Identifying interpreted programs through class loading sequences

• US 8,516,448 B2
• Filed: 12/21/2007
• Issued: 08/20/2013
• Est. Priority Date: 12/21/2006
• Status: Active Grant

• Current Assignee: International Business Machines Corporation, ServiceNow Incorporated
• Original Assignee: International Business Machines Corporation
• Inventors: Morgia, Claudio, Secomandi, Antonio, Paone, Fabio
• Primary Examiner(s): Dao, Thuy
• Assistant Examiner(s): ST LEGER, GEOFFREY R
• Application Number:
  US11/962,643
• Publication Number:
  US 20080152071A1
• Time in Patent Office: 2,069 Days
• Field of Search: None
• US Class Current: 717/127
• CPC Class Codes: G06F 11/3466 Performance evaluation by tracing or monitoring
• CPC Class Codes: G06F 21/121 Restricting unauthorised execution of programs
• CPC Class Codes: G06F 21/16 Program or content traceability, e.g. by watermarking
• CPC Class Codes: G06F 2201/865 Monitoring of software
• CPC Class Codes: G06F 2221/2135 Metering

Abstract

A solution is proposed for metering the usage of Java programs. For this purpose, each Java program to be metered is associated with a fingerprint defined by a reference sequence of classes that must be loaded for its execution. The sequence of classes that are actually loaded by the Java Virtual Machine (JVM) is monitored, for example, by means of a wrapper for a class loader of the JVM. The sequence of loaded classes is then used to identify the Java program in execution (which fingerprint matches this sequence of loaded classes).

Claims

1. A computer-implemented method, comprising:

associating, to meter usage of a predefined plurality of interpreted programs on a data processing system, each one of the predefined plurality of interpreted programs with an indication of at least one reference sequence of interpreter actions that identify the interpreted program, where each interpreted program is executed under control of an interpreter within a separate runtime environment and the reference sequence of interpreter actions comprises a reference sequence of at least one interpreter class load operation and at least one of a file read operation, a port opening operation, and a socket use operation;

monitoring, from within each runtime environment, an executed sequence of interpreter actions performed by the interpreter within that runtime environment, where the monitored executed sequence of interpreter actions comprises at least one executed interpreter class load operation and at least one of an executed file read operation, an executed port opening operation, and an executed socket use operation;

comparing a portion of the monitored executed sequence of interpreter actions performed by each interpreter with a plurality of reference sequences of interpreter actions associated with the predefined plurality of interpreted programs; and

detecting the usage of each of the predefined plurality of interpreted programs in response to a matching of the monitored executed sequence of interpreter actions with one of the associated at least one reference sequence of interpreter actions.

2. The computer-implemented method according to claim 1, where the execution of each interpreted program comprises loading of a plurality of classes.

3. The computer-implemented method according to claim 2, where the step of monitoring comprises:

intercepting at least one request of loading a class, being submitted by each interpreted program, by a wrapper within each runtime environment for a class loader within that runtime environment;

forwarding the at least one request to the class loader to cause the class loader to load the class; and

logging an indication of the loaded class by the wrapper within that runtime environment.

4. The computer-implemented method according to claim 3, where the step of logging comprises discarding each loaded class belonging to a predefined set of standard classes.

5. The computer-implemented method according to claim 1, where each reference sequence of interpreter actions comprises a fixed number of actions, and the step of comparing the portion of the monitored executed sequence of interpreter actions performed by each interpreter with the plurality of reference sequences of interpreter actions associated with the predefined plurality of interpreted programs comprises comparing a fixed number of the monitored executed sequence of interpreter actions performed by each interpreter with the plurality of reference sequences of interpreter actions associated with the predefined plurality of interpreted programs.

6. The computer-implemented method according to claim 5, where each executed interpreter action is associated with an identifier and the indication of each reference sequence of interpreter actions comprises a hash value based on identifiers of interpreter actions of the reference sequence of interpreter actions, and where the step of comparing comprises:

calculating an additional hash value of the fixed number of the monitored executed sequence of interpreter actions; and

searching the calculated additional hash value among hash values of reference sequences of interpreter actions.

7. The computer-implemented method according to claim 1, where the step of detecting the usage of each of the predefined plurality of interpreted programs comprises, for each monitored executed sequence of interpreter actions, iteratively determining a set of eligible ones of the interpreted programs comprising the one of the associated at least one reference sequence of interpreter actions matching the monitored executed sequence of interpreter actions until the set of eligible ones of the interpreted programs comprises a single eligible interpreted program.

8. A system, comprising:

a processor;

a data bus coupled to the processor; and

a computer-usable storage medium embodying computer program code, the computer-usable storage medium being coupled to the data bus, the computer program code comprising instructions executable by the processor and configured for;

associating, to meter usage of a predefined plurality of interpreted programs, each one of the predefined plurality of interpreted programs with an indication of at least one reference sequence of interpreter actions that identify the interpreted program, where each interpreted program is executed under control of an interpreter within a separate runtime environment and the reference sequence of interpreter actions comprises a reference sequence of at least one interpreter class load operation and at least one of a file read operation, a port opening operation, and a socket use operation;

monitoring, from within each runtime environment, an executed sequence of interpreter actions performed by the interpreter within that runtime environment, where the monitored executed sequence of interpreter actions comprises at least one executed interpreter class load operation and at least one of an executed file read operation, an executed port opening operation, and an executed socket use operation;

comparing a portion of the monitored executed sequence of interpreter actions performed by each interpreter with a plurality of reference sequences of interpreter actions associated with the predefined plurality of interpreted programs; and

detecting the usage of each of the predefined plurality of interpreted programs in response to a matching of the monitored executed sequence of interpreter actions with one of the associated at least one reference sequence of interpreter actions.

9. The system of claim 8, where the execution of each interpreted program comprises loading of a plurality of classes.

10. The system of claim 9, where the computer program code comprising instructions for monitoring comprises instructions configured for:

intercepting at least one request of loading a class, being submitted by each interpreted program, by a wrapper within each runtime environment for a class loader within that runtime environment;

forwarding the at least one request to the class loader to cause the class loader to load the class; and

logging an indication of the loaded class by the wrapper within that runtime environment.

11. The system of claim 10, where the computer program code comprising instructions for logging comprises instructions configured for discarding each loaded class belonging to a predefined set of standard classes.

12. The system of claim 8, where each reference sequence of interpreter actions comprises a fixed number of actions, and the computer program code comprising instructions for comparing the portion of the monitored executed sequence of interpreter actions performed by each interpreter with the plurality of reference sequences of interpreter actions associated with the predefined plurality of interpreted programs comprises instructions configured for comparing a fixed number of the monitored executed sequence of interpreter actions performed by each interpreter with the plurality of reference sequences of interpreter actions associated with the predefined plurality of interpreted programs.

13. The system of claim 12, where each executed interpreter action is associated with an identifier and the indication of each reference sequence of interpreter actions comprises a hash value based on identifiers of interpreter actions of the reference sequence of interpreter actions, and where the computer program code comprising instructions for comparing comprises instructions configured for:

calculating an additional hash value of the fixed number of the monitored executed sequence of interpreter actions; and

searching the calculated additional hash value among hash values of reference sequences of interpreter actions.

14. The system of claim 8, where the computer program code comprising instructions for detecting the usage of each of the predefined plurality of interpreted programs comprises, for each monitored executed sequence of interpreter actions, instructions configured for iteratively determining a set of eligible ones of the interpreted programs comprising the one of the associated at least one reference sequence of interpreter actions matching the monitored executed sequence of interpreter actions until the set of eligible ones of the interpreted programs comprises a single eligible interpreted program.

15. A computer-usable storage memory embodying computer program code, the computer program code comprising computer executable instructions configured for:

associating, to meter usage of a predefined plurality of interpreted programs, each one of the predefined plurality of interpreted programs with an indication of at least one reference sequence of interpreter actions that identify the interpreted program, where each interpreted program is executed under control of an interpreter within a separate runtime environment and the reference sequence of interpreter actions comprises a reference sequence of at least one interpreter class load operation and at least one of a file read operation, a port opening operation, and a socket use operation;

monitoring, from within each runtime environment, an executed sequence of interpreter actions performed by the interpreter within that runtime environment, where the monitored executed sequence of interpreter actions comprises at least one executed interpreter class load operation and at least one of an executed file read operation, an executed port opening operation, and an executed socket use operation;

comparing a portion of the monitored executed sequence of interpreter actions performed by each interpreter with a plurality of reference sequences of interpreter actions associated with the predefined plurality of interpreted programs; and

detecting the usage of each of the predefined plurality of interpreted programs in response to a matching of the monitored executed sequence of interpreter actions with one of the associated at least one reference sequence of interpreter actions.

16. The computer-usable storage memory of claim 15, where the execution of each interpreted program comprises loading of a plurality of classes.

17. The computer-usable storage memory of claim 16, where the computer program code comprising instructions for monitoring comprises instructions configured for:

intercepting at least one request of loading a class, being submitted by each interpreted program, by a wrapper within each runtime environment for a class loader within that runtime environment;

forwarding the at least one request to the class loader to cause the class loader to load the class; and

logging an indication of the loaded class by the wrapper within that runtime environment.

18. The computer-usable storage memory of claim 17, where the computer program code comprising instructions for logging comprises instructions configured for discarding each loaded class belonging to a predefined set of standard classes.

19. The computer-usable storage memory of claim 15, where each reference sequence of interpreter actions comprises a fixed number of actions, and the computer program code comprising instructions for comparing the portion of the monitored executed sequence of interpreter actions performed by each interpreter with the plurality of reference sequences of interpreter actions associated with the predefined plurality of interpreted programs comprises instructions configured for comparing a fixed number of the monitored executed sequence of interpreter actions performed by each interpreter with the plurality of reference sequences of interpreter actions associated with the predefined plurality of interpreted programs.

20. The computer-usable storage memory of claim 19, where each executed interpreter action is associated with an identifier and the indication of each reference sequence of interpreter actions comprises a hash value based on identifiers of interpreter actions of the reference sequence of interpreter actions, and where the computer program code comprising instructions for comparing comprises instructions configured for:

calculating an additional hash value of the fixed number of the monitored executed sequence of interpreter actions; and

searching the calculated additional hash value among hash values of reference sequences of interpreter actions.