47 results about "Program behavior" patented technology

The invention discloses an industrial robot programming teaching method and system, and belongs to the technical field of programming teaching, and the method specifically comprises the steps: collecting programming behavior data and industrial robot operation data in real time, generating learning state data of students according to the programming behavior data and the industrial robot operation data, and storing the learning state data of the students; the learning state data of the student comprises a programming behavior, a knowledge mastering degree and a learning style of the student, determining a knowledge point node embedding offset in combination with a preset dynamic knowledge graph according to the learning state data of the student, and updating the current dynamic knowledge graph according to the knowledge point node embedding offset, determining a current knowledge difficulty of the student based on the current dynamic knowledge graph, and pushing difficulty analysis data to a learning terminal of the student based on the current knowledge difficulty; according to the invention, accurate knowledge feedback for individual differences is realized, and the pertinence and efficiency of industrial robot programming teaching are effectively improved.

Arrangements for optimizing software performance through generative artificial intelligence are provided. Execution data associated with a user interacting with an application programming interface through a user interface on a computing device may be received. Trace data based on the execution data may be generated. The trace data may indicate that a performance of an application is degraded. One or more performance prompts specifying program behavior may be generated. Application source code and the performance prompts may be sent to an artificial intelligence engine for performing key performance indicator driven code analysis. The one or more performance prompts may have been executed in the artificial intelligence engine for pretraining a large language model. Optimized source code may be received from the artificial intelligence engine. Performance testing may be executed on the optimized source code. An action may be performed to address the performance of the application.

The invention discloses a tensor program analysis method and device based on machine learning and a storage medium, and relates to the technical field of tensor program analys.The method comprises the steps that a to-be-analyzed tensor program is embedded into a preset program behavior feature template, and unified feature representation corresponding to the to-be-analyzed tensor program is constructed; and inputting the unified feature representation into a pre-trained performance evaluation model to obtain a performance prediction result output by the performance evaluation model. According to the method, the program behavior feature template can be designed according to the unified program behavior of the tensor program, so that the unified feature representation can be efficiently obtained for various hardware platforms; and through a preset performance evaluation model, the performance of the tensor program is analyzed according to the unified feature representation, and a performance prediction result of the tensor program to be analyzed is obtained.

The techniques disclosed herein enable systems to leverage publisher profile and reputation to detect malware and block malicious actors. This is accomplished by obtaining a description of a software application that is pending release from the publisher. The description defines the nominal functionality of the software application such as expected program behaviors and device driver accesses. The system then catalogues the actual functionality of the software application by analyzing the program code implementing the software application. Accordingly, the generative model can detect inconsistencies between the actual functionality and the nominal functionality. In response, the generative model can initiate an interaction with the publisher to resolve the inconsistency. The publisher can respond with a justification of the inconsistency which is evaluated by the generative model in accordance with a reputation score associated with the publisher. The generative model optionally approves or blocks the software application based on the reputation score.

The embodiment of the invention provides a program error tracing method, electronic equipment, a storage medium and a program product. The method comprises the following steps: acquiring behavior data when a program runs; comparing the behavior data with a reference behavior model, and identifying abnormal behavior nodes; based on the abnormal behavior nodes, constructing a correlation graph of program behaviors; and based on the association map, positioning the root cause of the program error through bidirectional tracing. According to the method, the transformation from experience-dependent and isolated phenomenon analysis to systematic and automatic root cause mining is realized, and the problem of cross-module and hidden complex error tracing is solved.

This invention provides a privacy protection method and system for preventing misbehavior in mini-programs based on deep learning. It utilizes the collaborative efforts of deep learning and program analysis techniques to detect inconsistencies between the expected and actual behavior of mini-programs. This invention provides a novel mini-program analysis technique that associates UI information of widgets with corresponding program behaviors and determines the actual behavior of widgets based on program analysis, thereby enabling the construction of large-scale, high-quality training datasets. Based on the results of program analysis, deep learning techniques are used to learn an icon-behavior model from unstructured datasets to infer the expected behavior of widgets. This invention uses a defined three-layer standard model to detect differences between actual and expected behavior by calculating outlier scores. If any inconsistency is found, it indicates the presence of a misbehaving mini-program. The risk level of the inappropriate behavior can then be estimated, and countermeasures can be proactively implemented.

This application discloses a method and apparatus for cross-resource pool API behavior detection. The method includes: acquiring historical code corresponding to API behavior in the source and destination resource pools and related network performance loss data; constructing sine / cosine functions based on this data and determining the positional encoding of the historical code; acquiring the code corresponding to the API behavior in the source and destination pools and determining the corresponding word segmentation encoding; determining the positional vector corresponding to the source and destination code based on the word segmentation encoding and the stored positional encoding; detecting whether the positional vector matches the stored sine / cosine functions; and determining whether the API behavior in the source and destination pools is abnormal based on the detection result. This application improves the uniqueness of consistency analysis results by expanding the code dimension features through multiple sine / cosine functions, solving the problem of low accuracy in consistency analysis of program behavior using distance similarity in related technologies, and avoiding the problem that consistency analysis results in related technologies are easily manipulated and corrupted by malicious nodes.

The invention discloses a malicious program defense method and device and a storage medium. Relates to the technical field of computer security. Matching the operation behavior with a program behavior feature evaluation library to obtain a first risk assessment value; under the condition that the first risk assessment value reaches a first preset condition, acquiring a behavior chain of the operation behavior and behavior feature information of each behavior in the behavior chain; inputting the behavior feature information of each behavior in the behavior chain into the dynamic behavior recognition algorithm model, and calculating to obtain a second risk assessment value of the behavior chain; judging whether the program is a malicious program or not according to the second risk assessment value; and under the condition that the program is the malicious program, processing the malicious program. By means of the method and device, the problem that the defense effect on the unknown program is poor due to the fact that whether the unknown program is the malicious program or not cannot be accurately recognized in the related technology is solved.

The present application relates to a SOC verification and optimization method, apparatus, computer equipment, and medium based on instruction stream analysis, which uniformly samples subroutines of a program and extracts Basic Block sequence information in the subroutines; extracts instruction information of each Basic Block; aggregates instruction information and Basic Block sequence information to obtain an instruction sequence, and constructs an instruction semantic sequence model based on an autoregressive language model based on the instruction sequence; constructs a Basic Block program behavior representation model based on the instruction semantic sequence model and using a comparative learning method; reads several sliced ​​subroutines to be run, and obtains the semantic representation of the sliced ​​subroutines through the Basic Block program behavior representation model; constructs a subroutine similarity matrix based on the semantic representation of the sliced ​​subroutine, and performs program selection based on the subroutine similarity matrix.

The application discloses an evasive malicious software detection method and system based on dynamic plug-in. The method is as follows: deploying anti-anti-plug-in strategy, constructing trapping environment; inserting monitoring code in multiple levels of the trapping environment, establishing multi-level and fine-grained program behavior monitoring; for each target program in the trapping environment, after the probe instruction or function in the monitoring code is executed, the memory buffer area or register used for storing the probe result is dynamically identified and marked; the probe result is continuously monitored, when the probe result is tracked to be used for comparison instruction and affects the jump of subsequent conditional branch instruction, it is determined that the target program has a "probe-decision" logic chain; when the target program has one or more "probe-decision" logic chains, it is determined that the target program is evasive malicious software. The application can realize accurate, robust and automatic identification of evasive behavior.

The invention relates to the technical field of software engineering and software quality assurance, and provides a method and a system for evaluating influence of quantitative code change on a program implementation effect. The method comprises the following steps: acquiring code difference information between a to-be-tested code branch and a baseline branch, analyzing and extracting structured information of a changed code through a large language model, and calculating a basic influence value of the structured information of the changed code; calling a program behavior feature library based on the structured information of the change code, and calculating a dynamic adjustment coefficient; calculating the final influence score of each dimension according to the product of the basic influence value of the structured information of the change code and the dynamic adjustment coefficient; the final influence score of each dimension comprises a core function influence score, a performance efficiency influence score, a data consistency influence score, an interface compatibility influence score and a security influence score; and generating an influence analysis report according to the final influence score of each dimension. According to the method, the basic influence value determined by the change type is multiplied by the dynamic adjustment coefficient determined by the module criticality and the historical risk, so that the code change influence is accurately and dynamically quantified.

The invention discloses an APT detection method and device in a smart power plant and a storage medium. The method comprises the steps that a program behavior model is adopted, and a low-layer system call API and a high-layer call stack API are fused to construct a feature generation module so as to accurately describe software behaviors; a noise problem is solved by using an optimal local graph matching algorithm based on dynamic programming, so that behaviors of malicious software are accurately identified. In the application, the feature generation module is constructed by combining the program behavior model with the low-level system call API and the high-level call stack API, so as to accurately describe software behaviors; and the noise problem is solved by using an optimal local graph matching algorithm of dynamic planning, and malicious software behaviors are accurately identified. According to the method, the detection accuracy and reliability are improved through multi-level and multi-dimensional feature description, noise is effectively filtered out, and the power plant network security protection capability, adaptability and expandability are improved.

The application belongs to the technical field of automatic software testing and program analysis, and relates to a precise testing service system based on software code analysis reasoning, which comprises a data acquisition and initial graph construction module, an initial context-aware probability execution graph being constructed in combination with static potential call edges; a syntax change semantic analysis module, a structured syntax disturbance signature being generated; a probability disturbance instruction generation module, conditional probability disturbance instructions and polymorphic distribution disturbance instructions being generated, and a probability disturbance instruction set being aggregated; a graph real-time reconstruction module, a reconstructed probability execution graph being generated; an influence domain propagation analysis module, affected nodes being determined and an affected function set being generated; and a regression test subset generation module, a minimized regression test subset being generated. The application solves the problem that, when a traditional regression test selection method faces context-related program behaviors, the actual runtime influence probability of changes cannot be quantified, resulting in inaccurate test range selection.

The invention provides a runtime program behavior analysis and code patch-based communication behavior prediction method, which comprises the following steps of: inserting a code patch in a program code, the code patch comprising an instrumentation point; when the program runs to the instrumentation point for the first time, program behavior analysis is triggered, and the program behavior analysis comprises the steps of discovering a communication function according to a predefined analysis rule, reversely tracking and identifying a data relationship among parameters on which the communication function depends along a program path, and analyzing execution time of each communication point in the communication function; and according to the data relationship and the execution time, predicting the communication data volume and the communication occurrence time from the current program position to the communication point. According to the method, the program behavior of distributed machine learning can be observed, and the next communication behavior is speculated according to the program behavior. As one backstepping process is omitted, the method has higher prediction precision.

Different versions of a program are executed in a first mode of operation in accordance with normal operations with only expected behavior to generate different acceptable behavior models indicative of behavior of the program. A difference between acceptable behavior models indicates different risk profiles for the different versions of the program. Risk profiles can be generated by a model explainer. An event that attempts to execute remote code or a delayed event can be detected in a second mode of operation if the event or the delayed event is not included in the acceptable behavior model. Different sequences of events in the first or second mode can be instrumented at different levels of instrumentation to generate or use the acceptable behavior model. The sequences of events can be generated from a stacktrace in the first and second modes. The instrumentation can be performed in hardware by intercepting SYSCALLs.

The techniques disclosed herein enable systems to leverage publisher profile and reputation to detect malware and block malicious actors. This is accomplished by obtaining a description of a software application that is pending release from the publisher. The description defines the nominal functionality of the software application such as expected program behaviors and device driver accesses. The system then catalogues the actual functionality of the software application by analyzing the program code implementing the software application. Accordingly, the generative model can detect inconsistencies between the actual functionality and the nominal functionality. In response, the generative model can initiate an interaction with the publisher to resolve the inconsistency. The publisher can respond with a justification of the inconsistency which is evaluated by the generative model in accordance with a reputation score associated with the publisher. The generative model optionally approves or blocks the software application based on the reputation score.

This application belongs to the field of industrial control protocols and discloses a method, device, and medium for constructing an industrial control protocol semantic feature library based on program behavior analysis, including: S1: constructing typical industrial control field tags to form a unified set of field semantic tags; S2: acquiring execution context data; S3: performing symbolic execution analysis of protocol message processing to extract symbolic expressions related to protocol field processing; S4: dividing protocol field boundaries and classifying symbolic expressions by field as the original dataset; S5: extracting field program behavior features; S6: filtering field semantic features to select the most distinguishable field semantics from the original features; S7: constructing a semantic feature library by statistically analyzing the filtered features of each field in the original dataset, selecting filtered features that appear more frequently than a preset frequency and combining them to form composite features that can describe field semantics, and forming a complete industrial control protocol semantic feature library by constructing composite features for all fields.

The described technology facilitates execution control during the replay of the program behavior being tracked. Cross-level mapping associates the source code, intermediate representation, and native instructions in the trace. The trace includes a record of the native code instructions executed by the program managed by the runtime. The trace does not include any execution instance at the runtime. Breakpoints are set to align the trace location with the source code expression or statement, and skip garbage collection and other code that is unlikely to be of interest to the developer. The real-time debugging environment is adapted to support reverse execution based on the trace. The execution controller in the debugger or other tools can control the replay execution of the trace using breakpoint ranges, cross-level mapping, backward stepping exit support, and other items. Aspects of familiar compilers or familiar runtimes can be reused for innovative execution control that replays previously generated native code, which is contrary to their established purpose of generating native code.

The invention relates to an SOC verification optimization method and device based on instruction stream analysis, computer equipment and a medium. The method comprises the following steps: uniformly sampling subprograms of a program, and extracting Basic Block sequence information in the subprograms; the instruction information of each Basic Block is extracted; collecting the instruction information and the Basic Block sequence information to obtain an instruction sequence, and constructing an instruction semantic sequence model based on an autoregression language model based on the instruction sequence; based on the instruction semantic sequence model, a Basic Block program behavior representation model is constructed in a comparative learning mode; reading a plurality of slice subprograms to be operated, and obtaining semantic representations of the slice subprograms through a Basic Block program behavior representation model; and constructing a subprogram similarity matrix based on the semantic representation of the slice subprogram, and performing program selection based on the subprogram similarity matrix.

Apparatuses and methods for mitigating speculative based attacks on a processor are disclosed. In one example of the disclosed technology, an apparatus includes a processor, the apparatus having a memory positioned to store profiler data to measure at least one performance criterion for an instruction stream executed by the processor, and having control logic configured to select one of a plurality of mitigation schemes to mitigate a speculative based attack on the apparatus based on the measured performance criterion. The apparatus can include a remediation unit that can prevent a speculative side effect by implementing a delay scheme, a redo scheme, or a rollback scheme, which prevents side effect data generated by a mis-speculative instruction from becoming visible to an attacker.

The present invention discloses a method for constructing a malicious program behavior rule set, which includes steps of describing malicious program behaviors using an ontology; extracting malicious program behavior features; constructing a fine-grained malicious program behavior rule set; constructing a coarse-grained program behavior rule set; and constructing a behavior rule set for detectable program categories. The construction method of the present invention proposes a formalized extended description method based on the API call frequency of malicious programs, and realizes a complete description of program behaviors based on the ontology. The behavior rule set for detectable program categories jointly constructed by the fine-grained malicious program behavior rule set and the coarse-grained program behavior rule set is complete. By inputting the inference rules into an inference engine and binding the inference engine to the ontology, the behavior rule set can be used to perform inference detection on unknown samples, mark the categories of unknown programs, and comprehensively cover the inference detection of unknown samples.

The present invention belongs to the field of security detection technology, and discloses an application security detection method, device, equipment and storage medium. The method determines the application to be detected and the corresponding application identifier to be detected according to the application security detection instruction when receiving the application security detection instruction from the user; obtains the corresponding program behavior specification data from the preset behavior data set according to the application identifier to be detected; calls the application to be detected and obtains the current running data of the application to be detected; and performs application security detection on the application to be detected according to the program behavior specification data and the current running data. In the present invention, the program behavior specification data and the current running data of the application are combined to detect whether there are security problems in the terminal application. The program behavior specification data comes from the program developer, provides the most comprehensive program behavior detection, significantly improves the accuracy of the application security detection results, and solves the technical problem of inaccurate application security detection results in the existing application.

The invention belongs to the field of industrial control protocols, and discloses an industrial control protocol semantic feature library construction method and device based on program behavior analysis, and a medium, and the method comprises the steps: S1, constructing typical industrial control field tags, and forming a unified field semantic tag set; s2, executing context data acquisition; s3, performing symbolic execution analysis in a protocol message processing process, and extracting a symbolic expression related to protocol field processing; s4, dividing protocol field boundaries, classifying symbol expressions according to fields, and taking the symbol expressions as an original data set; s5, field program behavior feature extraction; s6, field semantic feature screening: screening out screening features which can distinguish field semantics most from the original features; and S7, constructing a semantic feature library, counting the screening features of each field in the original data set, selecting the screening features appearing at a frequency greater than a preset frequency, combining the screening features to form composite features capable of describing field semantics, and constructing the composite features for all fields to form a complete industrial control protocol semantic feature library.

A system and method are provided for detecting surprising / anomalous behavior in an upgrade to a program. A first prediction model is obtained to predict the behavior of a current version of the program. A second prediction model is trained using event sets representing a partially or totally ordered set of events realized from executing the upgrade version of the program. First (second) predictions are generated by applying a given event set to the first (second) prediction model. The first predictions are then compared with the second predictions to determine whether the respective prediction agree. When they do not agree, the deviation in the program behavior is signaled (e.g., to an engineer). The first and second predictions can be conditional probabilities of the given event set, and they can be compared using a comparison metric that includes a difference between negative logarithms of the respective predictions.

The embodiment of the invention discloses a plug-in program behavior identification method and device based on log analysis. The method comprises the steps that an operation log of an application system is obtained, the operation log comprises a plurality of operation behavior records, and each operation behavior record comprises an operation account, operation time and an operation service type; determining operation behavior feature information corresponding to each operation behavior record based on the operation account, the operation time and the operation service type; clustering all the operation behavior records based on the operation behavior feature information to obtain a plurality of class clusters; determining an abnormal probability corresponding to each operation behavior record in each class cluster based on the operation behavior feature information corresponding to each operation behavior record in each class cluster; and determining an abnormal operation behavior record based on the abnormal probability, and determining an operation behavior corresponding to the abnormal operation behavior record as a plug-in program behavior. Through the technical scheme of the embodiment of the invention, the accuracy and robustness of behavior identification of the plug-in program are improved.

A computer system is configured to override an original behavior of a function at runtime. Overriding the original behavior of the function at runtime includes identifying an override behavior for overriding the original behavior of the function, and encoding replacement code based on the override behavior. Further, a size of the replacement code is identified, and a first memory address of the function where code of the function is stored is also identified. The computer system then copies a block of code having the size of the replacement code from the first memory address to a second memory address, and copies the replacement code to the first memory address. After the replacement code is executed, copying the block of code stored at the second memory address back to the first memory address, restoring the code of the function.

The invention discloses a formalized protocol generation and verification method for an ESBMC, which reduces manual intervention by combining a large language model and an ESBMC tool, can significantly improve the verification efficiency and accuracy of a complex program, and can fully reflect the real behavior of the program by an automatically generated protocol when processing the program containing a complex control structure. The method comprises the following steps: analyzing extracted program information by using a large language model, automatically generating a precondition, a postcondition and a loop invariant formalized protocol, and inputting the precondition, the postcondition and the loop invariant formalized protocol into an ESBMC tool for verification to obtain a verification result. The verification result of the ESBMC is fed back to the protocol generation module, the generated protocol is refined and repaired, the generation strategy is dynamically adjusted, optimization is carried out according to different program behaviors, and it is ensured that the generated formalized protocol is accurate and effective. The capability of continuously optimizing the large language model through supervision fine tuning and enhanced training enables the model to automatically adapt to the characteristics of different programs, and a more accurate protocol is generated.

This invention relates to the field of educational technology, specifically to a learning analysis system and method for online programming learning, comprising a programming behavior collection module, a code semantic quantification module, a cognitive load assessment module, a learning stage discrimination module, and a cognitive adaptation resource library; wherein: the programming behavior collection module is used to collect operational behavior data; the code semantic quantification module is used to parse the abstract syntax tree of user-submitted code; the cognitive load assessment module is used to output a three-dimensional load index; the learning stage discrimination module is used to determine the user's current stage; and the cognitive adaptation resource library matches resources based on the discrimination results of the learning stage discrimination module. This invention, by collecting learners' programming behavior data in real time and combining it with cognitive load assessment, accurately determines the learner's learning stage, thereby providing personalized teaching resources, thus improving programming learning efficiency and reducing cognitive load.

The invention discloses a search fault identification method, device and equipment and a readable storage medium. The method comprises the following steps: obtaining all byte code files of an application main body; determining program behavior characteristics related to each byte code file; analyzing whether corresponding definition information exists in each program behavior feature or not; if the corresponding definition information does not exist in any program behavior characteristic, it is determined that the application main body has NoSuchMedia FoundError, and if the corresponding definition information does not exist in any program behavior characteristic, the application main body has NoSuchMedia FoundError; if all the program behavior characteristics have the corresponding definition information, determining that the application main body does not have a search fault; it can be seen that whether each program behavior feature can be searched or not can be determined by recognizing whether each program behavior feature has the matched definition information or not, whether NoSuchMethod FoundError exists or not in the program of the application main body or not is determined, and the running stability of the application main body is guaranteed.