Systems and methods of analyzing a software component

• US 9,396,082 B2
• Filed: 04/30/2014
• Issued: 07/19/2016
• Est. Priority Date: 07/12/2013
• Status: Active Grant

• Current Assignee: The Boeing Co.
• Original Assignee: The Boeing Co.
• Inventors: Kospiah, Shaun S., Grubel, Brian C., Snare, Brett W.
• Primary Examiner(s): Pearson, David
• Application Number:
  US14/266,674
• Publication Number:
  US 20150019915A1
• Time in Patent Office: 811 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: G06F 11/3003 Monitoring arrangements specially adapted to the computing system or computing system component being monitored
• CPC Class Codes: G06F 11/302 where the computing system component is a software system
• CPC Class Codes: G06F 11/3065 Monitoring arrangements determined by the means or processing involved in reporting the monitored data error or fault reporting or logging G06F11/0766
• CPC Class Codes: G06F 11/3089 Monitoring arrangements determined by the means or processing involved in sensing the monitored data, e.g. interfaces, connectors, sensors, probes, agents software debugging using additional hardware using a specific debug interface G06F11/3656; performance evaluation by tracing or monitoring G06F11/3466
• CPC Class Codes: G06F 11/3604 Software analysis for verifying properties of programs byte-code verification G06F9/44589
• CPC Class Codes: G06F 21/00 Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
• CPC Class Codes: G06F 21/561 Virus type analysis
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 21/567 using dedicated hardware
• CPC Class Codes: G06F 2201/815 Virtual middleware or OS functionality using virtual machines to implement generic software techniques for error detection or fault masking G06F11/1484
• CPC Class Codes: G06F 2201/865 Monitoring of software

Abstract

A particular method includes initiating, at an analyzer, execution of a software component at a first computing device. The first computing device includes hardware components and sensors. The sensors are external to the hardware components. A first hardware component of the hardware components is coupled to a second hardware component of the hardware components. A first sensor of the sensors is configured to monitor communications between the first hardware component and the second hardware component. The method also includes receiving monitoring data, from the first sensor, regarding a communication between the first hardware component and the second hardware component. The method further includes analyzing first effects of executing the software component on the first computing device based at least partially on the monitoring data.

Claims

1. A method comprising:

initiating, at an analyzer, execution of a software component at a first computing device, wherein the first computing device includes hardware components and sensors, wherein the sensors are external to the hardware components, wherein a first hardware component of the hardware components is coupled to a second hardware component of the hardware components, wherein a first sensor of the sensors is configured to monitor communications between the first hardware component and the second hardware component, and wherein the first sensor includes a voltmeter;

receiving monitoring data, from the first sensor, regarding a communication between the first hardware component and the second hardware component; and

analyzing first effects of executing the software component on the first computing device based at least partially on the monitoring data.

2. The method of claim 1, wherein the first hardware component includes a central processing unit and wherein the second hardware component includes at least one of a mouse, a keyboard, a video card, a sound card, an input device, an interface, a memory controller, a network interface, a universal serial bus interface, or a basic input output system.

3. The method of claim 1, further comprising determining a timestamp associated with the communication based on a time at which the monitoring data is received.

4. The method of claim 1, wherein the monitoring data includes contents of the communication.

5. The method of claim 4, further comprising:

determining a first type of the first hardware component based on a first identifier, wherein the monitoring data includes the first identifier;

determining a second type of the second hardware component based on a second identifier, wherein the monitoring data includes the second identifier; and

determining that the contents of the communication correspond to at least one of input data from an input device, output data to an output device, network data, or memory data, based on the first type of the first hardware component and the second type of the second hardware component.

6. The method of claim 4, further comprising, determining that the contents of the communication correspond to an input output request packet (IRP) in response to determining that contents of the communication correspond to a pointer to a data structure representative of the IRP.

7. The method of claim 1, further comprising determining whether the communication is received from the first hardware component or the second hardware component based on a source identifier, wherein the monitoring data includes the source identifier.

8. The method of claim 1, wherein the first hardware component and the second hardware component are prevented from writing to a memory component of the first computing device, and wherein the memory component stores a basic input output system (BIOS).

9. The method of claim 1, further comprising generating data indicating recommended procedures to detect execution of the software component at a second computing device, wherein the data indicating the recommended procedures is generated based on the first effects of executing the software component.

10. The method of claim 1, further comprising generating data indicating recommended procedures to prevent the first effects of executing the software component when the software component is executed at a second computing device.

11. A computer-readable storage device storing instructions that, when executed by a processor, cause the processor to perform operations comprising:

initiating execution of a software component at a first computing device, wherein the first computing device includes hardware components and sensors, wherein a first hardware component of the hardware components is coupled to a second hardware component of the hardware components, wherein a first sensor of the sensors is configured to monitor communications between the first hardware component and the second hardware component, and wherein the first sensor includes a voltmeter;

receiving monitoring data regarding a communication between the first hardware component and the second hardware component from the first sensor; and

analyzing first effects of executing the software component on the first computing device based on the monitoring data.

12. The computer-readable storage device of claim 11, wherein the operations further comprise storing the monitoring data.

13. The computer-readable storage device of claim 11, wherein the operations further comprise comparing the first effects to second effects of executing a second software component on a second computing device.

14. The computer-readable storage device of claim 13, wherein the second software component is executed on a virtual machine executing at the second computing device.

15. The computer-readable storage device of claim 14, wherein the second effects are determined based on monitoring events of an operating system executing on the virtual machine.

16. The computer-readable storage device of claim 13, wherein the second computing device includes second hardware components and second sensors, and wherein the second effects are determined based on second monitoring data received from a particular second sensor of the second sensors.

17. The computer-readable storage device of claim 13, wherein the software component and the second software component are distinct.

18. A device comprising:

a first hardware component configured to execute a software component;

a second hardware component configured to communicate with the first hardware component; and

a first sensor coupled to the first hardware component and the second hardware component, wherein the first sensor includes a voltmeter, and wherein the first sensor is configured to;

monitor communications between the first hardware component and the second hardware component; and

initiate an analysis of effects of executing the software component by sending, to an analyzer, monitoring data regarding a communication between the first hardware component and the second hardware component.

19. The device of claim 18, further comprising a memory component, wherein the first hardware component and the second hardware component are prevented from writing to the memory component, and wherein the memory component stores a basic input output system (BIOS).

20. The device of claim 18, wherein the first hardware component includes a central processing unit, and wherein the second hardware component includes at least one of a mouse, a keyboard, a video card, a sound card, an input device, an interface, a memory controller, a network interface, a universal serial bus interface, or a basic input output system.