Stack overflow risk detection method and device

Abstract

The invention provides a stack overflow risk detection method which can be applied to the technical field of artificial intelligence. The method comprises the following steps: determining a stack operation behavior feature sequence for a target stack; the stack operation behavior feature sequence comprises N stack operation behavior features arranged according to a time sequence; n is a positive integer; and predicting the stack overflow risk of the target stack for the determined stack operation behavior feature sequence based on a pre-trained risk prediction model. The invention further provides a stack overflow risk detection device and equipment, a storage medium and a program product.

Description

Technical Field

[0001] This application relates to the field of artificial intelligence technology, specifically to a method and apparatus for detecting stack overflow risks. Background Technology

[0002] Stack overflows can easily occur during program execution due to various reasons, such as function call exceptions or infinite recursion. Stack overflows can easily lead to program crashes or data loss. Therefore, there is an urgent need for a method to detect the risks of stack overflows. Summary of the Invention

[0003] In view of the above problems, this application provides a stack overflow risk detection method, apparatus, device, medium and program product that can detect stack overflow risks and improve the accuracy of stack overflow risk detection.

[0004] According to a first aspect of this application, a stack overflow risk detection method is provided, comprising: determining a stack operation behavior feature sequence for a target stack; the stack operation behavior feature sequence includes N stack operation behavior features arranged in chronological order; N is a positive integer; and predicting the stack overflow risk of the target stack for the determined stack operation behavior feature sequence based on a pre-trained risk prediction model.

[0005] Optionally, the stack operation behavior characteristics include at least one of the following: stack pointer characteristics, stack function call characteristics, and stack memory access characteristics.

[0006] Optionally, determining the stack operation behavior feature sequence for the target stack includes: determining the stack operation behavior feature sequence for the target stack within a target time period; predicting the stack overflow risk of the target stack includes at least one of the following: predicting whether the target stack will experience a stack overflow within the target time period; predicting the risk of the target stack experiencing a stack overflow after the target time period.

[0007] Optionally, the prediction of the stack overflow risk of the target stack based on the pre-trained risk prediction model for the determined stack operation behavior feature sequence includes: when it is determined that the stack pointer of the current target stack is out of bounds, predicting the stack overflow risk of the target stack based on the pre-trained risk prediction model for the determined stack operation behavior feature sequence.

[0008] Optionally, the method further includes: monitoring stack operation behavior characteristics of the target stack; the stack operation behavior characteristic sequence includes newly detected stack operation behavior characteristics.

[0009] Optionally, determining the stack operation behavior feature sequence for the target stack includes: determining different stack operation behavior feature sequences for the target stack within different time periods; predicting the stack overflow risk of the target stack based on the determined stack operation behavior feature sequence using a pre-trained risk prediction model includes: predicting the stack overflow risk of the target stack for each determined stack operation behavior feature sequence using a pre-trained risk prediction model.

[0010] Optionally, the risk prediction model based on pre-trained data predicts the stack overflow risk of the target stack based on the determined stack operation behavior feature sequence, including: determining the statistical characteristics among the stack operation behavior features in the determined stack operation behavior feature sequence; and predicting the stack overflow risk of the target stack based on the determined statistical characteristics using the pre-trained risk prediction model.

[0011] A second aspect of this application provides a stack overflow risk detection device, comprising:

[0012] A determining unit is used to determine a sequence of stack operation behavior characteristics for a target stack; the sequence of stack operation behavior characteristics includes N stack operation behavior characteristics arranged in chronological order; where N is a positive integer;

[0013] The model unit is used to predict the stack overflow risk of the target stack based on a pre-trained risk prediction model and a determined sequence of stack operation behavior characteristics.

[0014] Optionally, the stack operation behavior characteristics include at least one of the following: stack pointer characteristics, stack function call characteristics, and stack memory access characteristics.

[0015] Optionally, the determining unit is used to: determine a sequence of stack operation behavior characteristics for the target stack within a target time period; the modeling unit is used to perform at least one of the following: predict whether the target stack will experience a stack overflow within the target time period; predict the risk of the target stack experiencing a stack overflow after the target time period.

[0016] Optionally, the model unit is configured to: predict the stack overflow risk of the target stack based on a pre-trained risk prediction model, for the determined stack operation behavior feature sequence, when it is determined that the stack pointer of the current target stack is out of bounds.

[0017] Optionally, the device further includes a monitoring unit for: monitoring stack operation behavior characteristics of the target stack; the stack operation behavior characteristic sequence includes newly monitored stack operation behavior characteristics.

[0018] Optionally, the determining unit is used to: determine different stack operation behavior feature sequences for the target stack within different time periods; the model unit is used to: predict the stack overflow risk of the target stack based on a pre-trained risk prediction model for the determined different stack operation behavior feature sequences.

[0019] Optionally, the model unit is used to: determine the statistical characteristics among the stack operation behavior features in the determined stack operation behavior feature sequence; and predict the stack overflow risk of the target stack based on the determined statistical characteristics using a pre-trained risk prediction model.

[0020] A third aspect of this application provides an electronic device comprising: one or more processors; and a memory for storing one or more computer programs, wherein the one or more processors execute the one or more computer programs to implement the steps of the method described above.

[0021] A fourth aspect of this application also provides a computer-readable storage medium having a computer program or instructions stored thereon, which, when executed by a processor, implement the steps of the above-described method.

[0022] The fifth aspect of this application also provides a computer program product, including a computer program or instructions that, when executed by a processor, implement the steps of the above-described method. Attached Figure Description

[0023] The above-mentioned contents, other objects, features and advantages of this application will become clearer from the following description of embodiments with reference to the accompanying drawings, in which:

[0024] Figure 1 This illustration schematically depicts an application scenario of a stack overflow risk detection method and apparatus according to an embodiment of this application.

[0025] Figure 2 The flowchart of a stack overflow risk detection method according to an embodiment of this application is illustrated schematically;

[0026] Figure 3 This schematic diagram illustrates a structural block diagram of a stack overflow risk detection device according to an embodiment of this application;

[0027] Figure 4 A block diagram schematically illustrates an electronic device suitable for implementing a stack overflow risk detection method according to an embodiment of this application. Detailed Implementation

[0028] The embodiments of this application will now be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of this application. In the following detailed description, numerous specific details are set forth to provide a thorough understanding of the embodiments of this application for ease of explanation. However, it will be apparent that one or more embodiments may be implemented without these specific details. Furthermore, descriptions of well-known structures and technologies are omitted in the following description to avoid unnecessarily obscuring the concepts of this application.

[0029] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the scope of this application. The terms “comprising,” “including,” etc., as used herein indicate the presence of the stated features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0030] All terms used herein (including technical and scientific terms) have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein are to be interpreted in a manner consistent with the context of this specification, and not in an idealized or overly rigid way.

[0031] When using expressions such as "at least one of A, B and C", they should generally be interpreted in accordance with the meaning that is commonly understood by those skilled in the art (e.g., "a system having at least one of A, B and C" should include, but is not limited to, a system having A alone, a system having B alone, a system having C alone, a system having A and B, a system having A and C, a system having B and C, and / or a system having A, B and C, etc.).

[0032] Stack overflows can easily occur during program execution due to various reasons, such as function call exceptions or infinite recursion. Stack overflows can easily lead to program crashes or data loss. Therefore, there is an urgent need for a method to detect the risks of stack overflows.

[0033] This method employs a pre-trained machine learning model to detect the risk of stack overflow. Specifically, it involves collecting stack operation behavior features, which can be combined into a temporal feature sequence. This temporal feature sequence is then used to predict the stack overflow risk based on the pre-trained machine learning model. The machine learning model can be any model, such as a Long Short-Term Memory (LSTM) neural network model.

[0034] This method does not limit the characteristics of stack operation behavior. Specifically, it can include characteristics of the stack pointer, such as the stack pointer offset and offset rate, characteristics of the stack memory, such as the access frequency and the amount of data written to the stack memory, and characteristics of function calls within the stack, such as the call depth or recursion depth of functions within the stack.

[0035] This method, based on a machine learning model, can predict the risk of stack overflow by analyzing the stack operation behavior sequence, thereby improving the accuracy of stack overflow risk prediction.

[0036] It should be noted that the stack overflow risk detection method and apparatus provided in this application can be applied to the field of artificial intelligence technology as well as the field of fintech. For example, for financial applications, the stack overflow risk detection method provided in this application embodiment can be used to detect stack overflow risks. Furthermore, the stack overflow risk detection method and apparatus provided in this application embodiment can also be applied to any field other than fintech, such as stack overflow risk detection in social applications, stack overflow risk detection in video applications, etc. The application fields of the methods and apparatus disclosed in the embodiments of this application are not limited.

[0037] In the technical solution of this application, the user information (including but not limited to user personal information, user location information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, storage, use, processing, transmission, provision, disclosure, and application of related data all comply with relevant laws, regulations, and standards, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entry points for users to choose to authorize or refuse.

[0038] In scenarios involving automated decision-making using personal information, the methods, devices, and systems provided in this application all offer users corresponding entry points for choosing to agree to or reject the automated decision-making results. If the user chooses to reject, the process proceeds to the expert decision-making stage. Here, "automated decision-making" refers to the activity of automatically analyzing and evaluating an individual's behavioral habits, interests, or economic, health, and credit status through computer programs, and then making a decision. Here, "expert decision-making" refers to the activity of making decisions by personnel who specialize in a particular field, possess specialized experience, knowledge, and skills, and have reached a certain level of professional expertise.

[0039] Figure 1 The illustration schematically depicts an application scenario of a stack overflow risk detection method and apparatus according to an embodiment of this application. For example... Figure 1As shown, application scenario 100 according to this embodiment may include a first terminal device 101, a second terminal device 102, a third terminal device 103, a network 104, and a server 105. The network 104 serves as a medium for providing a communication link between the first terminal device 101, the second terminal device 102, the third terminal device 103, and the server 105. The network 104 may include various connection types, such as wired or wireless communication links, or fiber optic cables, etc. Users can use the first terminal device 101, the second terminal device 102, or the third terminal device 103 to interact with the server 105 through the network 104 to receive or send messages, etc. Various communication client applications may be installed on the first terminal device 101, the second terminal device 102, or the third terminal device 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social media platform software, etc. (only examples). The first terminal device 101, the second terminal device 102, or the third terminal device 103 can be various electronic devices with a display screen and supporting web browsing, including but not limited to smartphones, tablets, laptops, and desktop computers. The server 105 can be a server providing various services, such as a backend management server (for example only) that supports websites browsed by users using the first terminal device 101, the second terminal device 102, or the third terminal device 103. The backend management server can analyze and process received user requests and other data, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal devices.

[0040] It should be noted that the stack overflow risk detection method provided in this application embodiment can generally be executed by server 105, first terminal device 101, second terminal device 102, or third terminal device 103. Correspondingly, the stack overflow risk detection device provided in this application embodiment can generally be located in server 105, first terminal device 101, second terminal device 102, or third terminal device 103. The stack overflow risk detection method provided in this application embodiment can also be executed by a server or server cluster that is different from server 105 but can communicate with first terminal device 101, second terminal device 102, third terminal device 103, and / or server 105. Correspondingly, the stack overflow risk detection device provided in this application embodiment can also be located in a server or server cluster that is different from server 105 but can communicate with first terminal device 101, second terminal device 102, third terminal device 103, and / or server 105.

[0041] It should be understood that Figure 1The number of terminal devices, networks, and servers shown is merely illustrative. Depending on implementation needs, any number of terminal devices, networks, and servers can be included.

[0042] Figure 2 The flowchart illustrating a stack overflow risk detection method according to an embodiment of this application is shown schematically.

[0043] like Figure 2 As shown, the method flow of this embodiment may include operations S210 and S220. This application embodiment does not limit the specific executing entity; optionally, the executing entity can be any device or any software application, such as a terminal device, client, server, etc.

[0044] In operation S210, a sequence of stack operation behavior characteristics for the target stack is determined; the sequence of stack operation behavior characteristics includes N stack operation behavior characteristics arranged in chronological order; N is a positive integer.

[0045] In operation S220, based on a pre-trained risk prediction model, the stack overflow risk of the target stack is predicted for the determined stack operation behavior feature sequence.

[0046] This method can predict the risk of stack overflow based on a pre-trained risk prediction model and the stack operation behavior feature sequence of the target stack, thereby improving the accuracy of stack overflow risk prediction.

[0047] The embodiments of this application are not limited to a target stack. Optionally, the target stack can be any stack, and any stack that needs to be detected for stack overflow risk can be referred to as the target stack.

[0048] The embodiments of this application do not limit the stack operation behavior feature sequence. Optionally, the stack operation behavior feature sequence may include N stack operation behavior features arranged in temporal order, where N can be a positive integer, specifically a positive integer greater than 1. The embodiments of this application do not limit the temporal order in the stack operation behavior feature sequence; specifically, it can be arranged in a temporal order from front to back or from back to front.

[0049] The embodiments of this application do not limit the stack operation behavior characteristics. Optionally, the stack operation behavior characteristics may include characteristics of the operation behavior performed on the target stack, specifically including stack pointer characteristics, such as stack pointer offset, offset rate, etc.; stack memory characteristics, such as stack memory access frequency, amount of data written, etc.; and stack function call characteristics, such as stack function call depth or recursion depth, etc.

[0050] Understandably, in the event of a stack overflow or its imminent occurrence, stack pointer characteristics may exhibit corresponding anomalies, such as a sudden increase in offset or offset rate. Stack memory access characteristics may also show anomalies, such as a sudden and abnormal increase in access frequency or the amount of data written. Function call characteristics within the stack may also exhibit anomalies, such as a sudden increase in call depth or recursion depth. By combining these three types of stack operation behavior characteristics, the risk of stack overflow can be predicted more accurately. Of course, for other types of stack operation behavior characteristics, the above stack operation behavior characteristic sequence can also be combined to determine the changes in stack operation behavior characteristics over time within a certain period, facilitating the prediction of stack overflow risk.

[0051] In a specific example, a sudden increase in the stack pointer offset rate may correspond to an excessively large local variable or a recursion explosion; a continuously unbounded increase in call depth may correspond to infinite recursion or a maliciously long call chain; and frequent writes to the bottom of the stack may correspond to a buffer overflow overwriting the return address.

[0052] The embodiments of this application do not limit the specific method for determining the function call depth within the stack. Optionally, the size of the data within the stack can be determined based on the current stack pointer position, and the call depth of the current function within the stack can be determined further using a predetermined "average frame size of function frames during program runtime". Specifically, the quotient between the determined size of the data within the stack and the "average frame size of function frames during program runtime" can be used as the call depth of the current function within the stack.

[0053] Therefore, optionally, the stack operation behavior characteristics include at least one of the following: stack pointer characteristics, stack function call characteristics, and stack memory access characteristics. In this embodiment, specific stack operation behavior characteristics can be combined to predict stack overflow risks, thereby improving the accuracy of stack overflow risk prediction.

[0054] Optionally, the stack operation behavior features can correspond to the acquisition time, and can be stack operation behavior features acquired at the corresponding acquisition time. The acquisition time can specifically be a point in time or a time period, and the embodiments of this application are not limited thereto. Accordingly, the stack operation behavior feature sequence can be sorted according to the temporal relationship of the acquisition times corresponding to the stack operation behavior features.

[0055] In a specific example, the stack operation behavior characteristics may include stack pointer characteristics, specifically the stack pointer offset, which may be the stack pointer offset within the acquisition time period. Accordingly, the stack pointer offset can be divided by the duration of the acquisition time period to obtain the stack pointer offset rate, thereby determining the stack pointer offset and stack pointer offset rate as stack pointer characteristics.

[0056] In another specific example, stack operation behavior characteristics can be collected periodically to determine the corresponding collection time point. Specifically, stack operation behavior characteristics can be those within a collection period preceding the corresponding collection time point. For example, stack memory access characteristics could include: the frequency of stack memory accesses and the total amount of data written within a collection period preceding the corresponding collection time point.

[0057] The embodiments of this application are not limited to a risk prediction model. Optionally, the risk prediction model can be a classification model, a neural network model, or other model structures. In a specific example, the risk prediction model can be a long short-term memory neural network model, which can input the stack operation behavior feature sequence into the risk prediction model to predict the corresponding stack overflow risk.

[0058] The embodiments of this application do not limit the specific prediction process of the risk prediction model. Optionally, the stack operation behavior feature sequence may be input into the risk prediction model to predict the corresponding stack overflow risk. Alternatively, features may be further extracted based on the stack operation behavior feature sequence before being input into the risk prediction model to predict the corresponding stack overflow risk.

[0059] The embodiments of this application do not limit the predicted stack overflow risk. Optionally, it can predict whether a stack overflow has already occurred in the stack operation behavior feature sequence, specifically whether a stack overflow has already occurred within the time period corresponding to the stack operation behavior feature sequence. Alternatively, it can perform advance prediction, that is, predict the subsequent stack overflow risk based on the stack operation behavior feature sequence.

[0060] Optionally, determining the stack operation behavior feature sequence for the target stack includes: determining the stack operation behavior feature sequence for the target stack within a target time period; predicting the stack overflow risk of the target stack, including at least one of the following: (1) predicting whether the target stack will experience a stack overflow within the target time period; (2) predicting the risk of the target stack experiencing a stack overflow after the target time period. This embodiment can improve the comprehensiveness of stack overflow risk detection by predicting different types of stack overflow risks.

[0061] Optionally, the risk prediction model may have one or two prediction outputs, thereby predicting whether a stack overflow has occurred within the corresponding target time period based on the stack operation behavior feature sequence, and / or predicting the risk of a future stack overflow.

[0062] The embodiments of this application do not limit the target time period. Optionally, the target time period can be the time period between the earliest and latest collection times corresponding to the stack operation behavior features in the stack operation behavior feature sequence. It is understood that stack overflow often leads to abnormal conditions in the stack operation behavior features, so it is possible to predict whether a stack overflow occurs based on the stack operation behavior feature sequence. Correspondingly, stack operation behavior features are also prone to abnormal conditions before a stack overflow, so it is possible to predict the risk of subsequent stack overflows based on the stack operation behavior feature sequence.

[0063] The embodiments of this application do not limit the specific training method of the risk prediction model. Optionally, the risk prediction model can be trained based on a training sample set. The embodiments of this application do not limit the specific form of the training samples. Optionally, the features of the training samples in the training sample set may include stack operation behavior feature sequences, or features extracted based on stack operation behavior feature sequences. The sample labels of the training samples can be used to characterize stack overflow risk, specifically, they can be used to characterize whether a stack overflow occurs within the time period corresponding to the sample feature, or whether a stack overflow occurs after the time period corresponding to the sample feature.

[0064] In a specific example, stack operation behavior feature sequences can be collected during program execution when no stack overflow occurs. Furthermore, multiple stack operation behavior feature sequences can be determined using a sliding window approach, and it can be determined that the corresponding stack overflow risks are all risk-free.

[0065] It's also possible to collect stack operation behavior feature sequences during program execution when stack overflows occur. The time points when stack overflows occur can be marked, allowing multiple stack operation behavior feature sequences to be identified using a sliding window approach. Based on the time points of stack overflow occurrences, for stack operation behavior feature sequences containing that time point, the corresponding stack overflow risk can be determined as "stack overflow occurred within the time period corresponding to the sample feature." For stack operation behavior feature sequences within a fixed time period before that time point, such as stack operation behavior feature sequences 10 seconds before the stack overflow, the corresponding stack overflow risk can be determined as "stack overflow occurred after the time period corresponding to the sample feature." It's understandable that the sample labels in the training samples are used to represent whether a stack overflow occurred or not. Using a sliding window can also increase the number of training samples, reducing the difficulty of obtaining training samples.

[0066] Optionally, the risk prediction model can be trained by combining the training samples collected above. The risk prediction model can be used to predict at least one of the following: (1) whether a stack overflow will occur within the time period corresponding to the input stack operation behavior feature sequence; (2) the risk of a stack overflow occurring after the time period corresponding to the input stack operation behavior feature sequence.

[0067] In an alternative embodiment, stack overflow risk can be detected by combining stack pointer out-of-bounds conditions.

[0068] Optionally, based on a pre-trained risk prediction model, the stack overflow risk of the target stack is predicted for the determined stack operation behavior feature sequence. Specifically, if it is determined that the stack pointer of the current target stack is out of bounds, the stack overflow risk of the target stack is predicted based on the pre-trained risk prediction model for the determined stack operation behavior feature sequence. This embodiment can improve the accuracy and precision of stack overflow risk detection by combining the stack pointer out-of-bounds situation for stack overflow risk prediction.

[0069] One possible reason for a stack pointer going out of bounds is a stack overflow, which can trigger a risk prediction model to make a risk prediction, thereby improving the accuracy and precision of stack overflow risk prediction.

[0070] The embodiments of this application do not limit the specific method of determining stack pointer out of bounds. Optionally, it can be based on real-time monitoring of whether the stack pointer has exceeded the bounds. It can also be based on a hardware memory protection unit to determine whether the stack pointer has exceeded the bounds. Specifically, the hardware memory protection unit can monitor whether the stack pointer has exceeded the bounds by setting a stack space boundary register. When the stack pointer touches a preset stack bottom boundary, the hardware memory protection unit can trigger a hardware interrupt, indicating that the stack pointer has exceeded the bounds. However, the hardware memory protection unit has difficulty distinguishing the cause of the stack pointer out of bounds. Therefore, it can be combined with a risk prediction model to predict the risk of stack overflow, improve the accuracy of stack overflow risk detection, and reduce the probability of false alarms for stack overflow risk.

[0071] In a specific example, if a stack pointer out of bounds is determined based on a hardware memory protection unit, a risk prediction model is triggered to predict the stack overflow risk of the target stack. If the predicted stack overflow risk is higher than a preset risk threshold, then a stack overflow can be confirmed.

[0072] The embodiments of this application do not limit the specific timing and circumstances for performing stack overflow risk detection. Optionally, stack overflow risk can be continuously monitored, and the stack overflow risk detection method provided in the embodiments of this application can be executed periodically. Alternatively, the stack overflow risk detection method provided in the embodiments of this application can be executed under the triggering of a specified condition, such as the stack pointer out-of-bounds situation mentioned above. Furthermore, for ease of analysis, stack overflow risk can be predicted for different time periods, allowing for convenient analysis of stack overflow risk conditions at different times.

[0073] Therefore, optionally, stack operation behavior characteristics targeting the target stack can be monitored; the stack operation behavior characteristic sequence may include newly detected stack operation behavior characteristics. This embodiment can predict stack overflow risk based on newly detected stack operation behavior characteristics, thereby improving the real-time detection of stack overflow risk.

[0074] Understandably, it's possible to continuously monitor stack operation behavior characteristics targeting the target stack, thereby updating the corresponding stack operation behavior characteristic sequence. Specifically, the number of stack operation behavior characteristics in the sequence can be set to a fixed number, allowing for the addition of new characteristics and the deletion of older ones, thus predicting the current stack overflow risk in real time. Correspondingly, for the updated stack operation behavior characteristic sequence, a risk prediction model can be continuously used to detect stack overflow risk, thereby improving the real-time performance of stack overflow risk prediction. Optionally, older stack operation behavior characteristics may not be deleted, thus retaining as many characteristics as possible and improving the comprehensiveness of stack overflow risk prediction.

[0075] Optionally, the stack operation behavior feature sequence for the target stack is determined. Specifically, this can be done by determining different stack operation behavior feature sequences for the target stack within different time periods. Correspondingly, based on a pre-trained risk prediction model, the stack overflow risk of the target stack is predicted for the determined stack operation behavior feature sequences. Specifically, this can be done by predicting the stack overflow risk of the target stack for each determined stack operation behavior feature sequence based on the pre-trained risk prediction model. This embodiment can improve the comprehensiveness of stack overflow risk detection by detecting stack overflow risks at different time points.

[0076] The embodiments of this application do not limit the relationship between different time periods. Optionally, different time periods can be determined by a sliding window. For example, by using the window size and sliding step of the sliding window, multiple different time periods can be determined, thereby determining the corresponding sequence of stack operation behavior characteristics for the target stack, and further predicting the risk of stack overflow.

[0077] Optionally, by comprehensively considering the stack overflow risk over different time periods, the changes in stack overflow risk over different time periods can be determined, thereby making it easier to locate and determine the specific time period of stack overflow risk.

[0078] Optionally, for a total time period with stack overflow risk, multiple different sub-time periods can be determined through a sliding window mechanism, and the corresponding stack overflow risk can be further predicted. This allows the sub-time periods with stack overflow risk to be identified within the target time period, facilitating the location and determination of specific sub-time periods with stack overflow risk, and improving the accuracy and precision of stack overflow risk detection.

[0079] In a specific example, it may be possible to determine that there is a risk of stack overflow on a certain day, but it is difficult to pinpoint the exact hour in which the stack overflow risk occurs. Therefore, by dividing the day into multiple sub-time periods and detecting stack overflow risk in different sub-time periods, it is easy to identify the sub-time periods with a stack overflow risk or a high stack overflow risk.

[0080] Therefore, optionally, determining the stack operation behavior feature sequence for the target stack can specifically involve determining the different stack operation behavior feature sequences for the target stack within different time periods of the total time period. The total time period can include the different time periods within it. This application embodiment does not limit the method of dividing the different time periods; specifically, it can be divided using a sliding window method.

[0081] Optionally, determining the stack operation behavior feature sequence for the target stack can specifically involve: determining the target time period where the target stack has a stack overflow risk, and further determining different sub-time periods within the target time period; determining different stack operation behavior feature sequences for the target stack within different sub-time periods; and correspondingly, based on a pre-trained risk prediction model, predicting the stack overflow risk of the target stack for the determined stack operation behavior feature sequences. Specifically, based on the pre-trained risk prediction model, predicting the stack overflow risk of the target stack within the corresponding sub-time period for each determined stack operation behavior feature sequence. The embodiments of this application do not limit the specific processing method for the prediction results. Optionally, based on the predicted stack overflow risk of the target stack within the corresponding sub-time period, sub-time periods with a stack overflow risk higher than a risk threshold can be selected for localization; alternatively, sub-time periods with a stack overflow risk lower than a risk threshold can be selected for localization; or, the distribution of stack overflow risk within the sub-time periods of the target time period can be comprehensively analyzed for further localization. For the localized time period, the causes leading to the stack overflow risk can be further analyzed.

[0082] In one optional embodiment, the determined stack operation behavior feature sequence can be directly input into the risk prediction model to determine the stack overflow risk output by the risk prediction model. Alternatively, features can be further extracted based on the determined stack operation behavior feature sequence, and the extracted features can be input into the risk prediction model to determine the stack overflow risk output by the risk prediction model.

[0083] Optionally, based on a pre-trained risk prediction model, the stack overflow risk of the target stack is predicted for the determined stack operation behavior feature sequence. Specifically, this can be achieved by: determining the statistical characteristics between the stack operation behavior features in the determined stack operation behavior feature sequence; and predicting the stack overflow risk of the target stack based on the determined statistical characteristics using the pre-trained risk prediction model. This embodiment can improve the feature extraction effect and increase the accuracy of stack overflow risk prediction by extracting the statistical characteristics between the stack operation behavior features.

[0084] The embodiments of this application do not limit the statistical features or the specific methods for determining them. Optionally, the statistical features may specifically be statistical values ​​such as the feature mean, feature median, feature variance, feature standard deviation, feature maximum, feature minimum, etc., in the stack operation behavior feature sequence. Stack operation behavior features may include multiple sub-features, such as stack pointer features and stack memory access features. Therefore, statistical features can be further determined for the sub-features between different stack operation behavior features in the stack operation behavior feature sequence. For example, the mean, maximum, variance, etc., of a certain stack pointer feature (the offset of the stack pointer).

[0085] Understandably, statistical values ​​can characterize the overall stack operation behavior sequence to a certain extent, thereby improving feature extraction and facilitating the identification of anomalies within the stack operation behavior sequence. Optionally, the statistical values ​​of the sub-features of the stack operation behavior features can be combined into a feature vector to determine the statistical features.

[0086] The embodiments of this application are not limited to a specific method of predicting the stack overflow risk of a target stack based on a pre-trained risk prediction model and determined statistical characteristics. Optionally, the determined statistical characteristics can be input into the risk prediction model to determine the stack overflow risk output by the risk prediction model. Optionally, the determined statistical characteristics and the determined stack operation behavior feature sequence can also be input into the risk prediction model to determine the stack overflow risk output by the risk prediction model, which can increase the dimensionality of the input features and improve the prediction accuracy and comprehensiveness of the risk prediction model. Correspondingly, the training sample features for training the risk prediction model may include the stack operation behavior feature sequence and the corresponding statistical characteristics.

[0087] The embodiments of this application do not limit the specific subsequent handling methods for the stack overflow risk predicted by the risk prediction model. Optionally, the occurrence of a stack overflow can be determined by combining the stack pointer out-of-bounds situation with the stack overflow risk predicted by the risk prediction model. Optionally, corresponding defense strategies can also be adopted based on the specific situation of the stack overflow risk predicted by the risk prediction model, such as whether it exceeds a preset risk threshold. For example, if the stack overflow risk predicted by the risk prediction model is greater than the preset risk threshold, it means that a stack overflow may have already occurred or is about to occur, and defense measures such as issuing alarms, isolation, or expanding stack space can be taken.

[0088] For ease of understanding, this application also provides a specific application embodiment.

[0089] This embodiment provides an artificial intelligence-based stack overflow detection system that can monitor stack operation behavior during program execution in real time, identify abnormal patterns through machine learning models, and achieve stack overflow detection with low false alarm rate and high coverage.

[0090] Furthermore, this embodiment combines hardware and software collaborative monitoring mechanisms to maintain efficient real-time monitoring capabilities even in resource-constrained embedded environments, and enhances system security through intelligent defense strategies (such as dynamic task isolation, system rollback, and adaptive stack space adjustment). This embodiment is applicable to real-time operating systems and industrial control systems, and can detect and prevent potential stack overflow problems early in program execution.

[0091] The technical solution of this embodiment consists of four core modules: behavior feature extraction module, data processing module, model training module, and analysis and defense strategy module.

[0092] (1) Behavioral Feature Extraction Module. This module is responsible for capturing key behavioral features from program runtime, serving as input data for the artificial intelligence model (corresponding to the risk prediction model mentioned above). Its core functions include:

[0093] a) Stack pointer timing feature extraction (corresponding to the stack pointer features mentioned above). Stack pointer offset data is periodically collected via hardware interrupts or hook functions to construct a timing sequence of stack space utilization. Sliding window techniques (such as fixed sampling rate or dynamic event triggering) are used to extract features such as stack pointer offset rate and abrupt change points, capturing the dynamic change patterns of the stack space.

[0094] •Basic features:

[0095] - Offset rate: The rate at which the stack pointer offset relative to the function stack frame base address changes per unit time (e.g., (current offset - previous offset) / sampling interval), reflecting the growth rate of stack space occupancy. Under normal circumstances, the offset rate is gradual during function calls / returns; when the stack overflows, excessively large local variables or deep recursion can cause the rate to suddenly increase (e.g., the offset per second exceeds 50% of the stack space capacity).

[0096] - Mutation point detection: Identify abnormal jumps in offset (such as a sudden increase in offset exceeding 20% ​​of stack space in a single sampling) through statistical thresholds or machine learning algorithms, which may correspond to buffer overflow behavior that overwrites stack space.

[0097] •Higher-order features:

[0098] – Trend slope: The trend of the offset within the window is fitted by linear regression. A positive slope indicates that the stack space is growing continuously, while a sudden steepening of the slope may indicate the risk of overflow.

[0099] - Periodic patterns: Identify the stack usage cycle of normal programs (such as stable changes in stack frames during task switching). Abnormal non-periodic fluctuations (such as continuous unidirectional growth without decline) may indicate that recursion has not terminated or that resources have leaked.

[0100] •Example of an exception mode:

[0101] When a stack overflow occurs in a program, the stack pointer offset may exceed a predefined safety threshold (e.g., approaching the bottom of the stack), or rapidly approach the bottom of the stack within a short period of time (e.g., the offset rate within the sliding window exceeds the safety threshold 3 times), triggering an alert from the artificial intelligence model.

[0102] Output data (which can be used as a stack pointer characteristic):

[0103] Offset rate: This represents the rate of change of the stack pointer offset per unit of time, expressed in offsets per second. For example, a value of "12" means the stack pointer offsets 12 units per second. Under normal circumstances, this value changes smoothly during function calls and returns. If a stack overflow occurs, it may suddenly increase due to excessively large local variables or deep recursion. It reflects the growth rate of stack space usage.

[0104] Mutation point information: This is an array, where each element represents a mutation point. It can record the time of the mutation, accurate to the second; it can also record the stack pointer offset at the time of the mutation. For example, at a certain point in time, if the stack pointer offset is 20, the mutation point may correspond to abnormal behavior such as buffer overflow overwriting stack space.

[0105] Trend slope: A value obtained by fitting the trend of stack pointer offset through linear regression. If the slope is positive, it indicates that the stack space is continuously growing. When the slope suddenly becomes steep, it indicates that there may be a risk of stack overflow. It reflects the changes in stack space from an overall trend perspective.

[0106] Periodic pattern identifier: Used to describe the periodic characteristics of normal program stack usage. It includes the period duration, in seconds, which is the time interval between the recurrence of the stack usage pattern; it also includes the fluctuation type. Normal program stack usage may exhibit certain regular periodic changes, while abnormal non-periodic fluctuations, such as continuous unidirectional growth without decline, may be a manifestation of problems such as unterminated recursion or resource leaks.

[0107] b) Call chain depth statistics (corresponding to the stack-based function call characteristics mentioned above). Record the trend of function call depth changes over time, paying particular attention to recursive calls and abnormal call chain growth patterns. Dynamically track call chain depth through kernel-level monitoring modules (such as modifying the task control block or adding inline assembly) to identify unexpected depth mutations.

[0108] • Call chain depth is the number of nested function calls during program execution, directly reflecting the complexity of stack space usage. Call chain depth statistics dynamically track the changing trends of function call levels, capturing early signs of stack overflow such as excessive recursion and abnormal call chain growth. It is a core technology in stack overflow detection systems for identifying "logical anomalies."

[0109] - Typical causes of stack overflow: Each time a function is called, a stack frame (storing local variables, return address, etc.) is pushed onto the stack space. The deeper the stack is, the larger the stack space is occupied. When the depth exceeds the stack space capacity, an overflow occurs.

[0110] • Call chain depth: The level of the currently executing function in the call chain (e.g., the main function is level 1, the first-level sub-function is level 2, and so on).

[0111] -Time sequence: Record depth values ​​in chronological order to form a one-dimensional sequence (e.g., [1, 2, 3, 2, 1, 2, 3, 4, ...]), reflecting the dynamic changes of function nesting during program execution.

[0112] • Implementation method.

[0113] Add a "Current Call Depth" field. The depth is incremented by 1 with each function call and decremented by 1 upon return.

[0114] Insert assembly instructions at the function entry / exit points to directly read the link register or stack frame pointer and calculate the current call depth.

[0115] The compiler records depth changes when each function is entered and exited.

[0116] • Optimized recursive detection.

[0117] – Distinguish between normal function calls and recursive calls (where function names are repeated and the depth continues to increase during recursion), and set a recursion depth threshold (e.g., trigger an alert if it exceeds 100 levels).

[0118] • Key feature extraction and abnormal pattern recognition.

[0119] Basic features:

[0120] Depth change rate: The amount of depth increase or decrease per unit time (e.g., 5 layers increase per second). In normal programs, depth changes conform to business logic (e.g., finite state machine calls). In abnormal situations, unbounded growth may occur (e.g., infinite recursion).

[0121] Peak depth: The maximum depth within the statistical sliding window, compared with the task stack space capacity (e.g., if the stack space is 2KB, a warning will be issued if the total size of the stack frames corresponding to the depth exceeds 1.8KB).

[0122] Abnormal pattern detection:

[0123] • Unexpected deep mutations:

[0124] - A normal call chain depth should exhibit a stack-like structure of "increasing first and then decreasing" (e.g., function A→B→C, depth 3, depth decreases after returning). If "continuous unidirectional growth" occurs (e.g., depth suddenly increases from 5 to 50 and does not fall back), it may be due to unterminated recursion or malicious construction of a long call chain.

[0125] •Recursion depth anomaly:

[0126] - Identifies repeated calls to functions with the same name without any decrease in call depth.

[0127] Output data (which can be used as a characteristic of function calls on the stack):

[0128] Depth change rate: This refers to the increase or decrease in the depth of the function call chain per unit of time, measured in layers per second. For example, "2" means the function call chain depth increases by 2 layers per second. Normal program depth changes conform to business logic. However, if unbounded growth occurs, such as in infinite recursion, this value will increase abnormally.

[0129] Peak depth: This refers to the maximum depth reached by the function call chain within the statistical period. For example, "15" indicates that the function call chain reached a maximum depth of 15 levels within the sliding window's statistical range. By comparing this depth with the task stack space capacity, it can be determined whether there is a risk of stack overflow.

[0130] Unexpected Depth Mutation Flags: This is an array that records unexpected call chain depth mutations. Each element records the time the mutation occurred; it also records the function call chain depth before and after the mutation. A normal call chain depth should exhibit a stack-like structure of "increasing first and then decreasing." If a situation occurs where the depth suddenly increases from "5" to "12" and does not decrease back, it may indicate that the recursion has not terminated or that a long call chain has been maliciously constructed.

[0131] Recursion Depth Anomaly Flag: This is an array used to record information about recursion depth anomalies. Each element can record the name of the function that caused the recursion, and also the recursion depth value at the time the anomaly occurred. For example, if a function's recursion depth reaches 20, exceeding a reasonable threshold may trigger a stack overflow.

[0132] c) Memory access pattern analysis (corresponding to the stack memory access characteristics described above). Statistically analyze the frequency, location, and amount of data accessed in the stack region to identify abnormal write operations. Pay particular attention to frequent accesses or large writes to the bottom of the stack, as these may be precursors to stack overflow.

[0133] • Memory access frequency statistics: This can be achieved using hardware monitoring circuits or software instrumentation techniques. Hardware monitoring circuits can capture data on memory access signal lines and count the number of times the stack area memory is accessed within a specific time period, thereby obtaining the access frequency. Software instrumentation techniques involve inserting specific instructions into the program code to record relevant information each time the stack area memory is accessed, thereby calculating the access frequency.

[0134] • Memory access location recording: This can also be achieved using hardware monitoring circuits and software instrumentation techniques. Hardware monitoring circuits can obtain memory access address information to determine whether it is in the stack region and its specific location; software instrumentation techniques obtain and record the memory address each time stack memory is accessed, thereby tracking the memory access location.

[0135] • Memory access data volume statistics: This is achieved by monitoring the data bit width and the number of writes for each memory write operation. Hardware monitoring circuitry can detect and count the bit width of the written data; software instrumentation technology sets a counter in the program, incrementing the counter according to the data size of each write operation, thereby counting the amount of data written each time.

[0136] • Abnormal Write Operation Identification: Abnormal writes are identified based on set thresholds. For example, a threshold is set for the number of times the bottom stack region can be accessed per unit time. If the actual access frequency exceeds this threshold, it is considered abnormal. For data volume, a maximum data volume threshold is set for a single write to the bottom stack region. When the amount of data written exceeds this threshold, it is also considered abnormal.

[0137] Output data (which can be used as a stack memory access characteristic):

[0138] Memory access frequency: This indicates the number of times the stack memory is accessed per unit of time. "50" means that the stack memory was accessed 50 times within the set unit of time. By monitoring this frequency, abnormally frequent access can be detected, which may be a precursor to a stack overflow.

[0139] Access location information: This is an array that records the offset of the specific address relative to the stack base address each time memory is accessed in the stack region. Examples include "0x100" and "0x104". By tracing the access location, it is possible to determine whether there is any abnormal access to critical areas such as the bottom of the stack.

[0140] Accessed data volume: This is an array representing the size of data written in bytes for each memory access operation. Values ​​such as "4" and "8" indicate the number of bytes written in each operation. If a large amount of data is written to the bottom of the stack, there may be a risk of stack overflow.

[0141] Exception write flags: This is an array that records information related to exception writes. It can record the time the exception write occurred; it can also record the exception type, for example, writing data to the return address, which is a typical stack overflow attack.

[0142] (2) Data processing module.

[0143] The functional sub-modules are as follows:

[0144] a) Dataset Construction. A training set is constructed using synthetic attack data and normal operation data:

[0145] • Normal samples: collected from normally functioning programs.

[0146] • Abnormal samples: It is possible to construct a program with a controlled stack overflow and collect samples from the program's execution.

[0147] b) Feature standardization. The raw features (stack pointer offset rate, call chain depth changes, etc.) output by the behavior feature extraction module are standardized to eliminate the influence of units.

[0148] c) Sliding window construction.

[0149] The time-series features are grouped according to a fixed window length (e.g., 10 seconds), and statistical features within the window are extracted: Let X be the time-series data, representing a snapshot of the system's operational state at consecutive time points. The element x_t at each time point t contains multiple dimensions of system behavior features: for example, stack pointer features such as stack pointer offset rate and mutation point information; call chain features such as function call depth and recursion depth; and memory access features such as access frequency, access location, and amount of data written. These features collectively describe the real-time usage state of the system stack, and abnormal combinations of features may indicate a stack overflow risk.

[0150] For time series data X = {x_1, x_2, ..., x_n}, where n is the number of elements in the time series, and the feature vector at time point t is x_t, which can contain multiple dimensions of system behavior features, the sliding window operation can be represented as:

[0151] Window definition: If the window size is w and the step size is s, then the data points contained in the i-th window W_i are: W_i={x_i,x_i+1,...,x_i+w-1}, where i∈{1,1+s,1+2s,...,n-w+1}.

[0152] Window statistical features: For features in window W_i, corresponding statistics can be extracted for each system behavior feature. Examples include mean, standard deviation, and maximum value. Specifically, for x_i, x_i+1, ..., x_i+w-1 in window W_i, calculate the statistical values, such as mean, standard deviation, and maximum value, for the same type of system behavior feature (e.g., stack pointer offset rate).

[0153] Feature vector generation: Combine the statistical features obtained within window W_i into a new feature vector.

[0154] For example, x_i in window W_i can contain 10 system behavior features. Then, for each of the 10 system behavior features, by combining w features in window W_i, three statistical values ​​(mean, standard deviation, and maximum) can be determined, resulting in a total of 30 statistical values. These 30 statistical values ​​can then be combined into a 30-dimensional feature vector.

[0155] The feature vectors can be further transformed into three-dimensional data that can be input into the Long Short-Term Memory (LSTM) neural network model: its structure is [number of samples, time steps, feature dimensions] (e.g., 1000 samples, each sample containing 10 time steps, with 12 features per step). The number of time steps can be optimized based on training conditions, ranging from 10 to 50 time steps (corresponding to 100ms-500ms of monitoring data).

[0156] (3) Model training module. Lightweight long short-term memory neural network models can be used for training.

[0157] (4) Analysis and Defense Strategy Module. This module is responsible for inputting the collected feature data into the model for analysis in real time and achieving low-latency response in conjunction with hardware interrupts. Its core function is dynamic threshold determination: based on the abnormal probability output by the model (e.g., >0.9) and the hardware interrupt signal, a low-latency defense triggering mechanism is formulated. For example, when the hardware memory protection unit detects a stack pointer out of bounds and the model determines a high risk of stack overflow, the defense strategy is immediately triggered. Optional defense strategies include:

[0158] 1. Implement task isolation to separate the affected tasks from other tasks and prevent the risk from spreading.

[0159] 2. Perform a system rollback to restore the system to its previous safe state.

[0160] 3. Adaptive stack space adjustment, increasing stack space capacity to avoid overflow.

[0161] This embodiment also provides a specific process.

[0162] Model training: The data processing module uses the behavior feature extraction module to collect the raw feature data of the program during runtime, realizes dataset construction, feature standardization and sliding window construction, and finally outputs a dataset that can be used for training and testing. Then, the model training module uses the collected training set to train the model. The qualified model that meets the preset performance indicators can be put into application.

[0163] Practical application: The behavior feature extraction module collects the raw feature data of the program during runtime. This data is then standardized and a sliding window is constructed by the data processing module. The data is then input into the trained model, which calculates the anomaly probability. The analysis and defense strategy module then determines whether to adopt a defense strategy based on a preset threshold.

[0164] The beneficial effects of this embodiment include:

[0165] High real-time performance. It monitors program behavior in real time with millisecond-level response speed, and combines hardware interrupts to achieve low-latency response, enabling timely detection and handling of stack overflow issues, effectively ensuring the safe operation of the system.

[0166] It exhibits good resource adaptability. Employing a lightweight model optimized for operation in resource-constrained embedded environments, it combines hardware and software collaborative monitoring mechanisms to achieve efficient detection without consuming excessive resources.

[0167] Intelligent defense capabilities. It possesses adaptive defense strategies, and upon detecting a stack overflow, it can take measures such as task isolation, system rollback, or stack space adjustment based on the actual situation to enhance the system's security and stability.

[0168] Suitable for real-time operating systems and industrial control systems, it can detect and prevent potential stack overflow problems early in program execution.

[0169] Based on the above method embodiments, this application also provides a stack overflow risk detection device. Figure 3 The diagram illustrates a structural block diagram of a stack overflow risk detection device according to an embodiment of this application.

[0170] like Figure 3 As shown, a stack overflow risk detection device 300 in this embodiment includes: a determination unit 310 and a model unit 320.

[0171] The determining unit 310 is used to determine a sequence of stack operation behavior features for the target stack; the sequence of stack operation behavior features includes N stack operation behavior features arranged in chronological order; N is a positive integer. In one embodiment, the determining unit 310 can be used to execute the operation S210 described above, which will not be repeated here.

[0172] Model unit 320 is used to predict the stack overflow risk of a target stack based on a pre-trained risk prediction model and a determined sequence of stack operation behavior characteristics. In one embodiment, model unit 320 can be used to perform the operation S220 described above, which will not be repeated here.

[0173] Optionally, the stack operation behavior characteristics include at least one of the following: stack pointer characteristics, stack function call characteristics, and stack memory access characteristics.

[0174] Optionally, the determining unit 310 is used to: determine the stack operation behavior feature sequence for the target stack within the target time period; the model unit is used to perform at least one of the following: predict whether the target stack will experience a stack overflow within the target time period; predict the risk of the target stack experiencing a stack overflow after the target time period.

[0175] Optionally, model unit 320 is used to: predict the stack overflow risk of the target stack based on a pre-trained risk prediction model, for the determined stack operation behavior feature sequence, when it is determined that the stack pointer of the current target stack is out of bounds.

[0176] Optionally, the device further includes a monitoring unit for: monitoring stack operation behavior characteristics of the target stack; the stack operation behavior characteristic sequence includes newly monitored stack operation behavior characteristics.

[0177] Optionally, the determining unit 310 is used to: determine the characteristic sequence of different stack operation behaviors for the target stack within different time periods; the model unit 320 is used to: predict the stack overflow risk of the target stack based on the pre-trained risk prediction model for the determined different stack operation behavior characteristic sequences.

[0178] Optionally, model unit 320 is used to: determine the statistical characteristics among the stack operation behavior features in the determined stack operation behavior feature sequence; and predict the stack overflow risk of the target stack based on the determined statistical characteristics using a pre-trained risk prediction model.

[0179] For an explanation of this device embodiment, please refer to other embodiments.

[0180] According to embodiments of this application, any plurality of modules among the determining unit 310, model unit 320, and monitoring unit can be combined into one module, or any one of these modules can be split into multiple modules. Alternatively, at least a portion of the functionality of one or more of these modules can be combined with at least a portion of the functionality of other modules and implemented in one module. According to embodiments of this application, at least one of the determining unit 310, model unit 320, and monitoring unit can be at least partially implemented as hardware circuitry, such as a field-programmable gate array (FPGA), a programmable logic array (PLA), a system-on-a-chip, a system-on-a-substrate, a system-on-package, an application-specific integrated circuit (ASIC), or any other reasonable means of integrating or packaging circuitry, or implemented in software, hardware, or firmware, or in any appropriate combination of any of these three implementation methods. Alternatively, at least one of the determining unit 310, model unit 320, and monitoring unit can be at least partially implemented as a computer program module, which, when run, can perform corresponding functions.

[0181] Figure 4 A block diagram schematically illustrates an electronic device suitable for implementing a stack overflow risk detection method according to an embodiment of this application.

[0182] like Figure 4 As shown, an electronic device 900 according to an embodiment of this application includes a processor 901, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 902 or a program loaded from a storage portion 908 into a random access memory (RAM) 903. The processor 901 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or an associated chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 901 may also include onboard memory for caching purposes. The processor 901 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of this application.

[0183] RAM 903 stores various programs and data required for the operation of electronic device 900. Processor 901, ROM 902, and RAM 903 are interconnected via bus 904. Processor 901 executes various operations of the method flow according to embodiments of this application by executing programs in ROM 902 and / or RAM 903. It should be noted that the programs may also be stored in one or more memories other than ROM 902 and RAM 903. Processor 901 may also execute various operations of the method flow according to embodiments of this application by executing programs stored in said one or more memories.

[0184] According to embodiments of this application, the electronic device 900 may further include an input / output (I / O) interface 905, which is also connected to a bus 904. The electronic device 900 may also include one or more of the following components connected to the input / output (I / O) interface 905: an input section 906 including a keyboard, mouse, etc.; an output section 907 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 908 including a hard disk, etc.; and a communication section 909 including a network interface card such as a LAN card, modem, etc. The communication section 909 performs communication processing via a network such as the Internet. A drive 910 is also connected to the input / output (I / O) interface 905 as needed. A removable medium 911, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on the drive 910 as needed so that computer programs read from it can be installed into the storage section 908 as needed.

[0185] This application also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or it may exist independently and not assembled into the device / apparatus / system. The computer-readable storage medium carries one or more programs, which, when executed, implement the method according to the embodiments of this application.

[0186] According to embodiments of this application, the computer-readable storage medium can be a non-volatile computer-readable storage medium, such as including but not limited to: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this application, the computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. For example, according to embodiments of this application, the computer-readable storage medium may include ROM 902 and / or RAM 903 and / or one or more memories other than ROM 902 and RAM 903 described above.

[0187] Embodiments of this application also include a computer program product comprising a computer program containing program code for performing the methods shown in the flowchart. When the computer program product is run on a computer system, the program code is used to cause the computer system to implement any of the method embodiments provided in the embodiments of this application.

[0188] When the computer program is executed by the processor 901, it performs the functions defined in the system / apparatus of this application embodiment. According to the embodiments of this application, the systems, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0189] In one embodiment, the computer program may rely on a tangible storage medium such as an optical storage device or a magnetic storage device. In another embodiment, the computer program may also be transmitted and distributed in the form of signals over a network medium, and downloaded and installed via the communication section 909, and / or installed from a removable medium 911. The program code contained in the computer program can be transmitted using any suitable network medium, including but not limited to: wireless, wired, etc., or any suitable combination thereof.

[0190] In such an embodiment, the computer program can be downloaded and installed from a network via the communication section 909, and / or installed from the removable medium 911. When the computer program is executed by the processor 901, it performs the functions defined in the system of this application embodiment. According to the embodiments of this application, the systems, devices, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0191] According to embodiments of this application, program code for executing the computer programs provided in the embodiments of this application can be written in any combination of one or more programming languages. Specifically, these computational programs can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, languages ​​such as Java, C++, Python, "C", or similar programming languages. The program code can be executed entirely on the user's computing device, partially on the user's device, partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0192] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0193] Those skilled in the art will understand that the features described in the various embodiments of this application can be combined and / or combined in various ways, even if such combinations or combinations are not explicitly described in this application. In particular, the features described in the various embodiments of this application can be combined and / or combined in various ways without departing from the spirit and teachings of this application. All such combinations and / or combinations fall within the scope of this application.

Claims

1. A method for predicting stack overflow risk, characterized in that, include: Determine the stack operation behavior feature sequence for the target stack; the stack operation behavior feature sequence includes N stack operation behavior features arranged in chronological order; N is a positive integer; Based on a pre-trained risk prediction model, the stack overflow risk of the target stack is predicted for the determined stack operation behavior feature sequence.

2. The method according to claim 1, characterized in that, The stack operation behavior characteristics include at least one of the following: stack pointer characteristics, stack function call characteristics, and stack memory access characteristics.

3. The method according to claim 1, characterized in that, The step of determining the stack operation behavior feature sequence for the target stack includes: determining the stack operation behavior feature sequence for the target stack within the target time period; The prediction of the stack overflow risk of the target stack includes at least one of the following: Predict whether the target stack will experience a stack overflow within the target time period; The risk of stack overflow occurring in the target stack after the target time period is predicted.

4. The method according to claim 1, characterized in that, The pre-trained risk prediction model predicts the stack overflow risk of the target stack based on the determined stack operation behavior feature sequence, including: If it is determined that the stack pointer of the target stack is out of bounds, the stack overflow risk of the target stack is predicted based on the pre-trained risk prediction model and the determined stack operation behavior feature sequence.

5. The method according to claim 1, characterized in that, The method further includes: monitoring stack operation behavior characteristics of the target stack; The stack operation behavior feature sequence includes newly detected stack operation behavior features.

6. The method according to claim 1, characterized in that, The determination of the stack operation behavior feature sequence for the target stack includes: determining different stack operation behavior feature sequences for the target stack within different time periods; The pre-trained risk prediction model predicts the stack overflow risk of the target stack based on the determined stack operation behavior feature sequence, including: Based on a pre-trained risk prediction model, the stack overflow risk of the target stack is predicted for different stack operation behavior feature sequences.

7. The method according to claim 1, characterized in that, The pre-trained risk prediction model predicts the stack overflow risk of the target stack based on the determined stack operation behavior feature sequence, including: For the determined sequence of stack operation behavior characteristics, determine the statistical characteristics among the stack operation behavior characteristics; Based on a pre-trained risk prediction model, the stack overflow risk of the target stack is predicted according to the determined statistical characteristics.

8. A stack overflow risk prediction device, characterized in that, include: The determining unit is used to determine the sequence of stack operation behavior characteristics for the target stack; The stack operation behavior feature sequence includes N stack operation behavior features arranged in chronological order; N is a positive integer; The model unit is used to predict the stack overflow risk of the target stack based on a pre-trained risk prediction model and a determined sequence of stack operation behavior characteristics.

9. An electronic device, comprising: One or more processors; Memory, used to store one or more computer programs. The characteristic feature is that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program or instructions stored thereon, characterized in that, When the computer program or instructions are executed by a processor, they implement the steps of the method according to any one of claims 1 to 7.

11. A computer program product, comprising a computer program or instructions, characterized in that, When the computer program or instructions are executed by a processor, they implement the steps of the method according to any one of claims 1 to 7.

Images