16 results about "Program behavior" patented technology

Arrangements for optimizing software performance through generative artificial intelligence are provided. Execution data associated with a user interacting with an application programming interface through a user interface on a computing device may be received. Trace data based on the execution data may be generated. The trace data may indicate that a performance of an application is degraded. One or more performance prompts specifying program behavior may be generated. Application source code and the performance prompts may be sent to an artificial intelligence engine for performing key performance indicator driven code analysis. The one or more performance prompts may have been executed in the artificial intelligence engine for pretraining a large language model. Optimized source code may be received from the artificial intelligence engine. Performance testing may be executed on the optimized source code. An action may be performed to address the performance of the application.

The embodiment of the invention provides a program error tracing method, electronic equipment, a storage medium and a program product. The method comprises the following steps: acquiring behavior data when a program runs; comparing the behavior data with a reference behavior model, and identifying abnormal behavior nodes; based on the abnormal behavior nodes, constructing a correlation graph of program behaviors; and based on the association map, positioning the root cause of the program error through bidirectional tracing. According to the method, the transformation from experience-dependent and isolated phenomenon analysis to systematic and automatic root cause mining is realized, and the problem of cross-module and hidden complex error tracing is solved.

This invention provides a privacy protection method and system for preventing misbehavior in mini-programs based on deep learning. It utilizes the collaborative efforts of deep learning and program analysis techniques to detect inconsistencies between the expected and actual behavior of mini-programs. This invention provides a novel mini-program analysis technique that associates UI information of widgets with corresponding program behaviors and determines the actual behavior of widgets based on program analysis, thereby enabling the construction of large-scale, high-quality training datasets. Based on the results of program analysis, deep learning techniques are used to learn an icon-behavior model from unstructured datasets to infer the expected behavior of widgets. This invention uses a defined three-layer standard model to detect differences between actual and expected behavior by calculating outlier scores. If any inconsistency is found, it indicates the presence of a misbehaving mini-program. The risk level of the inappropriate behavior can then be estimated, and countermeasures can be proactively implemented.

This application discloses a method and apparatus for cross-resource pool API behavior detection. The method includes: acquiring historical code corresponding to API behavior in the source and destination resource pools and related network performance loss data; constructing sine / cosine functions based on this data and determining the positional encoding of the historical code; acquiring the code corresponding to the API behavior in the source and destination pools and determining the corresponding word segmentation encoding; determining the positional vector corresponding to the source and destination code based on the word segmentation encoding and the stored positional encoding; detecting whether the positional vector matches the stored sine / cosine functions; and determining whether the API behavior in the source and destination pools is abnormal based on the detection result. This application improves the uniqueness of consistency analysis results by expanding the code dimension features through multiple sine / cosine functions, solving the problem of low accuracy in consistency analysis of program behavior using distance similarity in related technologies, and avoiding the problem that consistency analysis results in related technologies are easily manipulated and corrupted by malicious nodes.

The application discloses an evasive malicious software detection method and system based on dynamic plug-in. The method is as follows: deploying anti-anti-plug-in strategy, constructing trapping environment; inserting monitoring code in multiple levels of the trapping environment, establishing multi-level and fine-grained program behavior monitoring; for each target program in the trapping environment, after the probe instruction or function in the monitoring code is executed, the memory buffer area or register used for storing the probe result is dynamically identified and marked; the probe result is continuously monitored, when the probe result is tracked to be used for comparison instruction and affects the jump of subsequent conditional branch instruction, it is determined that the target program has a "probe-decision" logic chain; when the target program has one or more "probe-decision" logic chains, it is determined that the target program is evasive malicious software. The application can realize accurate, robust and automatic identification of evasive behavior.

The invention relates to the technical field of software engineering and software quality assurance, and provides a method and a system for evaluating influence of quantitative code change on a program implementation effect. The method comprises the following steps: acquiring code difference information between a to-be-tested code branch and a baseline branch, analyzing and extracting structured information of a changed code through a large language model, and calculating a basic influence value of the structured information of the changed code; calling a program behavior feature library based on the structured information of the change code, and calculating a dynamic adjustment coefficient; calculating the final influence score of each dimension according to the product of the basic influence value of the structured information of the change code and the dynamic adjustment coefficient; the final influence score of each dimension comprises a core function influence score, a performance efficiency influence score, a data consistency influence score, an interface compatibility influence score and a security influence score; and generating an influence analysis report according to the final influence score of each dimension. According to the method, the basic influence value determined by the change type is multiplied by the dynamic adjustment coefficient determined by the module criticality and the historical risk, so that the code change influence is accurately and dynamically quantified.

Different versions of a program are executed in a first mode of operation in accordance with normal operations with only expected behavior to generate different acceptable behavior models indicative of behavior of the program. A difference between acceptable behavior models indicates different risk profiles for the different versions of the program. Risk profiles can be generated by a model explainer. An event that attempts to execute remote code or a delayed event can be detected in a second mode of operation if the event or the delayed event is not included in the acceptable behavior model. Different sequences of events in the first or second mode can be instrumented at different levels of instrumentation to generate or use the acceptable behavior model. The sequences of events can be generated from a stacktrace in the first and second modes. The instrumentation can be performed in hardware by intercepting SYSCALLs.

The techniques disclosed herein enable systems to leverage publisher profile and reputation to detect malware and block malicious actors. This is accomplished by obtaining a description of a software application that is pending release from the publisher. The description defines the nominal functionality of the software application such as expected program behaviors and device driver accesses. The system then catalogues the actual functionality of the software application by analyzing the program code implementing the software application. Accordingly, the generative model can detect inconsistencies between the actual functionality and the nominal functionality. In response, the generative model can initiate an interaction with the publisher to resolve the inconsistency. The publisher can respond with a justification of the inconsistency which is evaluated by the generative model in accordance with a reputation score associated with the publisher. The generative model optionally approves or blocks the software application based on the reputation score.

This application belongs to the field of industrial control protocols and discloses a method, device, and medium for constructing an industrial control protocol semantic feature library based on program behavior analysis, including: S1: constructing typical industrial control field tags to form a unified set of field semantic tags; S2: acquiring execution context data; S3: performing symbolic execution analysis of protocol message processing to extract symbolic expressions related to protocol field processing; S4: dividing protocol field boundaries and classifying symbolic expressions by field as the original dataset; S5: extracting field program behavior features; S6: filtering field semantic features to select the most distinguishable field semantics from the original features; S7: constructing a semantic feature library by statistically analyzing the filtered features of each field in the original dataset, selecting filtered features that appear more frequently than a preset frequency and combining them to form composite features that can describe field semantics, and forming a complete industrial control protocol semantic feature library by constructing composite features for all fields.

The invention belongs to the field of industrial control protocols, and discloses an industrial control protocol semantic feature library construction method and device based on program behavior analysis, and a medium, and the method comprises the steps: S1, constructing typical industrial control field tags, and forming a unified field semantic tag set; s2, executing context data acquisition; s3, performing symbolic execution analysis in a protocol message processing process, and extracting a symbolic expression related to protocol field processing; s4, dividing protocol field boundaries, classifying symbol expressions according to fields, and taking the symbol expressions as an original data set; s5, field program behavior feature extraction; s6, field semantic feature screening: screening out screening features which can distinguish field semantics most from the original features; and S7, constructing a semantic feature library, counting the screening features of each field in the original data set, selecting the screening features appearing at a frequency greater than a preset frequency, combining the screening features to form composite features capable of describing field semantics, and constructing the composite features for all fields to form a complete industrial control protocol semantic feature library.

The invention relates to an anti-quantum cryptography hybrid programming language program verification method and an anti-quantum cryptography hybrid programming language program verification system. The method comprises the following steps: inputting a password protocol program to be verified in Rocq based on a hybrid programming language; subprograms in the cryptographic protocol program are modeled in a formalized mode through a module system, and classic program behaviors and quantum program behaviors in the cryptographic protocol program are described based on a unified grammar framework of a hybrid programming language; performing type checking and grammar checking on a program written based on a unified grammar framework and a module system; generating semantics of the program according to grammar for the program passing the check; protocol properties needing to be proved are described in a formalized mode according to grammar; establishing an inference rule based on program rewriting on the basis of grammar; and carrying out interactive certification on the formally described protocol property in the Rocq by using a certification strategy of the Rocq. According to the method, the security of the complex password protocol can be completely and accurately described and automatically verified, and the verification reliability and efficiency are remarkably improved.

The application discloses a formal specification generation and verification method for ESBMC, which reduces manual intervention by combining a large language model with an ESBMC tool, can significantly improve the verification efficiency and accuracy of complex programs, and can fully reflect the real behavior of the program when processing programs containing complex control structures. The automatically generated specification can fully reflect the real behavior of the program when processing programs containing complex control structures. By using a large language model to analyze and extract program information, the preconditions, postconditions and loop invariant formal specification are automatically generated, which are input into the ESBMC tool for verification to obtain the verification result. The verification result of ESBMC is fed back to the specification generation module, the generated specification is refined and repaired, and the generation strategy is dynamically adjusted to optimize different program behaviors, so that the generated formal specification is accurate and effective. Through supervised fine-tuning and reinforcement training, the ability of the large language model is continuously optimized, so that the model can automatically adapt to the characteristics of different programs and generate more accurate specifications.

A method for the automated performance of software tests for a program to be tested in an embedded system. The method includes: ascertaining, using an emulation-based fuzzer, a program behavior of the program to be tested, wherein at least one emulation-based result is derived on this basis; ascertaining, using a hardware-based fuzzer, the program behavior of the program to be tested, wherein at least one hardware-based result is derived on this basis; providing, using a monitoring component, the derived results, wherein the emulation-based result is provided to the hardware-based fuzzer, and / or the hardware-based result is provided to the emulation-based fuzzer.

The invention discloses a code behavior analysis method for a steel rolling process control system. The code behavior analysis method comprises the following steps: determining an instruction set architecture used by a program in the steel rolling process control system; performing instruction identification and binary processing, dividing a program into basic blocks, and establishing a mapping relation from the basic blocks to functions; analyzing parameter information transmitted to the sub-function by the parent function, and analyzing parameter and variable information of the sub-function through a stack top and stack bottom pointer to obtain a data transmission path in a function calling process; taking the input function as a start point of taint analysis, taking the output function as an end point of taint analysis, performing bidirectional taint analysis on the program, and constructing a program execution chain; performing code semantic analysis on the program, analyzing the typical field of the message, and constructing a weak supervised learning mode combining unsupervised learning and supervised learning to obtain a field identification and classification result. According to the method, program behaviors can be comprehensively mastered, and solid technical support is provided for system debugging, function verification, safety evaluation and potential vulnerability detection.

The invention discloses an online binary continuous optimization system supporting a multi-instruction-set architecture. The online binary continuous optimization system comprises a program behavior information acquisition module, an offline binary optimization module, an online code replacement module, an old version code recovery module and a program stage change detection and decision module, the program behavior information acquisition module realizes information acquisition during general operation through a self-adaptive dual-mode design; the offline binary optimization module converts the collected dynamic information into an intermediate representation, and performs optimization on the intermediate representation; the online code replacement module controls the process to start and stop and replaces the optimized fragment; the old version code recovery module detects and recovers old version codes through a runtime memory management mechanism; the program stage change detection and decision-making module monitors program performance index changes, identifies stage behavior switching and realizes continuous adaptive optimization of a closed loop. The invention also discloses an optimization method realized by using the system, and the method has a wide application prospect.