Detecting anomalous function execution in a program

• US 10,592,390 B2
• Filed: 05/28/2014
• Issued: 03/17/2020
• Est. Priority Date: 05/28/2014
• Status: Active Grant

• Current Assignee: Nintendo Company Limited
• Original Assignee: Nintendo Company Limited
• Inventors: Rabin, Steve
• Primary Examiner(s): Maskulinski, Michael
• Application Number:
  US14/288,747
• Publication Number:
  US 20150347285A1
• Time in Patent Office: 2,120 Days
• CPC Class Codes: G06F 11/0721 within a central processing unit [CPU]
• CPC Class Codes: G06F 11/0736 in functional embedded systems, i.e. in a data processing system designed as a combination of hardware and software dedicated to performing a certain function testing or monitoring of automated control systems G05B23/02
• CPC Class Codes: G06F 11/0751 Error or fault detection not based on redundancy power supply failures G06F1/30; network fault management H04L41/06
• CPC Class Codes: G06F 11/0772 Means for error signaling, e.g. using interrupts, exception flags, dedicated error registers
• CPC Class Codes: G06F 11/3013 where the computing system is an embedded system, i.e. a combination of hardware and software dedicated to perform a certain function in mobile devices, printers, automotive or aircraft systems testing or monitoring of control systems or parts thereof G05B23/02
• CPC Class Codes: G06F 11/3024 where the computing system component is a central processing unit [CPU]
• CPC Class Codes: G06F 11/321 Display for diagnostics, e.g. diagnostic result display, self-test user interface
• CPC Class Codes: G06F 11/34 Recording or statistical evaluation of computer activity, e.g. of down time, of input/output operation ; Recording or statistical evaluation of user activity, e.g. usability assessment
• CPC Class Codes: G06F 11/3616 using software metrics
• CPC Class Codes: G06F 11/362 Software debugging
• CPC Class Codes: G06F 2201/865 Monitoring of software

Abstract

Methods and systems for detecting anomalous function execution in a program, such as a video game or simulation program, are described herein. Certain methods attempt to isolate and score functions that behave in a particular manner that is deemed to be problematic within a repetitive program. Other methods can use the repetitive nature of the program to directly compare and isolate problematic functions.

Claims

1. A system for detecting anomalous execution in a program, comprising:

a processing system having at least one processor and at least one memory, the processing system configured to;

obtain program execution data of a running program, running on an information processing device operatively coupled to the system, to identify aspects of function execution, the program execution data stored in a memory of the information processing device;

identify one or more patterns of execution for one or more functions executing in the running program;

generate a score associated with the one or more patterns of execution for the one or more functions;

identify a type of anomaly, from one or more anomaly classifications stored in the memory of the processing system, based on, at least in part, the score associated with the one or more patterns of execution for the one or more functions; and

generate a display showing function execution over time including a graphical display of at least the identified type of anomaly.

2. The system of claim 1, wherein the processing system is further configured to identify the type of anomaly based on a degree of periodicity of the one or more executing functions.

3. The system of claim 1, wherein the processing system is further configured to identify the type of anomaly based on a degree of non-periodicity of the one or more executing functions.

4. The system of claim 1, wherein the processing system is further configured to identify the type of anomaly based on behavior exhibited during one or more frames of function execution.

5. The system of claim 1, wherein the program execution data includes, at least, address data indicating where in the memory program instructions are stored.

6. The system of claim 1, wherein the program execution data includes, at least, count of times one or more functions are called in the running program.

7. A system for detecting anomalous execution in a program, comprising:

a processing system having at least one processor and at least one memory, the processing system configured to;

obtain program execution data of a running program to identify one or more patterns of function execution;

identify a type of anomaly, from one or more types of anomaly classifications stored in the memory of the processing system, based on, at least in part, a score associated with the one or more patterns of function execution; and

generate a display showing function execution including at least the identified type of anomaly.

8. The system of claim 7, wherein the processing system is further configured to assign one or more classifications to the identified anomalies.

9. The system of claim 8, wherein the one or more classifications are assigned to the identified anomalies based on a periodicity of function execution exhibited by the anomalies.

10. The system of claim 8, wherein the one or more classifications are assigned to the identified anomalies based on a non-periodicity of function execution exhibited by the anomalies.

11. The system of claim 8, wherein the one or more classifications are assigned to the identified anomalies based on aspects related to execution behavior occurring during one or more frames of execution.

12. The system of claim 7, wherein the generated display comprising a graph showing a percentage of execution along a first axis and function execution over time along a second axis.

13. The system of claim 7, wherein the identified type of anomaly is selected from a group comprising at least one of rare function execution, flutter function execution, swell function execution, and/or wild function execution.

14. The system of claim 7, wherein the program execution data includes, at least, address data indicating where in the memory program instructions are stored.

15. A method implemented using an information processing system having at least one processor and at least one memory, the method comprising:

obtaining program execution data of a running program to identify one or more patterns of function execution;

identifying a type of anomaly, from one or more types of anomaly classifications stored in the memory of the information processing system, based on, at least in part, a score associated with the one or more patterns of function execution; and

generating a display showing function execution including at least the identified type of anomaly from the one or more types of anomalies.

16. The method of claim 15, wherein the one or more types of anomalies are assigned a classification based on a periodicity of function execution exhibited by the anomalies.

17. The method of claim 15, wherein the one or more types of anomalies are assigned a classification based on a non-periodicity of function execution exhibited by the anomalies.

18. The method of claim 15, wherein the one or more types of anomalies are assigned a classification based on aspects related to execution behavior occurring during one or more frames of execution.

19. A non-transitory computer readable storage medium comprising a computer program having code executable by an information processing apparatus, the computer program, when executed, causing the information processing apparatus to:

obtain program execution data of a running program to identify one or more patterns of function execution;

identify a type of anomaly, from one or more types of anomaly classifications stored in a memory of the information processing apparatus, based on, at least in part, a score associated with the one or more patterns of function execution; and

generate a display showing function execution including at least the identified type of anomaly from the one or more types of anomalies.

20. The non-transitory computer readable storage medium of claim 19, wherein the one or more types of anomalies are assigned a classification based on a periodicity of function execution exhibited by the anomalies.

21. The non-transitory computer readable storage medium of claim 19, wherein the one or more types of anomalies are assigned a classification based on a non-periodicity of function execution exhibited by the anomalies.

22. The non-transitory computer readable storage medium of claim 19, wherein the one or more types of anomalies are assigned a classification based on aspects related to execution behavior occurring during one or more frames of execution.