System and method of software execution path identification

• US 8,776,029 B2
• Filed: 03/23/2012
• Issued: 07/08/2014
• Est. Priority Date: 03/23/2011
• Status: Active Grant

• Current Assignee: Zerodee, Inc.
• Original Assignee: Zerodee, Inc.
• Inventors: Puthuff, Neil
• Primary Examiner(s): Zhen, Li B
• Assistant Examiner(s): Lin, Hui-Wen
• Application Number:
  US13/428,572
• Publication Number:
  US 20120246625A1
• Time in Patent Office: 837 Days
• Field of Search: 717/130
• US Class Current: 717/131
• CPC Class Codes: G06F 11/28 by checking the correct order of processing G06F11/08 - G06F11/26 take precedence; monitoring patterns of pulse trains H03K5/19
• CPC Class Codes: G06F 11/3612 by runtime analysis performance monitoring G06F11/3466
• CPC Class Codes: G06F 11/3636 by tracing the execution of the program

Abstract

A method and system for creating uniquely representative execution path identifiers of software program. The method comprises the steps of running the software program, continuously accessing execution information of the software program, identifying execution sequences of the execution information, and creating a unique execution path identifier of each of the execution sequences by summing the execution information when the execution information is within a functional boundary thereof so as to create an execution path identifier representing a unique execution sequence of the execution information. The system comprises an execution path identification creator continuously receiving and accessing execution information of the software program, identifying execution sequences of the execution information and creating the unique execution path identifier of each of the execution sequences.

Claims

1. A method for creating software execution path identification, said method comprising the steps of:

running a software program;

continuously accessing execution information of said software program;

identifying execution sequences of said software execution information; and

creating a unique execution path identifier of each of said execution sequences by summing said execution information when said execution information is within a functional boundary thereof so as to create an execution path identifier representing a unique execution sequence of said execution information;

the step of creating said unique execution path identifier comprises the steps of;

removing any location-specific content from said execution information to produce address-independent canonical execution information;

hashing said canonical execution information;

modifying said hashed canonical execution information depending on conditions present at a time of execution; and

creating an accumulated sum of said modified canonical execution information until said functional boundaries are reached, said accumulated sum represents said execution path identifier.

2. The method according to claim 1, wherein said execution information is in the form of conditional execution instructions.

3. The method according to claim 2, wherein said conditional execution instructions are in the form of at least one of opcodes and condition flags.

4. The method according to claim 1, further comprising the step of determining if each of said execution sequences of said software execution information being a new execution sequence or a repeat execution sequence.

5. The method according to claim 4, wherein the step of determining if each of said execution sequences being a new execution sequence or a repeat execution sequence includes the step of comparing said execution path identifier determined in the step of creating said unique execution path identifier with previously stored execution path identifiers.

6. The method according to claim 1, further comprising the step of recreating said software execution information from said execution path identifier.

7. A system for creating software execution path identification, said system comprising an execution path identification creator including a logic device for continuously receiving and accessing execution information of a software program and identifying execution sequences of said software execution information, and an accumulator for creating a unique execution path identifier of each of said execution sequences by summing said execution information when said execution information is within a functional boundary thereof so as to create an execution path identifier representing a unique execution sequence of said execution information;

said functional boundary detected by said logic device;

said logic device including a microprocessor;

said execution path identification creator further includes;

a device for removing any location-specific content from said execution information to produce address-independent canonical execution information;

a device for hashing said canonical execution information;

a device for modifying said hashed canonical execution information depending on conditions present at a time of execution; and

a device for creating an accumulated sum of said modified canonical execution information until said functional boundaries are reached, said accumulated sum represents said execution path identifier.

8. The system according to claim 7, wherein said execution information is in the form of conditional execution instructions.

9. The system according to claim 8, wherein said conditional execution instructions are in the form of at least one of opcodes and condition flags.

10. The system according to claim 7, further comprising a local storage medium collecting said stream of said execution path identifiers for later retrieval and decompression.

11. The system according to claim 10, further comprising a comparison logic provided for determining if each of said execution sequences of said software execution information is a new execution sequence or a repeat execution sequence by comparing said execution path identifier determined by said execution path identification creator with said execution path identifiers previously stored in said local storage medium.

12. The system according to claim 7, further comprising a device for recreating said software execution information from said execution path identifier.