39 results about "Program behavior" patented technology

The invention discloses an industrial robot programming teaching method and system, and belongs to the technical field of programming teaching, and the method specifically comprises the steps: collecting programming behavior data and industrial robot operation data in real time, generating learning state data of students according to the programming behavior data and the industrial robot operation data, and storing the learning state data of the students; the learning state data of the student comprises a programming behavior, a knowledge mastering degree and a learning style of the student, determining a knowledge point node embedding offset in combination with a preset dynamic knowledge graph according to the learning state data of the student, and updating the current dynamic knowledge graph according to the knowledge point node embedding offset, determining a current knowledge difficulty of the student based on the current dynamic knowledge graph, and pushing difficulty analysis data to a learning terminal of the student based on the current knowledge difficulty; according to the invention, accurate knowledge feedback for individual differences is realized, and the pertinence and efficiency of industrial robot programming teaching are effectively improved.

Arrangements for optimizing software performance through generative artificial intelligence are provided. Execution data associated with a user interacting with an application programming interface through a user interface on a computing device may be received. Trace data based on the execution data may be generated. The trace data may indicate that a performance of an application is degraded. One or more performance prompts specifying program behavior may be generated. Application source code and the performance prompts may be sent to an artificial intelligence engine for performing key performance indicator driven code analysis. The one or more performance prompts may have been executed in the artificial intelligence engine for pretraining a large language model. Optimized source code may be received from the artificial intelligence engine. Performance testing may be executed on the optimized source code. An action may be performed to address the performance of the application.

The techniques disclosed herein enable systems to leverage publisher profile and reputation to detect malware and block malicious actors. This is accomplished by obtaining a description of a software application that is pending release from the publisher. The description defines the nominal functionality of the software application such as expected program behaviors and device driver accesses. The system then catalogues the actual functionality of the software application by analyzing the program code implementing the software application. Accordingly, the generative model can detect inconsistencies between the actual functionality and the nominal functionality. In response, the generative model can initiate an interaction with the publisher to resolve the inconsistency. The publisher can respond with a justification of the inconsistency which is evaluated by the generative model in accordance with a reputation score associated with the publisher. The generative model optionally approves or blocks the software application based on the reputation score.

The embodiment of the invention provides a program error tracing method, electronic equipment, a storage medium and a program product. The method comprises the following steps: acquiring behavior data when a program runs; comparing the behavior data with a reference behavior model, and identifying abnormal behavior nodes; based on the abnormal behavior nodes, constructing a correlation graph of program behaviors; and based on the association map, positioning the root cause of the program error through bidirectional tracing. According to the method, the transformation from experience-dependent and isolated phenomenon analysis to systematic and automatic root cause mining is realized, and the problem of cross-module and hidden complex error tracing is solved.

This invention provides a privacy protection method and system for preventing misbehavior in mini-programs based on deep learning. It utilizes the collaborative efforts of deep learning and program analysis techniques to detect inconsistencies between the expected and actual behavior of mini-programs. This invention provides a novel mini-program analysis technique that associates UI information of widgets with corresponding program behaviors and determines the actual behavior of widgets based on program analysis, thereby enabling the construction of large-scale, high-quality training datasets. Based on the results of program analysis, deep learning techniques are used to learn an icon-behavior model from unstructured datasets to infer the expected behavior of widgets. This invention uses a defined three-layer standard model to detect differences between actual and expected behavior by calculating outlier scores. If any inconsistency is found, it indicates the presence of a misbehaving mini-program. The risk level of the inappropriate behavior can then be estimated, and countermeasures can be proactively implemented.

This application discloses a method and apparatus for cross-resource pool API behavior detection. The method includes: acquiring historical code corresponding to API behavior in the source and destination resource pools and related network performance loss data; constructing sine / cosine functions based on this data and determining the positional encoding of the historical code; acquiring the code corresponding to the API behavior in the source and destination pools and determining the corresponding word segmentation encoding; determining the positional vector corresponding to the source and destination code based on the word segmentation encoding and the stored positional encoding; detecting whether the positional vector matches the stored sine / cosine functions; and determining whether the API behavior in the source and destination pools is abnormal based on the detection result. This application improves the uniqueness of consistency analysis results by expanding the code dimension features through multiple sine / cosine functions, solving the problem of low accuracy in consistency analysis of program behavior using distance similarity in related technologies, and avoiding the problem that consistency analysis results in related technologies are easily manipulated and corrupted by malicious nodes.

The invention discloses a malicious program defense method and device and a storage medium. Relates to the technical field of computer security. Matching the operation behavior with a program behavior feature evaluation library to obtain a first risk assessment value; under the condition that the first risk assessment value reaches a first preset condition, acquiring a behavior chain of the operation behavior and behavior feature information of each behavior in the behavior chain; inputting the behavior feature information of each behavior in the behavior chain into the dynamic behavior recognition algorithm model, and calculating to obtain a second risk assessment value of the behavior chain; judging whether the program is a malicious program or not according to the second risk assessment value; and under the condition that the program is the malicious program, processing the malicious program. By means of the method and device, the problem that the defense effect on the unknown program is poor due to the fact that whether the unknown program is the malicious program or not cannot be accurately recognized in the related technology is solved.

The present application relates to a SOC verification and optimization method, apparatus, computer equipment, and medium based on instruction stream analysis, which uniformly samples subroutines of a program and extracts Basic Block sequence information in the subroutines; extracts instruction information of each Basic Block; aggregates instruction information and Basic Block sequence information to obtain an instruction sequence, and constructs an instruction semantic sequence model based on an autoregressive language model based on the instruction sequence; constructs a Basic Block program behavior representation model based on the instruction semantic sequence model and using a comparative learning method; reads several sliced ​​subroutines to be run, and obtains the semantic representation of the sliced ​​subroutines through the Basic Block program behavior representation model; constructs a subroutine similarity matrix based on the semantic representation of the sliced ​​subroutine, and performs program selection based on the subroutine similarity matrix.

The application discloses an evasive malicious software detection method and system based on dynamic plug-in. The method is as follows: deploying anti-anti-plug-in strategy, constructing trapping environment; inserting monitoring code in multiple levels of the trapping environment, establishing multi-level and fine-grained program behavior monitoring; for each target program in the trapping environment, after the probe instruction or function in the monitoring code is executed, the memory buffer area or register used for storing the probe result is dynamically identified and marked; the probe result is continuously monitored, when the probe result is tracked to be used for comparison instruction and affects the jump of subsequent conditional branch instruction, it is determined that the target program has a "probe-decision" logic chain; when the target program has one or more "probe-decision" logic chains, it is determined that the target program is evasive malicious software. The application can realize accurate, robust and automatic identification of evasive behavior.

The invention relates to the technical field of software engineering and software quality assurance, and provides a method and a system for evaluating influence of quantitative code change on a program implementation effect. The method comprises the following steps: acquiring code difference information between a to-be-tested code branch and a baseline branch, analyzing and extracting structured information of a changed code through a large language model, and calculating a basic influence value of the structured information of the changed code; calling a program behavior feature library based on the structured information of the change code, and calculating a dynamic adjustment coefficient; calculating the final influence score of each dimension according to the product of the basic influence value of the structured information of the change code and the dynamic adjustment coefficient; the final influence score of each dimension comprises a core function influence score, a performance efficiency influence score, a data consistency influence score, an interface compatibility influence score and a security influence score; and generating an influence analysis report according to the final influence score of each dimension. According to the method, the basic influence value determined by the change type is multiplied by the dynamic adjustment coefficient determined by the module criticality and the historical risk, so that the code change influence is accurately and dynamically quantified.

The invention discloses an APT detection method and device in a smart power plant and a storage medium. The method comprises the steps that a program behavior model is adopted, and a low-layer system call API and a high-layer call stack API are fused to construct a feature generation module so as to accurately describe software behaviors; a noise problem is solved by using an optimal local graph matching algorithm based on dynamic programming, so that behaviors of malicious software are accurately identified. In the application, the feature generation module is constructed by combining the program behavior model with the low-level system call API and the high-level call stack API, so as to accurately describe software behaviors; and the noise problem is solved by using an optimal local graph matching algorithm of dynamic planning, and malicious software behaviors are accurately identified. According to the method, the detection accuracy and reliability are improved through multi-level and multi-dimensional feature description, noise is effectively filtered out, and the power plant network security protection capability, adaptability and expandability are improved.

The application belongs to the technical field of automatic software testing and program analysis, and relates to a precise testing service system based on software code analysis reasoning, which comprises a data acquisition and initial graph construction module, an initial context-aware probability execution graph being constructed in combination with static potential call edges; a syntax change semantic analysis module, a structured syntax disturbance signature being generated; a probability disturbance instruction generation module, conditional probability disturbance instructions and polymorphic distribution disturbance instructions being generated, and a probability disturbance instruction set being aggregated; a graph real-time reconstruction module, a reconstructed probability execution graph being generated; an influence domain propagation analysis module, affected nodes being determined and an affected function set being generated; and a regression test subset generation module, a minimized regression test subset being generated. The application solves the problem that, when a traditional regression test selection method faces context-related program behaviors, the actual runtime influence probability of changes cannot be quantified, resulting in inaccurate test range selection.

The invention provides a runtime program behavior analysis and code patch-based communication behavior prediction method, which comprises the following steps of: inserting a code patch in a program code, the code patch comprising an instrumentation point; when the program runs to the instrumentation point for the first time, program behavior analysis is triggered, and the program behavior analysis comprises the steps of discovering a communication function according to a predefined analysis rule, reversely tracking and identifying a data relationship among parameters on which the communication function depends along a program path, and analyzing execution time of each communication point in the communication function; and according to the data relationship and the execution time, predicting the communication data volume and the communication occurrence time from the current program position to the communication point. According to the method, the program behavior of distributed machine learning can be observed, and the next communication behavior is speculated according to the program behavior. As one backstepping process is omitted, the method has higher prediction precision.

Different versions of a program are executed in a first mode of operation in accordance with normal operations with only expected behavior to generate different acceptable behavior models indicative of behavior of the program. A difference between acceptable behavior models indicates different risk profiles for the different versions of the program. Risk profiles can be generated by a model explainer. An event that attempts to execute remote code or a delayed event can be detected in a second mode of operation if the event or the delayed event is not included in the acceptable behavior model. Different sequences of events in the first or second mode can be instrumented at different levels of instrumentation to generate or use the acceptable behavior model. The sequences of events can be generated from a stacktrace in the first and second modes. The instrumentation can be performed in hardware by intercepting SYSCALLs.

The techniques disclosed herein enable systems to leverage publisher profile and reputation to detect malware and block malicious actors. This is accomplished by obtaining a description of a software application that is pending release from the publisher. The description defines the nominal functionality of the software application such as expected program behaviors and device driver accesses. The system then catalogues the actual functionality of the software application by analyzing the program code implementing the software application. Accordingly, the generative model can detect inconsistencies between the actual functionality and the nominal functionality. In response, the generative model can initiate an interaction with the publisher to resolve the inconsistency. The publisher can respond with a justification of the inconsistency which is evaluated by the generative model in accordance with a reputation score associated with the publisher. The generative model optionally approves or blocks the software application based on the reputation score.

This application belongs to the field of industrial control protocols and discloses a method, device, and medium for constructing an industrial control protocol semantic feature library based on program behavior analysis, including: S1: constructing typical industrial control field tags to form a unified set of field semantic tags; S2: acquiring execution context data; S3: performing symbolic execution analysis of protocol message processing to extract symbolic expressions related to protocol field processing; S4: dividing protocol field boundaries and classifying symbolic expressions by field as the original dataset; S5: extracting field program behavior features; S6: filtering field semantic features to select the most distinguishable field semantics from the original features; S7: constructing a semantic feature library by statistically analyzing the filtered features of each field in the original dataset, selecting filtered features that appear more frequently than a preset frequency and combining them to form composite features that can describe field semantics, and forming a complete industrial control protocol semantic feature library by constructing composite features for all fields.

Apparatuses and methods for mitigating speculative based attacks on a processor are disclosed. In one example of the disclosed technology, an apparatus includes a processor, the apparatus having a memory positioned to store profiler data to measure at least one performance criterion for an instruction stream executed by the processor, and having control logic configured to select one of a plurality of mitigation schemes to mitigate a speculative based attack on the apparatus based on the measured performance criterion. The apparatus can include a remediation unit that can prevent a speculative side effect by implementing a delay scheme, a redo scheme, or a rollback scheme, which prevents side effect data generated by a mis-speculative instruction from becoming visible to an attacker.

The present invention discloses a method for constructing a malicious program behavior rule set, which includes steps of describing malicious program behaviors using an ontology; extracting malicious program behavior features; constructing a fine-grained malicious program behavior rule set; constructing a coarse-grained program behavior rule set; and constructing a behavior rule set for detectable program categories. The construction method of the present invention proposes a formalized extended description method based on the API call frequency of malicious programs, and realizes a complete description of program behaviors based on the ontology. The behavior rule set for detectable program categories jointly constructed by the fine-grained malicious program behavior rule set and the coarse-grained program behavior rule set is complete. By inputting the inference rules into an inference engine and binding the inference engine to the ontology, the behavior rule set can be used to perform inference detection on unknown samples, mark the categories of unknown programs, and comprehensively cover the inference detection of unknown samples.

The present invention belongs to the field of security detection technology, and discloses an application security detection method, device, equipment and storage medium. The method determines the application to be detected and the corresponding application identifier to be detected according to the application security detection instruction when receiving the application security detection instruction from the user; obtains the corresponding program behavior specification data from the preset behavior data set according to the application identifier to be detected; calls the application to be detected and obtains the current running data of the application to be detected; and performs application security detection on the application to be detected according to the program behavior specification data and the current running data. In the present invention, the program behavior specification data and the current running data of the application are combined to detect whether there are security problems in the terminal application. The program behavior specification data comes from the program developer, provides the most comprehensive program behavior detection, significantly improves the accuracy of the application security detection results, and solves the technical problem of inaccurate application security detection results in the existing application.

The invention belongs to the field of industrial control protocols, and discloses an industrial control protocol semantic feature library construction method and device based on program behavior analysis, and a medium, and the method comprises the steps: S1, constructing typical industrial control field tags, and forming a unified field semantic tag set; s2, executing context data acquisition; s3, performing symbolic execution analysis in a protocol message processing process, and extracting a symbolic expression related to protocol field processing; s4, dividing protocol field boundaries, classifying symbol expressions according to fields, and taking the symbol expressions as an original data set; s5, field program behavior feature extraction; s6, field semantic feature screening: screening out screening features which can distinguish field semantics most from the original features; and S7, constructing a semantic feature library, counting the screening features of each field in the original data set, selecting the screening features appearing at a frequency greater than a preset frequency, combining the screening features to form composite features capable of describing field semantics, and constructing the composite features for all fields to form a complete industrial control protocol semantic feature library.

The invention discloses a formalized protocol generation and verification method for an ESBMC, which reduces manual intervention by combining a large language model and an ESBMC tool, can significantly improve the verification efficiency and accuracy of a complex program, and can fully reflect the real behavior of the program by an automatically generated protocol when processing the program containing a complex control structure. The method comprises the following steps: analyzing extracted program information by using a large language model, automatically generating a precondition, a postcondition and a loop invariant formalized protocol, and inputting the precondition, the postcondition and the loop invariant formalized protocol into an ESBMC tool for verification to obtain a verification result. The verification result of the ESBMC is fed back to the protocol generation module, the generated protocol is refined and repaired, the generation strategy is dynamically adjusted, optimization is carried out according to different program behaviors, and it is ensured that the generated formalized protocol is accurate and effective. The capability of continuously optimizing the large language model through supervision fine tuning and enhanced training enables the model to automatically adapt to the characteristics of different programs, and a more accurate protocol is generated.

This invention relates to the field of educational technology, specifically to a learning analysis system and method for online programming learning, comprising a programming behavior collection module, a code semantic quantification module, a cognitive load assessment module, a learning stage discrimination module, and a cognitive adaptation resource library; wherein: the programming behavior collection module is used to collect operational behavior data; the code semantic quantification module is used to parse the abstract syntax tree of user-submitted code; the cognitive load assessment module is used to output a three-dimensional load index; the learning stage discrimination module is used to determine the user's current stage; and the cognitive adaptation resource library matches resources based on the discrimination results of the learning stage discrimination module. This invention, by collecting learners' programming behavior data in real time and combining it with cognitive load assessment, accurately determines the learner's learning stage, thereby providing personalized teaching resources, thus improving programming learning efficiency and reducing cognitive load.

The improved compiler identifies an interception declaration in the source code and issues code that instead replaces a call to a specified article with a call to a specified interceptor. The source generator proactively modifies program behavior in any desired manner without introducing hidden security violations and without requiring edits required by program developers. The interception declaration is visible in source code and development tools. In some cases, different calls to a particular method at a respective location are intercepted by different alternate methods. Alternative methods have the same signature, or are otherwise compatible. Some interceptors specify selectable parameters. Method calls, field accesses, and attribute calls may be intercepted. Work for modifying program behavior is shifted from runtime to compilation in a program lifecycle, thereby improving runtime performance and eliminating JIT compilation security risks.

The invention discloses a test case processing method and device, a storage medium and electronic equipment, and relates to the technical field of software testing, and the method comprises the following steps: firstly, obtaining code files corresponding to a plurality of test cases; performing structured analysis on the code file, and extracting key operation nodes, natural language clauses and input parameters respectively corresponding to the plurality of test cases; on the basis of the key operation nodes, the natural language clauses and the input parameters, the mixing similarity of the multiple test cases is calculated; determining the test cases with the mixing similarity higher than a similarity threshold as redundant test cases; according to the method, duplicate removal processing is carried out on redundant test cases through the deep learning model, the capability of understanding program behavior semantics is remarkably improved, then test scripts with equivalent functions in different languages can be recognized, meanwhile, the accuracy and processing efficiency of duplicate removal of the test cases are improved, and the test efficiency is improved. And the actual requirements of multi-language and large-scale test scenes in software testing can be better met.

The invention relates to an anti-quantum cryptography hybrid programming language program verification method and an anti-quantum cryptography hybrid programming language program verification system. The method comprises the following steps: inputting a password protocol program to be verified in Rocq based on a hybrid programming language; subprograms in the cryptographic protocol program are modeled in a formalized mode through a module system, and classic program behaviors and quantum program behaviors in the cryptographic protocol program are described based on a unified grammar framework of a hybrid programming language; performing type checking and grammar checking on a program written based on a unified grammar framework and a module system; generating semantics of the program according to grammar for the program passing the check; protocol properties needing to be proved are described in a formalized mode according to grammar; establishing an inference rule based on program rewriting on the basis of grammar; and carrying out interactive certification on the formally described protocol property in the Rocq by using a certification strategy of the Rocq. According to the method, the security of the complex password protocol can be completely and accurately described and automatically verified, and the verification reliability and efficiency are remarkably improved.

The invention discloses a program behavior intervention method based on a quantum state, particularly relates to the technical field of computer security protection, and is used for solving the problems of resource conflict and stability reduction caused by systematic mismatching when quantum randomness is directly introduced into a classical computing system. A quantum random number sequence is obtained in real time, system state parameters of a target program are monitored synchronously, then a clustering mode in the random sequence is recognized, the system state is coupled to determine an intervening scheduling gap of an operating system, and then the matching degree of the clustering mode and the scheduling gap is evaluated to judge the compatibility relation. On the basis of the relation and the system state parameters, constructing a Pareto leading edge of intervention efficiency and system stability and determining an optimal solution set, selecting an adaptive operation point by evaluating the cumulative effect of optimal solutions and historical intervention, and finally modulating a quantum random number sequence according to the operation point to generate an intervention instruction and injecting the intervention instruction into a target program; and adaptive cooperation of quantum randomness and system certainty is realized.

The application discloses a formal specification generation and verification method for ESBMC, which reduces manual intervention by combining a large language model with an ESBMC tool, can significantly improve the verification efficiency and accuracy of complex programs, and can fully reflect the real behavior of the program when processing programs containing complex control structures. The automatically generated specification can fully reflect the real behavior of the program when processing programs containing complex control structures. By using a large language model to analyze and extract program information, the preconditions, postconditions and loop invariant formal specification are automatically generated, which are input into the ESBMC tool for verification to obtain the verification result. The verification result of ESBMC is fed back to the specification generation module, the generated specification is refined and repaired, and the generation strategy is dynamically adjusted to optimize different program behaviors, so that the generated formal specification is accurate and effective. Through supervised fine-tuning and reinforcement training, the ability of the large language model is continuously optimized, so that the model can automatically adapt to the characteristics of different programs and generate more accurate specifications.

This invention relates to a semi-automatic method and system for refining firmware relationships, comprising: S1, formal verification of the firmware abstract specification layer: First, modeling the firmware requirement interface document and performing attribute reduction, i.e., formal reduction; then, constraining the attribute reduction using first-order theory to generate an SMT expression file for the abstract specification layer; S2, formal verification of the firmware program execution specification layer; S3, SMT-LIB theory unification: through a semi-automatic method, converting both the SBI standard and program behavior into SMT expressions, and performing theoretical conversion and syntax unification on the converted SBI standard and program behavior; S4, formal verification of the SMT solver; S5, generating a verification report; S6, visualizing the verification report. This invention can effectively verify whether firmware meets requirement specifications and discover potential errors and security vulnerabilities.

A method for the automated performance of software tests for a program to be tested in an embedded system. The method includes: ascertaining, using an emulation-based fuzzer, a program behavior of the program to be tested, wherein at least one emulation-based result is derived on this basis; ascertaining, using a hardware-based fuzzer, the program behavior of the program to be tested, wherein at least one hardware-based result is derived on this basis; providing, using a monitoring component, the derived results, wherein the emulation-based result is provided to the hardware-based fuzzer, and / or the hardware-based result is provided to the emulation-based fuzzer.