21 results about "Stack trace" patented technology

Systems and methods for generating an enhanced error message are provided. An example method includes: receiving one or more raw error messages. The one or more raw error messages include one or more stack traces. The method further includes matching at least one raw error message of the one or more raw error messages to one or more error rules from a plurality of error rules. The one or more error rules include regular expression patterns. The method further includes parsing the at least one raw error message, based on the one or more matched error rules from the plurality of error rules; and generating one or more enhanced error messages, based on the at least one parsed raw error messages. The one or more enhanced error messages include one or more natural language sentences. The method further includes embedding the one or more enhanced error messages into a website.

A cyber threat information processing method including generating stack trace information of a reader program of an operating system executing a non-executable file at a hooking point of a system call of the operating system when the reader program performs the system call, obtaining a calling function for calling the system call and a variable corresponding to the calling function from the generated stack trace information, and providing description information about the obtained calling function and the variable corresponding to the calling function.

The invention discloses a data acquisition method and device, electronic equipment and a storage medium. The data acquisition method comprises the following steps: injecting a data acquisition code into a runtime environment of a target application program; determining data acquisition demand information in a runtime environment of the target application program; calling the data acquisition code according to the data acquisition demand information; when the data collection code is called, stack tracking data are obtained from original calling stack data of the target application program according to the data collection requirement information, and the stack tracking data are output. By adopting the method, the performance loss of call stack acquisition can be reduced.

A verified stack trace can be generated by utilizing information contained in a shadow stack, such as a hardware protected duplicate stack implemented for malware prevention and computer security. The shadow stack contains return addresses which are obtainable without requiring an unwinding of the traditional call stack. As such, triaging based on return address information can be performed more quickly and more efficiently, and with a reduced utilization of processing resources. Additionally, the generation of a verified stack trace can be performed, with such a verified stack trace containing return addresses that are known to be correct and not corrupted. The return addresses can either be read from the traditional call stack, or derived therefrom, and then verified by comparison to corresponding return addresses from the shadow stack, or they can be read directly from the shadow stack.

A program is executed using a call stack and a shadow stack. The call stack includes frames with respective return addresses. The frames can also store variables and / or parameters. The shadow stack stores copies of the return addresses in the call stack. The call stack and the shadow stack are maintained by (i) adding a respective stack frame to the call stack and a respective return address to the shadow stack each time a function is called, and (ii) removing a respective frame from the call stack and a respective return address from the shadow stack each time a function is exited. A backtrace of the current call chain of the program is generated by accessing the return addresses in the shadow stack. The output backtrace includes return addresses from the shadow stack and / or information about traced functions derived from the return addresses of the shadow stack.

The present invention provides a pre-stack AVO inversion optimization algorithm based on DTW matching technology. Seismic traces with minimal error are selected as reference traces, a Euclidean distance matrix is ​​established, and the cumulative Euclidean distance matrix is ​​calculated to characterize the global similarity between the sequence reference trace and the trace to be corrected. The cumulative error matrix is ​​calculated to determine the optimal path for correcting the trace. This path stores the amount of stretching and compression at each point, representing the optimal time-domain stretching and compression scheme for the trace to be corrected. By traversing all traces to be corrected, an optimized pre-stack trace gather is obtained. Using this optimized trace gather for pre-stack AVO inversion improves inversion accuracy. The present invention only performs local stretching and compression on the time axis, ensuring the accuracy of subsequent AVO analysis and inversion. Furthermore, the stretching and compression amount of each trace to be corrected can be automatically calculated as the correction amount. In situations where the effective reflection signal is weak and background noise interference is strong, a control layer can be added to make the matching results more reliable.

A method and system for threat detection and analysis is disclosed herein. The method includes monitoring at least one thread associated with at least one process on a computing system. The method further includes detecting specific system calls associated with at least one process at kernel level. The specific system calls are analyzed by applying a filter to the system calls sequence feature set associated with the specific system calls for detecting one or more events of interest. A full stack trace capture of at least one process is requested if the system calls sequence feature set is filtered and the one or more events of interest are detected. A first level monitoring is provided to the computing system, which includes processing and analyzing the captured full stack trace by a machine learning (ML) stack trace analyzer to generate a first verdict for threat detection and analysis.

Various examples are directed to systems and methods for debugging a software application. A computing system may access first stack trace data describing a plurality of function calls made by a software application during a failed execution of a first test case. The computing system may compare the first stack trace data and flaky test case data. The flaky test case data may describe at least one function call made by the software application during execution of at least one flaky test case. The at least one flaky test case may comprise a first flaky test case that the software application passed during one execution of the first flaky test case and failed during another execution of the first flaky test case. Based at least in part on the comparing, the computing system may determine that the first test case is a flaky test case.

Techniques implemented by container services to provide users with utilization metrics indicating which processes running inside containers of distributed container systems are driving computing resource consumption. The container service may deploy agents in VMs alongside the containers that are supporting applications, and the agents may include profilers that inject eBPF programs into the kernels of each VM in which containers are running. The eBPF programs collect stack traces from the kernels that represent which processes were being executed when the stack traces were sampled. The profilers may use the stack traces to determine resource utilization for each process, and group the stack trace results based on the container in which the processes are executing. The utilization metrics may be converted into easily digestible visualizations and provided to a user to determine which processes are driving utilization in the containers, which in turn helps the users improve their application code.

Systems and methods for detecting a malware injection interested processes. The method includes identifying one or more trusted processes, monitoring at least one thread associated with the trusted processes using at least one control point, detecting activity at the at least one thread based on the at least one control point and determining a timestamp of the detected activity, receiving from the trusted processes at least one execution stack corresponding to the timestamp and indicating the at least one control point used to monitor the at least one thread, applying a first malware detector to the at least one execution stack to generate a first verdict, collecting the first verdict and auxiliary information corresponding to the trusted processes at the given timestamp, and applying a second malware detector to the first verdict and the auxiliary information to generate a second verdict.

This application discloses a program call stack creation method and apparatus, and an unwind stack method and apparatus. The call stack creation method includes: obtaining a first program, where the first program includes a first function, in a process of calling a runtime library to run the first program, adding a second function and creating a call stack, where the call stack includes a first stack frame, a second stack frame, and a third stack frame that are respectively corresponding to the first function, the second function, and a third function. An unwind stack performance can be improved to a maximum extent without affecting a non-stack trace scenario.

A computer-implemented method is disclosed. The method includes: obtaining a stack trace associated with an error detected in connection with execution of a computer program by a processor; determining a location of the error within source code of the computer program based on the stack trace, wherein the source code contains a template code section and a custom code section; generating an error message for the error, wherein the generating includes: in response to determining that the error is located in the custom code section, appending a first representation of the stack trace to the error message; and in response to determining that the error is located in the template code section, formatting the error message to indicate a generic template code error, and presenting the error message via a computing device.

Methods, systems, and media for encoding stack trace information are disclosed. Embodiments provide a thread categorization method that uses a categorization signature to represent a stack trace in a compact form. Some embodiments can receive a stack trace comprising a sequence of stack frames. Some embodiments can generate, based on the sequence of stack frames, a trace signature representing a set. Some embodiments can receive one or more subsequent stack traces. For each of the one or more subsequent stack traces, some embodiments can determine whether a subsequent trace signature representing a sequence of stack frames included within the subsequent stack trace has been generated. If not, some embodiments can generate, based on the trace signature and other subsequent trace signatures generated based on the trace signature, a subsequent trace signature representing the subsequent sequence of stack frames.

A program is executed using a call stack and a shadow stack. The call stacks include frames having respective return addresses. These frames may also store variables and / or parameters. The shadow stack stores a copy of the return address in the call stack. The call stack and the shadow stack are maintained by (i) adding a corresponding stack frame to the call stack and adding a corresponding return address to the shadow stack whenever a function is called, and (ii) removing the corresponding frame from the call stack and the corresponding return address from the shadow stack whenever the function is exited. And backtracking of the current call chain of the program is generated by accessing the return address in the shadow stack. The backtracking of the output includes a return address from the shadow stack and / or information about a tracked function derived from the return address of the shadow stack.

1. The name of the design product: electronic device stack trace profiling analysis function visualization graphical user interface. 2. The use of the design product: an electronic device. 3. The design points of the design product: in the graphical user interface. 4. The picture or photo that best indicates the design points: front view. 5. The use of the graphical user interface: for collected profile data to support correlation trace / span, support jumping from a trace / span to related profiling. 6. The human-computer interaction mode of the graphical user interface: the front view is the initial interface; after clicking the "stacktraces" icon below the front view, interface change state diagram 1 is entered; after clicking interface change state diagram 1, entering "un" in the search bar below the flame diagram, interface change state diagram 2 is entered; after clicking interface change state diagram 2, sliding the mouse, interface change state diagram 3 is entered. 7. Other circumstances that need to be explained: the display screen panel is used for an electronic device.

This invention discloses an intelligent software compatibility problem detection method based on a pre-trained language model. It collects unlabeled and labeled Python stack trace data to construct a pre-training dataset and a fine-tuning dataset; parses the traceback data and standardizes its format; processes traceback data exceeding the model's maximum length limit; uses the unlabeled traceback data to perform unsupervised retraining on the BERT model to learn traceback semantic features; constructs an intelligent software compatibility problem detection model; divides the fine-tuning dataset, selects positive examples from the training set to construct a class-balanced fine-tuning training set, and uses a small amount of labeled data to fine-tune the classification model. This invention solves the problem that existing methods cannot automatically detect compatibility problems occurring during the operation of intelligent software, overcomes the limitations of existing models in understanding the semantic features of Python traceback context, and can fully capture the dependencies between stack frames and exception information, effectively improving the accuracy of intelligent software compatibility problem detection.

A computer-implemented method is disclosed. The method includes: obtaining a stack trace associated with an error detected in connection with execution of a computer program by a processor; determining a location of the error within source code of the computer program based on the stack trace, wherein the source code contains a template code section and a custom code section; generating an error message for the error, wherein the generating includes: in response to determining that the error is located in the custom code section, appending a first representation of the stack trace to the error message; and in response to determining that the error is located in the template code section, formatting the error message to indicate a generic template code error, and presenting the error message via a computing device.

Execution of a software program that is programmed in an interpreter-based language is monitored. Programs for recording entry and exit points of functions and invocations of system calls are attached to the software program. At least one program is implemented using eBPF. A monitoring agent receives indications of entries and exits to the functions. Based on the indications of entries and exits, the monitoring agent monitors a stack trace of the software program. Based on the indications of system call invocations and based on the stack trace of the software program, the monitoring agent identifies system call invocations by a software library. The monitoring agent performs a responsive action in response to a determination that a system call invocation deviates from a pre-defined policy of authorized functionalities.

A method, storage system and computer program product for securing a computing device (20) comprising a processor (24) and a memory (26) and coupled to a storage device (28) storing a set of one or more files (40, 41). A call to a specified function executed by a processor is detected, and a stack trace is generated in memory for the call to the specified function. Once a stack frame (52) is detected in the stack track that includes a return address that references a shell code region in the memory that includes executable code that is not loaded from any given file on the storage device, the referenced executable code is compared to the malicious shell code list. Finally, a preventive action is initiated upon detection of a match between the referenced executable code and one of the malicious shell codes in the list.

A computing system for identifying and scoring problems associated with call stacks. The computing system identifies call stacks associated with an application and determines a problem occurs in the application. The computer system compares a call stack of a first set of applications with a call stack of a second set of applications, wherein the call stack of the first set of applications includes the problem and the call stack of the second set of applications does not include the problem. The computer system generates a score indicating a likelihood that a particular call stack caused the problem based on whether the particular call stack is included in the call stack of the first set of applications, the call stack of the second set of applications, or both. The computing system generates a notification comprising the score indicating the likelihood that the particular call stack caused the problem.

A method, storage system, and computer program product for protecting a computing device, including a processor and memory, and connected to a storage device that stores a set of one or more files. A call to a function designated for execution by the processor is detected, and a stack trace for the call to the designated function is generated in memory. When the stack trace detects a stack frame containing a return address that references a shellcode region in memory, where the shellcode region contains executable code that was not loaded from any given file on the storage device, the referenced executable code is then compared against a list of malicious shellcodes. Finally, when a match is found between the referenced executable code and one of the malicious shellcodes in the list, preventive action is initiated.