Computer software module apparatus, circuit apparatus, apparatus and method for improved software execution monitoring

Abstract

A software monitoring apparatus (100) comprising a controller (101) configured to: a) receive a software code module (215); b) introduce a plurality of probes (211) into the software code module (215), each probe (211) arranged to provide an output (212) when executed; c) execute the software code module (215), generating an image log file (213) based on the outputs (212) of the probes (211); d) provide an image analysis (221) of the image log file (213); e) provide an indication (222) of expected behaviour based on the image analysis (221); f) receive an indication (216) of actual behaviour; g) compare the expected behaviour indicated by the indication (222) of expected behaviour with the actual behaviour indicated by the indication (216) of actual behaviour; and provide an alert (231) based on the comparison.

Description

Technical Field

[0001] This invention relates to apparatuses, apparatuses including computer software modules, apparatuses including circuits, apparatuses and methods for providing improved software execution monitoring methods, and more particularly to apparatuses, apparatuses including computer software modules, apparatuses including circuits, and devices and methods for providing improved software execution monitoring methods using neural networks. Background Technology

[0002] As computers and processing power have increased, so too have the applications and complexity of computer software. Several techniques and tools have been developed to develop and ensure correct operation (testing and debugging). Debugging is typically used to ensure that software can be compiled and executed without errors, while testing verifies that the software program can be executed and produce correct results without crashing. Two main techniques used to ensure correct program execution are (event) logging and tracing.

[0003] Log recording is the act of saving logs; log files are files that record events that occur during the operation of an operating system or other software. Event logging provides system administrators with information useful for diagnosis and auditing. Early in the development cycle, different categories of events to be logged and the details to be displayed in event messages are often considered. Many event logging technologies allow, or require, to assign a unique "code" to each type of event, which is used by event logging software or a separate viewer (such as Event Viewer) to format and output human-readable messages. This helps locate and allows system administrators to more easily obtain information related to the problem that occurred. Event logging is used to record high-level information (often failure information).

[0004] Software tracing provides developers with information useful for debugging. This information is used both during the development cycle and after software release. Tracing is suitable for monitoring low-level operations and is embedded in the actual code of the software program. The information logged in the tracing indicates where the trace originated, enabling developers to understand how the code executes.

[0005] Therefore, logging and tracing require developers to analyze the software program both before and during development to ensure relevant events are logged or understandable traces are generated. This is a demanding task, requiring significant development resources and is prone to error introduction due to its primarily human nature. Furthermore, substantial knowledge and experience are needed to properly analyze event logs and traces to identify errors in the software program's execution.

[0006] Therefore, a more effective way is needed to provide monitoring of software programs and analyze such monitoring. Summary of the Invention

[0007] The inventors have recognized that automation can indeed facilitate the monitoring of software programs and the analysis of such monitoring. They have also recognized that as monitoring becomes automated, the exact nature of logs or traces does not need to be readable by human developers, and that the data can be leveraged by profoundly altering the nature of the generated data rather than through traditional analytical tools. As illustrated below, this provides an extremely simple and elegant way to deliver automated monitoring, solving the problem of how to provide easily implementable and reliable monitoring—a problem that has existed since the advent of modern software programs, dating back even to the last century.

[0008] The inventors also recognized that the most advanced analytical tools available are designed for image analysis, and therefore suggested that it is good to generate images as the output of a monitor that can be analyzed using image analysis tools, such as the various neural network tools and techniques commonly used for image analysis.

[0009] Therefore, one objective of this teaching is to provide a way to monitor computer programs by generating visual or image log files, thereby overcoming or at least reducing or mitigating the problems in question, wherein the visual or image log files are analyzed using image analysis tools, thereby utilizing very advanced techniques available for image analysis.

[0010] According to one aspect, a software monitoring device is provided, the software monitoring device including a controller configured to: a) receive a software code module; b) introduce a plurality of detectors into the software code module, each detector being arranged to provide output when executed; c) execute the software code module and generate an image log file based on the outputs of the detectors; d) provide image analysis of the image log file; e) provide an indication of expected behavior based on the image analysis; f) receive an indication of actual behavior; g) compare the expected behavior indicated by the indication of expected behavior with the actual behavior indicated by the indication of actual behavior; and provide an alarm based on the comparison.

[0011] The solution can be implemented as a software solution, a hardware solution, or a hybrid of software and hardware components.

[0012] In one embodiment, the image analysis tool is based on a neural network.

[0013] In one embodiment, the controller is also configured to: b2) train the image analysis tool after introducing multiple detectors.

[0014] In one embodiment, the controller is also configured to adjust at least one of a plurality of detectors during training to provide an output that provides a higher success rate for the image analysis tool.

[0015] In one embodiment, the detector's output is related to the characteristics of the image log file.

[0016] In one embodiment, the controller is also configured to provide the image analysis to identify patterns in an image log file that are associated with expected behavior.

[0017] In one such embodiment, the controller is further configured to: identify a first pattern associated with a first expected behavior; identify a second pattern associated with a second expected behavior; and provide a first indication of the first expected behavior and a second indication of the second behavior.

[0018] In one embodiment, the controller is further configured to: a1) receive a second software code module; b1) introduce a second plurality of detectors into the second software code module, each detector being arranged to provide output when executed; c1) execute the second software code module to generate a second image log file based on the outputs of the second plurality of detectors; d1) provide image analysis of the second image log file; e1) provide a second indication of a second expected behavior based on the second image analysis; g1) compare the expected behavior indicated by the indication of the expected behavior with the second expected behavior indicated by the second indication of the second expected behavior with the actual behavior indicated by the indication of the actual behavior; and provide an alarm based on the comparison.

[0019] In one embodiment, the image analysis tool is based on object detection. In such an embodiment, object detection is based on a deep neural network model.

[0020] According to one aspect, a method for use in a software monitoring apparatus is provided for providing a method for software monitoring as taught herein. The method includes receiving a software code module and introducing a plurality of detectors into the software code module, wherein each detector is arranged to provide output when executed. The method further includes: executing or causing the software code module to be executed, generating an image log file based on the detector outputs. The method further includes: providing image analysis of the image log file, and providing an indication of expected behavior based on the image analysis. The method further includes: receiving an indication of actual behavior, comparing the expected behavior indicated by the indication of expected behavior with the actual behavior indicated by the indication of actual behavior, and providing an alarm based on the comparison.

[0021] According to one aspect, a computer-readable medium carrying computer instructions is provided, which, when loaded into and executed by a controller of a software monitoring device, enable the software monitoring device to implement the method according to this document.

[0022] According to one aspect, a software component (or module) device is provided according to embodiments of the teachings herein. The software component device is adapted for use in a software monitoring apparatus as taught herein to perform automated software monitoring as taught herein.

[0023] The software component arrangement includes: a software component for receiving a software code module. The software component arrangement further includes: a software component for introducing a plurality of detectors into the software code module, wherein each detector is arranged to provide output when executed. The software component arrangement further includes: a software component for executing the software code module and for generating an image log file based on the detector outputs. The software component arrangement further includes: a software component for providing image analysis of the image log file and a software component for providing an indication of expected behavior based on the image analysis. The software component arrangement further includes: a software component for receiving an indication of actual behavior and a software component for comparing the expected behavior indicated by the indication of expected behavior with the actual behavior indicated by the indication of actual behavior. The software component arrangement further includes: a software component for providing an alarm based on the comparison.

[0024] According to one aspect, a circuit-included apparatus for software monitoring is provided, based on embodiments of the teachings herein. The circuit-included apparatus for software monitoring is suitable for use in software monitoring devices as taught herein, for automated software monitoring.

[0025] The circuit-integrated apparatus for automated software monitoring includes circuitry for receiving a software code module. It also includes circuitry for introducing a plurality of detectors into the software code module, each detector being arranged to provide an output upon execution. Furthermore, the apparatus includes circuitry for executing the software code module and for generating an image log file based on the detector outputs. It further includes circuitry for providing image analysis of the image log file and for providing an indication of expected behavior based on the image analysis. The apparatus also includes circuitry for receiving an indication of actual behavior and for comparing the expected behavior indicated by the indication of expected behavior with the actual behavior indicated by the indication of actual behavior. Finally, the apparatus includes circuitry for providing an alarm based on the comparison.

[0026] Other embodiments and advantages of the invention will be set forth in the detailed description. It should be noted that the teachings herein have found application in software monitoring devices across many fields of software monitoring. Attached Figure Description

[0027] Embodiments of the invention will now be described with reference to the accompanying drawings, which illustrate non-limiting examples of how the invention can be conceptualized into practice.

[0028] Figure 1A A schematic diagram of a software monitoring device according to an embodiment of the present invention is shown;

[0029] Figure 1B A schematic diagram of a software monitoring device according to an embodiment of the present invention is shown;

[0030] Figure 2 A schematic diagram of a software monitoring model according to an embodiment of the teachings herein is shown;

[0031] Figure 3 A flowchart of a general method according to an embodiment of the present invention is shown;

[0032] Figure 4 A component view of a software component apparatus according to embodiments taught herein is shown;

[0033] Figure 5 A component view of a device including circuitry according to embodiments of the teachings herein is shown; and

[0034] Figure 6 A schematic diagram is shown of a computer-readable medium carrying computer instructions that, when loaded into and executed by a device controller, enable the device to implement embodiments of the present invention. Detailed Implementation

[0035] Figure 1A A schematic diagram of a software monitoring device 100 according to an embodiment of the present invention is shown. The software monitoring device includes a controller 101 and a memory 102. It should be noted that the software monitoring device 100 may include a single device or may be distributed across multiple devices and apparatuses.

[0036] Controller 101 is configured to control the overall operation of the software monitoring device 100. In one embodiment, controller 101 is a general-purpose processor. In another embodiment, controller 101 is a combination of a graphics controller and a general-purpose controller. As those skilled in the art will understand, there are many alternatives for how the controller can be implemented, such as using field-programmable gate arrays, AISCs, GPUs, etc., as an addition or alternative. For the purposes of this application, all these possibilities and alternatives will be simply referred to as controller 101.

[0037] Memory 102 is configured to store data and computer-readable instructions, which, when loaded into controller 101, instruct how to control software monitoring device 100. Memory 102 may include one or more memory modules, partitions, allocations, units, or devices, but they will be considered as part of the same overall memory 102. A memory unit may be used to store data, a memory unit may be used for a communication interface (see below) to store settings, and so on. As those skilled in the art will understand, there are many possibilities regarding where data should be stored, and therefore, the general memory 102 for software monitoring device 100 is considered to include any and all such memory units used for the purposes of this application. As those skilled in the art will understand, there are many alternatives regarding how the memory is implemented, such as using non-volatile memory circuitry (e.g., EEPROM memory circuitry) or volatile memory circuitry (e.g., RAM memory circuitry). Memory 102 may also be an allocation of a larger memory partition. For the purposes of this application, all such alternatives will be simply referred to as memory 102.

[0038] In one embodiment, the software monitoring device 100 may further include a communication interface 103. The communication interface may be wired and / or wireless. The communication interface may include several interfaces.

[0039] In one embodiment, the communication interface includes a USB (Universal Serial Bus) interface. In another embodiment, the communication interface includes an analog interface, a CAN (Controller Area Network) bus interface, an I2C (Integrated Circuit) interface, or other interfaces.

[0040] In one embodiment, the communication interface includes a radio frequency (RF) communication interface. In one such embodiment, the communication interface includes Bluetooth. TM Interface, WiFi TM Interface, ZigBee TM Interface, RFID TM (Radio Frequency Identifier) ​​interface, Wireless Display (WiDi) interface, Miracast interface, and / or other RF interfaces commonly used for short-range RF communication. In alternatives or supplements to such embodiments, the communication interface includes a cellular communication interface, such as a fifth-generation (5G) cellular communication interface, an LTE (Long Term Evolution) interface, a GSM (Global System for Mobile Communications) interface, and / or other interfaces commonly used for cellular communication. In one embodiment, the communication interface is configured to communicate using the UPnP (Universal Plug and Play) protocol. In one embodiment, the communication interface is configured to communicate using the DLNA (Digital Living Network Device) protocol.

[0041] In one embodiment, the communication interface 103 is configured to communicate using more than one of the example techniques given above.

[0042] The communication interface 103 can be configured to enable the software monitoring device 100 to communicate with other devices, such as other software monitoring devices 100 and / or smartphones, internet tablets, tablets, or other computers.

[0043] User interface 104 may be included in software monitoring device 100. Alternatively or additionally, user interface 104 (at least a portion thereof) may be remotely included in software monitoring device 100 via communication interface 103. In this case, user interface (at least a portion thereof) is not a physical device within software monitoring device 100, but rather receives user input or provides user output via communication interface 103 through a remote device (not shown). Examples of such remote devices include mobile phones, tablets, or computers.

[0044] Figure 1B A schematic diagram of an example of a software monitoring device 100 according to an embodiment of the present invention is shown. The software monitoring device 100 in this example is a desktop computer (or workstation) 100, which includes a housing 105 housing a controller 101, a memory 102, and a communication interface 103. In this example, the workstation also includes a user interface 104 comprising a display and a keyboard.

[0045] Figure 2 A schematic diagram of a software monitoring model 200 included in a software monitoring device 100 according to one embodiment of the teachings herein is shown (i.e., a processing module of the software monitoring device 100 is shown). The software monitoring model 200 is arranged to be executed by a controller 101 of the software monitoring device 100 according to the present invention, a software component device 400 according to the present invention, a circuit-included device 500 according to the present invention, or used by a method according to the present invention. It should be noted that different parts of the software monitoring device model may be executed by different parts of corresponding execution devices.

[0046] The software monitoring model 200 includes a detector generator module 210, which is arranged to incorporate detectors 211 into the actual code of the software code module 215. Detector 211 is typically a piece of code that generates output 212 each time detector 211 is executed. In one embodiment, detector 211 is arranged to provide graphical data as output 212. According to the invention, the detector is automatically incorporated into the code and located at a position automatically selected by the detector generator module 210, thus eliminating the need for manual interaction by the developer, thereby saving resources and eliminating the risk of introducing (human) errors.

[0047] Furthermore, since the detectors are introduced automatically, the overhead of introducing more detectors is negligible compared to the overhead of manual introduction. Because more detectors can be used with minimal (if any) additional cost, the code can be more comprehensively covered, eliminating the need to understand the code's purpose to identify where to input detectors and what the associated outputs of those detectors should be, as was required in previous systems. This significantly reduces the amount of work required to introduce detectors.

[0048] The software monitoring model 200 also includes a sensor module 220, which is arranged to monitor the execution of the software code module 215. Therefore, the sensor module 220 is arranged to receive output 212 generated by the detector 211. When the detector 211 generates output, the output can be received, and the sensor module 220 is arranged to process the output, thereby providing an image log file 213 based on the received output 212. In an additional or alternative embodiment, the detector generator module 210 provides the image log file 213 to the sensor module 220.

[0049] Sensor module 220 includes image analysis tool 221. Since sensor module 220 has received image log file 213, the image log file is processed by image analysis tool 221 to determine a graphic pattern 214 in the image log file 213. Graphic pattern 214 is associated with a use case (e.g., the behavior or function of computer software module 215). Because graphic pattern 214 is identified, sensor module is therefore able to report an indication 222 of the expected behavior of software code module 215 (i.e., the behavior of the associated use case). In one embodiment, image analysis tool 221 is a neural network, such as a convolutional neural network. In another embodiment, image analysis tool 221 is based on an object detection model, such as a deep learning neural network. In such an embodiment, pattern 214 can be considered as an object to be identified.

[0050] The software monitoring model 200 also includes a monitoring manager module 230, which receives an indication 222 of expected behavior from the sensor module 220. The monitoring manager module 230 also receives an indication 216 of the actual behavior of the software code module 215, i.e., an indication of the resulting behavior of the execution of the software code module 215. The monitoring manager module 230 is configured to compare the expected behavior indicated by the indication 222 with the actual behavior indicated by the indication 216, and if there is a mismatch, the monitoring manager module 230 is configured to issue an alarm 231 for this result. An alarm is one embodiment designed to provide information about the difference between the expected behavior and the actual behavior. Even if there is a match, an alarm can still be issued, wherein the alarm is an alarm for this result. An alarm can also provide information about differences that are considered too small to not provide a match. Therefore, alarms are provided based on comparison.

[0051] Alarms can be external signaling to a user or operator, such as text, audio, and / or visual output. Alternatively or additionally, alarms can be external signaling to another device, such as a computer-readable message or other means of data transfer between the two devices. Such alarms can cause the receiving device to issue or provide further alerts. Alternatively or additionally, alarms can be internal signaling to another module or component of the same device. Such alarms can cause the receiving party to issue or provide further alerts.

[0052] In one embodiment, the software monitoring model 200 further includes a training module 225 for training the image analysis tool 221. The training module 225 is configured to execute the software code module 215 using known input parameters 226. In one embodiment, the input parameters 226 are provided by the training module 225. In another embodiment, the input parameters 226 are provided to and stored by the training module 225, potentially for use in repeated use cases. The training module 225 also receives instructions 216 of the actual behavior to be performed and forwards them as expected behavior 222 to the image analysis tool 221, enabling the image analysis tool 221 to associate the pattern 214 of the image log file 213 with behavior and establish a graph-behavior association, allowing the image analysis tool 221 to later provide instructions 222 of the expected behavior associated with the pattern 214.

[0053] like Figure 2 As shown, the software monitoring module can be applied to more than one software code module 215. This allows a larger software package to be divided into several smaller software code modules, which can be monitored individually, each monitored by a sensor module 220, as a group monitored by several sensor modules 220, or any combination thereof.

[0054] It should be noted that the image log file 213 can contain more than one pattern 214, in a manner very similar to how an image can contain more than one object. Therefore, the teachings here can be used to simultaneously identify more than one expected behavior, and are thus useful for monitoring parallel processes.

[0055] Returning to image log file 213 and graphics output 212, in one embodiment, the graphics data may be related to a location within the log image file. In such an embodiment, the graphics data may be related to characteristics of such a location within the log image file. Examples of such characteristics include the location's intensity, color, grayscale, contrast, or brightness. Examples of locations include pixels, pixel groups, regions, or objects within the log image file.

[0056] In one embodiment, the image log file 213 is a matrix, where each element corresponds to a detector 211. These elements can be considered as corresponding to characteristics of the image (intensity, color, grayscale, contrast, or brightness). Each time detector 211 is executed, the value of an element increases, thereby changing the characteristic of the element. In one embodiment where each element corresponds to the grayscale of a corresponding pixel, detector 211 executed more frequently will produce darker pixels compared to detector 211 executed less frequently. Therefore, depending on how the software code module 215 is executed, different images will be produced, and different patterns are identifiable (at least for the image analysis tool 221) for different use cases, and these patterns can be associated with the results of the use case.

[0057] Therefore, the inventors have provided a clever way to automatically monitor code and prepare the code to be monitored, which reduces the amount of work required and completely eliminates the risk of introducing human error. This is based on the concept of abandoning logs and instead utilizing an excellent implementation of images to be analyzed by a highly developed image analysis tool 221.

[0058] The inventors also realized that since the detector 211 generates output 212, thus producing an image log, the resulting image can be controlled to achieve perfection because the detector 211 is generated by the software monitoring model 200. Therefore, the detector 211 can be tuned during training to produce an optimal image log 213 (or at least provide the highest confidence result) for image analysis. If the detector is set to provide a low success rate in pattern recognition, it can be tuned until a high (sufficient) success rate is achieved, i.e., a success rate exceeding the desired success rate. The method of tuning the detector depends on the image analysis tool currently used, and details on this will not be given herein, as providing such details would make the text difficult to discern.

[0059] Therefore, in one embodiment, the training module 225 is also arranged to adjust the detector 211 in terms of how the output 212 is generated. This can thus eliminate or at least significantly reduce factors (e.g., white balance, focus, etc.) that could make it difficult for the image analysis tool 221 to successfully identify the pattern 214.

[0060] The inventors also realized that, since the training is not based on real life but on software code module 215, the distribution of different test cases can be controlled so that different test cases receive the same training, which is a feature that is not available for the normal training of image analysis tools.

[0061] Figure 3A flowchart of a general method according to an embodiment of the teachings herein is shown. The method utilizes a software monitoring device 100 as taught herein. The software monitoring device 100 receives 310 a software code module 215 and introduces a plurality of detectors 211 320 into the software code module 215, wherein each detector 211 is arranged to provide an output 212 when executed. The software monitoring device 100 then executes 330 the software code module 215 or causes the software code module to be executed, which generates an image log file 213 based on the outputs 212 of the detectors 211. The software monitoring device 100 provides 350 image analysis 221 on the image log file 213 in a suitable format as described above, and provides 360 an indication 222 of expected behavior based on the image analysis 221. The software monitoring device 100 also receives 370 an indication 216 of actual behavior and compares 380 the expected behavior indicated by the indication 222 of expected behavior with the actual behavior indicated by the indication 216 of actual behavior, and if they do not match, the software monitoring device 100 provides 390 an alarm 231.

[0062] Figure 4 A component view of a software component (or module) device 400 according to an embodiment of the teachings herein is shown. The software component device 400 is suitable for use in a software monitoring device 100 as taught herein for performing automated software monitoring as taught herein.

[0063] The software component device 400 includes a software component for receiving a software code module 215. The software component device 400 also includes a software component for introducing a plurality of detectors 211 into the software code module 215, wherein each detector 211 is arranged to provide an output 212 upon execution. The software component device 400 also includes a software component for executing the software code module 215 and for generating an image log file 213 based on the outputs 212 of the detectors 211. The software component device 400 also includes a software component for providing image analysis 221 of the image log file 213 and a software component for providing an indication 222 of expected behavior based on the image analysis 221. The software component device 400 also includes a software component for receiving an indication 216 of actual behavior and a software component for comparing the expected behavior indicated by the indication 222 of expected behavior with the actual behavior indicated by the indication 216 of actual behavior. The software component device 400 also includes a software component for providing alarm 231 490 in case of mismatch.

[0064] Figure 5 A component view of a circuit-included device 500 for software monitoring according to an embodiment taught herein is shown. The circuit-included device 500 for software monitoring is suitable for use in a software monitoring device 100 as taught herein for automated software monitoring.

[0065] Figure 5 The circuit-integrated apparatus 500 for automated software monitoring includes circuitry for receiving software code module 215. The apparatus 500 also includes circuitry for introducing a plurality of detectors 211 into software code module 215, wherein each detector 211 is arranged to provide output 212 upon execution. The apparatus 500 further includes circuitry for executing software code module 215 and for generating image log file 213 based on the output 212 of the detectors 211. The apparatus 500 also includes circuitry for providing image analysis 221 of image log file 213 and for providing indication 222 of expected behavior based on image analysis 221. The apparatus 500 also includes circuitry for receiving indication 216 of actual behavior and for comparing the expected behavior indicated by indication 222 with the actual behavior indicated by indication 216. The device 500 for automated software monitoring, which includes circuitry, also includes circuitry for providing alarm 231 590 in case of mismatch.

[0066] Figure 6 A schematic diagram of a computer-readable medium 120 carrying computer instructions 121 is shown, which, when loaded into and executed by the controller of a software monitoring device 100, enable the software monitoring device 100 to implement the present invention.

[0067] The computer-readable medium 120 can be tangible, such as a hard disk drive or flash memory (e.g., a USB flash drive or cloud server). Alternatively, the computer-readable medium 120 can be intangible, such as a signal carrying computer instructions that enable the computer instructions to be downloaded via a network connection (e.g., an internet connection).

[0068] exist Figure 6 In the example, computer-readable medium 120 is shown as a computer disk 120 inserted into a computer disk reader 122 carrying computer-readable computer instructions 121. The computer disk reader 122 may be part of a cloud server 123 or other server, or the computer disk reader may be connected to a cloud server 123 or other server. The cloud server 123 may be part of the Internet or at least connected to the Internet. Alternatively, the cloud server 123 may be connected via a proprietary or dedicated connection. In one example embodiment, the computer instructions are stored in a remote server 123 and downloaded to the memory 102 of the software monitoring device 100 for execution by the controller 101.

[0069] The computer disk reader 122 may also be connected to (or possibly inserted into) the software monitoring device 100 in order to transmit computer-readable computer instructions 121 to the controller of the software monitoring device (possibly via the memory of the software monitoring device 100).

[0070] Figure 6 The illustration shows a scenario where software monitoring device 100 receives computer-readable computer instructions 121 via a wireless server connection (invisibly) and another scenario where software monitoring device 100 receives computer-readable computer instructions 121 via a wired interface (tangibly). This enables the computer-readable computer instructions 121 to be downloaded to software monitoring device 100, thereby enabling software monitoring device 100 to operate and implement the invention as disclosed herein.

Claims

1. A software monitoring device (100) comprising a controller (101) configured to: a) Receive software code module (215); b) Introduce multiple detectors (211) into the software code module (215), each detector (211) being arranged to provide an output (212) when executed. c) Execute the software code module (215) to generate an image log file (213) based on the output (212) of the detector (211); d) Provide image analysis (221) of the image log file (213); wherein, The image analysis (221) is performed by an image analysis tool based on a neural network, and the controller (101) is further configured to: train the image analysis tool after the plurality of detectors (211) are introduced; and adjust at least one of the plurality of detectors (211) during training to provide an output that provides a higher success rate for the image analysis tool; e) Provide instructions (222) for the expected behavior based on the image analysis (221); f) Receive instructions for actual action (216); g) Compare the expected behavior indicated by the expected behavior instruction (222) with the actual behavior indicated by the actual behavior instruction (216); and provide an alert (231) based on the comparison.

2. The software monitoring device (100) according to claim 1, wherein, The output (212) of the detector (211) is related to the characteristics of the image log file (213).

3. The software monitoring device (100) according to claim 1, wherein, The controller (101) is also configured to provide the image analysis to identify a pattern (214) in the image log file, the pattern (214) being associated with the expected behavior.

4. The software monitoring device (100) according to claim 3, wherein, The controller (101) is also configured to: Identify a first pattern (214) that is associated with a first expected behavior; Identify a second pattern (214), which is associated with a second expected behavior; and Provide a first indication of the first expected behavior and a second indication of the second expected behavior.

5. The software monitoring device (100) according to claim 1, wherein, The controller (101) is also configured to: a1) Receive the second software code module (215); b1) Introduce a second plurality of detectors (211) into the second software code module (215), each detector (211) being arranged to provide an output (212) when executed. c1) Execute the second software code module (215) to generate a second image log file (213) based on the output (212) of the second plurality of detectors (211); d1) Provide image analysis (221) of the second image log file (213); e1) Provide a second indication (222) of the second expected behavior based on the second image analysis (221); g1) compare the expected behavior indicated by the expected behavior instruction (222) and the second expected behavior indicated by the second expected behavior instruction (222) with the actual behavior indicated by the actual behavior instruction (216); and provide an alert (231) based on the comparison.

6. The software monitoring device (100) according to claim 1, wherein, The image analysis tool is based on object detection.

7. The software monitoring device (100) according to claim 6, wherein, The object detection is based on a deep neural network model.

8. A method for automating software monitoring in a software monitoring device (100), the method comprising: a) Receive (310) software code module (215); b) Introduce multiple detectors (211) into the software code module (215) (320), each detector (211) being arranged to provide an output (212) when executed. c) Execute the software code module (215) described in (330) to generate (340) an image log file (213) based on the output (212) of the detector (211); d) Provide (350) image analysis (221) of the image log file (213); wherein the image analysis (221) is performed by an image analysis tool based on a neural network, and the controller (101) is further configured to: train the image analysis tool after the plurality of detectors (211) are introduced; and adjust at least one of the plurality of detectors (211) during training to provide an output that provides a higher success rate for the image analysis tool; e) Based on the image analysis (221), provide (360) an indication (222) of the expected behavior; f) Receive (370) instructions for actual behavior (216); g) Compare the expected behavior indicated by the expected behavior instruction (222) with the actual behavior indicated by the actual behavior instruction (216) (380); and provide (390) an alarm (231) based on the comparison.

9. A computer-readable medium (120) carrying computer instructions (121) which, when loaded into and executed by a controller (101) of a software monitoring device (100), enable the software monitoring device (100) to perform the method according to claim 8.

Images