Systems and methods of analyzing a software component

• US 9,280,369 B1
• Filed: 07/12/2013
• Issued: 03/08/2016
• Est. Priority Date: 07/12/2013
• Status: Active Grant

• Current Assignee: The Boeing Co.
• Original Assignee: The Boeing Co.
• Inventors: Kirk, Terrance J., Bialek, Matthew S., Kospiah, Shaun, Lemm, Timothy M., Thompson, Scott G.
• Primary Examiner(s): Pearson, David
• Application Number:
  US13/941,384
• Time in Patent Office: 970 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: G06F 2009/45591 Monitoring or debugging support
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects

Abstract

A particular method includes executing a software component on a virtual machine executing at a computing device. The method also includes monitoring kernel level events of an operating system executing on the virtual machine and monitoring application level events of the operating system. The method further includes analyzing effects of executing the software component on the virtual machine based on the kernel level events and the application level events.

Claims

1. A method comprising:

executing, based on a first set of operating conditions, a software component on a virtual machine executing at a computing device;

monitoring kernel level events of an operating system executing on the virtual machine;

monitoring application level events of the operating system;

analyzing first effects of executing the software component on the virtual machine based on the kernel level events and the application level events

determining an operating condition of the operating system to modify based on the first effects, wherein the operating condition is determined by comparing the first effects to third effects associated with a database entry, and wherein the database entry indicates the operating condition;

modifying the operating condition to generate a second set of operating conditions;

executing, based on the second set of operating conditions, the software component on the virtual machine; and

analyzing second effects of executing the software component with the second set of operating conditions based on monitored second kernel level events and based on monitored second application level events.

2. The method of claim 1, wherein the kernel level events include a kernel level function call and wherein an application level event includes an application level function call.

3. The method of claim 1, wherein monitoring kernel level events includes storing data regarding one or more kernel level function calls, wherein the data regarding a kernel level function call identifies a particular kernel level function, one or more arguments of the kernel level function call, a timestamp indicating when the kernel level function call is detected, or a combination thereof.

4. The method of claim 1, further comprising generating data indicating recommended procedures to detect, based on the first effects of executing the software component, execution of the software component at a second computing device, wherein the first effects include accessing a particular region of a first memory associated with the virtual machine, wherein the recommended procedures include monitoring a second particular region of a second memory associated with the second computing device, and wherein the particular region of the first memory and the second particular region of the second memory are equivalent.

5. The method of claim 1, wherein analyzing the second effects includes comparing the second effects to fourth effects associated with the database entry.

6. The method of claim 1, wherein a particular application level event results in multiple corresponding kernel level events.

7. The method of claim 6, further comprising storing data identifying the particular application level event and the multiple corresponding kernel level events in a memory.

8. A system comprising:

a processor; and

a memory storing instructions that, when executed by the processor, cause the processor to perform operations comprising;

executing, based on a first set of operating conditions, a software component on a virtual machine executing at a computing device;

monitoring kernel level events of an operating system executing on the virtual machine;

monitoring application level events of the operating system;

analyzing first effects of executing the software component on the virtual machine based on the kernel level events and the application level events

determining an operating condition of the operating system to modify based on the first effects, wherein the operating condition is determined by comparing the first effects to third effects associated with a database entry, and wherein the database entry indicates the operating condition;

modifying the operating condition to generate a second set of operating conditions;

executing, based on the second set of operating conditions, the software component on the virtual machine; and

analyzing second effects of executing the software component with the second set of operating conditions based on monitored second kernel level events and based on monitored second application level events.

9. The system of claim 8, wherein the kernel level events are monitored using a kernel level sensor.

10. The system of claim 8, wherein the operations further comprise:

detecting a kernel level function call before execution of a kernel level function associated with the kernel level function call; and

storing first data regarding the kernel level function call.

11. The system of claim 10, wherein the first data regarding the kernel level function call identifies the kernel level function, one or more arguments of the kernel level function call, a timestamp indicating when the kernel level function call is detected, or a combination thereof.

12. The system of claim 10, wherein the operations further comprise:

executing the kernel level function; and

storing second data regarding effects of executing the kernel level function on the virtual machine.

13. The system of claim 12, wherein the effects of executing the kernel level function include modifying the particular region of memory.

14. The system of claim 8, wherein the application level events are monitored using an application level sensor.

15. The system of claim 8, wherein the operations further comprise:

detecting an application level function call before execution of an application level function associated with the application level function call;

storing first data regarding the application level function call;

executing the application level function; and

storing second data regarding effects of executing the application level function on the virtual machine.

16. The system of claim 15, wherein executing the application level function results in one or more corresponding kernel level function calls and wherein the second data further includes data regarding the one or more corresponding kernel level function calls.

17. The system of claim 16, wherein a particular kernel level function is associated with each of the corresponding kernel level function calls and wherein the second data further includes data regarding effects of executing the particular kernel level function on the virtual machine.

18. A computer-readable storage device storing instructions that, when executed by a processor, cause the processor to perform operations comprising:

executing, based on a first set of operating conditions, a software component on a virtual machine executing at a computing device;

monitoring kernel level events of an operating system executing on the virtual machine;

monitoring application level events of the operating system;

analyzing first effects of executing the software component on the virtual machine based on the kernel level events and the application level events;

determining an operating condition of the operating system to modify based on the first effects, wherein the operating condition is determined by comparing the first effects to third effects associated with a database entry, and wherein the database entry indicates the operating condition;

modifying the operating condition to generate a second set of operating conditions;

executing, based on the second set of operating conditions, the software component on the virtual machine; and

analyzing second effects of executing the software component with the second set of operating conditions based on monitored second kernel level events and based on monitored second application level events.

19. The computer-readable storage device claim 18, wherein the operations further comprise generating data indicating recommended procedures to detect, based on the first effects of executing the software component, execution of the software component at a second computing device, wherein the first effects include accessing a particular region of a first memory associated with the virtual machine, wherein the recommended procedures include monitoring a second particular region of a second memory associated with the second computing device, and wherein the particular region of the first memory and the second particular region of the second memory are equivalent.

20. The computer-readable storage device of claim 18, wherein analyzing effects of executing the software component includes comparing effects of executing the software component to publicized effects of executing the software component.