Software Behavior Pattern Identification via Deterministic Testing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for identifying anomalies in computer software behavior are probabilistic and time-consuming, making it difficult to detect unnormal behavior before a security breach occurs, as they rely on mathematical probabilities and require time to define normal and unnormal behavior post-release.
Innovation Solution
A method using software tests to generate deterministic patterns of behavior, allowing for the identification of anomalous behaviors during runtime by comparing pre-defined patterns created during testing with observed behavior post-release, utilizing automated tests and event records to detect normal and unnormal behavior patterns.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If probabilistic behavior analysis is used to identify anomalies, then the system can detect unnormal behavior after software release, but the detection is not accurate for each specific software and takes time to define normal and unnormal behavior
Solution Approach 1:
The patent applies preliminary action by performing software tests before release to generate deterministic behavior patterns in advance. These patterns are created during the testing phase and stored for later comparison during runtime, eliminating the time needed to define behavior patterns after release while maintaining high detection accuracy.
2Reliability
If probabilistic behavior analysis is used, then the system can identify anomalies based on mathematical probabilities, but it cannot provide deterministic identification of cyber-attacks
Solution Approach 1:
The patent substitutes the probabilistic mathematical analysis system with a deterministic pattern matching system. Instead of using statistical probabilities to identify anomalies, the system uses exact pattern comparison between expected behavior (from tests) and actual behavior (from runtime), providing reliable and precise security detection.
3Measurement precision
If automated tests are performed before release to generate behavior patterns, then deterministic patterns can be created for accurate anomaly identification, but the testing process requires significant time and resources
Solution Approach 1:
The patent performs behavior pattern generation as a preliminary action during the testing phase before software release. By creating deterministic patterns in advance and storing them for runtime comparison, the system achieves high detection accuracy without slowing down the release process, as the pattern matching during runtime is efficient and automated.
4Reliability
If post-release behavior monitoring is implemented, then the system can identify anomalies after software is installed, but attackers can already attack the device before normal and unnormal behavior are properly defined
Solution Approach 1:
The patent implements preliminary action by generating behavior patterns during pre-release testing, so that security protection is already in place before the software is deployed. The deterministic patterns created in advance enable immediate anomaly detection upon software execution, eliminating the vulnerability window that exists with post-release behavior definition.
Data Source
AI summary
A method including performing tests for a computer software that emulate user or application behavior when using the computer software, detecting a first set of resource properties when performing the tests on the computer software, identifying behavior patterns based on a series the event records created from the resource properties detected when running the tests, detecting a second set of properties of resources running the computer software following release of the computer software, comparing the behavior patterns extracted from the tests with a second behavior pattern extracted from real-life operation after release of the computer software, detecting normal software behavior and unnormal software behavior based on the differences between the behavior patterns extracted from the tests and second behavior pattern.