herein. Certain methods attempt to isolate and score functions that behave in a particular manner that is deemed to be problematic within a repetitive program. Other methods can use the repetitive nature of the program to directly compare and isolate problematic functions.

Claims

1. A system for detecting anomalous execution in a program, comprising:

a processing system having at least one processor, the processing system configured to;

monitor a running program to identify aspects of function execution;

identify one or more execution traits for one or more functions executing in the running program;

detect anomalies based on the identified traits of the one or more executing functions;

identify one or more types of anomalies from the detected anomalies; and

generate a display showing function execution over time including a graphical display of at least the detected anomalies.

2. The system of claim 1, wherein the processing system is further configured to identify a type of detected anomaly based on a degree of periodicity of the one or more executing functions.

3. The system of claim 1, wherein the processing system is further configured to identify a type of detected anomaly based on a degree of non-periodicity of the one or more executing functions.

4. The system of claim 1, wherein the processing system is further configured to identify a type of detected anomaly based on behavior exhibited during one or more frames of function execution.

5. A system for detecting anomalous execution in a program, comprising:

a processing system having at least one processor, the processing system configured to;

monitor a running program to identify aspects of function execution;

detect anomalies in the aspects of function execution; and

generate a display showing function execution including at least the detected anomalies.

6. The system of claim 5, wherein the processing system is further configured to analyze the detected anomalies and assign one or more classifications to the detected anomalies.

7. The system of claim 6, wherein the one or more classifications are assigned to the detected anomalies based on a periodicity of function execution exhibited by the anomalies.

8. The system of claim 6, wherein the one or more classifications are assigned to the detected anomalies based on a non-periodicity of function execution exhibited by the anomalies.

9. The system of claim 6, wherein the one or more classifications are assigned to the detected anomalies based on aspects related to execution behavior occurring during one or more frames of execution.

10. The system of claim 5, wherein the generated display comprising a graph showing a percentage of execution along a first axis and function execution over time along a second axis.

11. A method implemented using an information processing system having at least one processor, the method comprising:

monitoring a running program to identify aspects of function execution;

detecting anomalies in the aspects of function execution;

identifying one or more types of anomalies from the detected anomalies; and

generating a display showing function execution including at least the identified one or more types of anomalies in the aspects of function execution.

12. The method of claim 11, wherein the one or more types of anomalies are assigned based on a periodicity of function execution exhibited by the anomalies.

13. The method of claim 11, wherein the one or more types of anomalies are assigned based on a non-periodicity of function execution exhibited by the anomalies.

14. The method of claim 11, wherein the one or more types of anomalies are assigned based on aspects related to execution behavior occurring during one or more frames of execution.

15. The method of claim 11, wherein the generated display comprising a graph showing a percentage of execution along a first axis and function execution over time along a second axis.

16. A non-transitory computer readable storage medium storing a computer program having code executable by an information processing apparatus, the computer program, when executed, causing the information processing apparatus to provide execution comprising:

monitoring a running program to identify aspects of function execution;

detecting anomalies in the aspects of function execution;

identifying one or more types of anomalies from the detected anomalies; and

generating a display showing function execution including at least the identified one or more types of anomalies in the aspects of function execution.

17. The non-transitory computer readable storage medium of claim 16, wherein the one or more types of anomalies are assigned based on a periodicity of function execution exhibited by the anomalies.

18. The non-transitory computer readable storage medium of claim 16, wherein the one or more types of anomalies are assigned based on a non-periodicity of function execution exhibited by the anomalies.

19. The non-transitory computer readable storage medium of claim 16, wherein the one or more types of anomalies are assigned based on aspects related to execution behavior occurring during one or more frames of execution.

20. The non-transitory computer readable storage medium of claim 16, wherein the generated display comprising a graph showing a percentage of execution along a first axis and function execution over time along a second axis.