Automatically identifying and highlighting differences between historic traces

Patent metadata

Field	Value
Publication number	US-11132280-B2
Application number	US-201916271182-A
Country	US
Kind code	B2
Filing date	Feb 8, 2019
Priority date	Feb 8, 2019
Publication date	Sep 28, 2021
Grant date	Sep 28, 2021

Abstract

This disclosure relates to identifying and presenting differences between a plurality of recorded executions of an executable entity. One or more models are created over the plurality of recorded prior executions of at least a portion of an executable entity. These models include at least one of (i) a control flow model, or (ii) a data model. An anomalous model data point is identified within these models, and a first location in at least one of the plurality of recorded executions that corresponds to the anomalous model data point is identified. A second location in the at least one of the plurality of recorded executions is also identified. This second location is causal to the anomalous model data point at the first location. The identity of the first and/or second locations in the least one of the plurality of recorded executions is presented.

First claim

What is claimed:

1. A method, implemented at a computer system that includes one or more processors and a memory, for using a dynamic replay-based analysis to identify an anomaly in execution of an executable entity, the method comprising:
receiving trace data comprising a plurality of recorded prior executions of at least a portion of the executable entity;
replaying at least a portion of each of the plurality of recorded prior executions;
based on the replaying of at least the portion of each of the plurality of recorded prior executions,
reconstructing, for each prior execution of the executable entity, at least (i) a portion of prior code instruction execution, and (ii) one or more prior runtime data entity values; and
creating a plurality of models over the plurality of recorded prior executions, including:
(i) based on reconstructing at least the portion of prior code instruction execution for each prior execution of the executable entity, creating a control flow model that models a plurality of patterns of at least the portion of the prior code instruction execution across the plurality of recorded prior executions, and
(ii) based on reconstructing the one or more prior runtime data entity values for each prior execution of the executable entity, creating a data model that models, for at least one data entity, a plurality of prior runtime data values of the at least one data entity across the plurality of recorded prior executions;

identifying an anomalous model data point using the plurality of models, based on identifying both of (i) an anomalous pattern of at least the portion of the prior code instruction execution within the control flow model, and (ii) an anomalous value of the at least one data entity within the data model;
identifying a first location in at least one of the plurality of recorded prior executions over which the plurality of models were created, and that corresponds to the anomalous model data point;
identifying a second location in the at least one of the plurality of recorded prior executions that is causal to the anomalous model data point at the first location; and
presenting at least an identity of the second location in the at least one of the plurality of recorded prior executions.

2. The method of claim 1 , further comprising also presenting an identity of the first location in the at least one of the plurality of recorded prior executions.

3. The method of claim 1 , wherein identifying the second location in the at least one of the plurality of recorded prior executions comprises performing at least one of (i) a data flow analysis, or (ii) a control flow analysis.

4. The method of claim 1 , wherein identifying the second location in the at least one of the plurality of recorded prior executions comprises using at least one of the plurality of models to identify where the at least one of the plurality of recorded prior executions diverged from one or more others of the plurality of recorded prior executions.

5. The method of claim 1 , wherein identifying the second location in the at least one of the plurality of recorded prior executions comprises iteratively working backwards from the first location to identify data or code behaviors that correlate with occurrence of the anomalous model data point.

6. The method of claim 1 , wherein the presenting comprises presenting at one or more of (i) a software component, or (ii) a user interface.

7. The method of claim 1 , wherein identifying the anomalous value of the at least one data entity within the data model comprises at least one of: (i) anomaly detection on values of the at least one data entity in the data model, or (ii) anomaly detection over data flow in the data model.

8. The method of claim 1 , wherein identifying the anomalous model data point comprises:
applying a curve fitting analysis to a plurality of data points in each of the plurality of models; and
determining that the anomalous model data point deviates from a curve by at least a threshold.

9. The method of claim 1 , further comprising classifying the at least one of the plurality of recorded prior executions as being anomalous, and classifying one or more others of the plurality of recorded prior executions as being normal.

10. The method of claim 9 , wherein the presenting comprises highlighting a difference between the at least one of the plurality of recorded prior executions, and at least one of the one or more others of the plurality of recorded prior executions at the second location.

11. A computer system, comprising:
at least one processor; and
at least one computer-readable media having stored thereon computer-executable instructions that are executable by the at least one processor to cause the computer system to use a dynamic replay-based analysis to identify an anomaly in execution of an executable entity, the computer-executable instructions including instructions that are executable to cause the computer system to perform at least the following:
receive trace data comprising a plurality of recorded prior executions of at least a portion of the executable entity;
replay at least a portion of each of the plurality of recorded prior executions;
based on the replaying of at least the portion of each of the plurality of recorded prior executions,
reconstruct, for each prior execution of the executable entity, at least (i) a portion of prior code instruction execution, and (ii) one or more prior runtime data entity values; and
create a plurality of models over the plurality of recorded prior executions, including:
(i) based on reconstructing at least the portion of prior code instruction execution for each prior execution of the executable entity, creating a control flow model that models a plurality of patterns of at least the portion of the prior code instruction execution across the plurality of recorded prior executions, and
(ii) based on reconstructing the one or more prior runtime data entity values for each prior execution of the executable entity, creating a data model that models, for at least one data entity, a plurality of prior runtime data values of the data entity across the plurality of recorded prior executions;

identify an anomalous model data point using the plurality of models, based on identifying both of (i) an anomalous pattern of at least the portion of the prior code instruction execution within the control flow model, and (ii) an anomalous value of the at least one data entity within the data model;
identify a first location in at least one of the plurality of recorded prior executions over which the plurality of models were created, and that corresponds to the anomalous model data point;
identify a second location in the at least one of the plurality of recorded prior executions that is causal to the anomalous model data point at the first location; and
present at least an identity of the second location in the at least one of the plurality of recorded prior executions.

12. The computer system of claim 11 , the computer-executable instructions also including instructions that are executable to cause the computer system to present an identity of the first location in the at least one of the plurality of recorded prior executions.

13. The computer system of claim 11 , wherein identifying the second location in the at least one of the plurality of recorded prior executions comprises performing at least one of (i) a data flow analysis, or (ii) a control flow analysis.

14. The computer system of claim 11 , wherein identifying the second location in the at least one of the plurality of recorded prior executions comprises using

Assignees

• Microsoft Technology Licensing Llc

Inventors

• Davis Jackson Michael
• Myers Del
• Nelson Patrick Lothian
• Sterland Andrew R
• Richardson Leslie Yvette
• Mola Jordi
• Pinkerton James M
• Marron Mark

Classifications

• G06F11/3692

  for test results analysis · CPC title

• G06F11/3636 Primary

  by tracing the execution of the program · CPC title

• G06F11/3612

  by runtime analysis (performance monitoring G06F11/3466) · CPC title