Automatic software behavior identification using execution record

Patent metadata

Field	Value
Publication number	US-11755458-B2
Application number	US-202117154853-A
Country	US
Kind code	B2
Filing date	Jan 21, 2021
Priority date	Feb 25, 2019
Publication date	Sep 12, 2023
Grant date	Sep 12, 2023

Abstract

Automatic identification of execution behavior(s) of software. This automatic identification is based on analysis of historical execution records using machine learning to identify a particular pattern that corresponds to an execution behavior. In order to automatically identify an execution behavior present within particular software, an execution record of that particular software is accessed. The execution record includes an execution trace that reproducibly represents the execution of the software within a particular execution environment, such that the execution record is usable to rerun the execution of the software precisely as the software previously run. Based on finding the particular pattern within the execution record, the computing system automatically identifies that the execution behavior is present within the software.

First claim

What is claimed is:

1. A computing system comprising:
one or more processors; and
one or more computer-readable hardware storage media having thereon computer-executable instructions that are structured such that, when executed by the one or more processors, the computer-executable instructions configure the computing system to at least:
access an execution record of a prior execution of software, wherein the execution record includes an execution trace that reproducibly represents the prior execution of the software within a particular execution environment in a manner that enables a data input to each instruction that was executed within the particular execution environment during the prior execution of the software to be known;
use the execution trace of the execution record to rerun the prior execution of the software precisely as the software was previously run within the particular execution environment by using the execution trace to supply each rerun instruction with the data input that was used for that instruction during the prior execution of the software;
based on rerunning the prior execution of the software, identify a particular execution pattern in the prior execution of the software;
analyze a plurality of execution records using machine learning techniques to determine that the particular execution pattern corresponds to an execution behavior; and
determine that the execution behavior was present within the prior execution of the software.

2. The computing system of claim 1 , wherein accessing the execution record of an execution of the software is part of accessing the plurality of execution records and wherein the plurality of execution records are recorded during a plurality of executions of the software.

3. The computing system of claim 2 , wherein the plurality of executions of the software occurs in a plurality of different execution environments.

4. The computing system of claim 2 , wherein finding the particular execution pattern within the execution record is part of finding the particular execution pattern in at least some of the plurality of execution records.

5. The computing system of claim 4 , wherein identifying that the execution behavior is present within the prior execution of the software, is based on finding the particular execution pattern in at least some of the plurality of execution records.

6. The computing system of claim 1 , wherein the computing system is further configured to display an identification of the execution behavior or the particular execution pattern to a user.

7. The computing system of claim 6 , wherein the computing system is further configured to identify a replacement setting associated with the particular execution pattern that would allow the execution behavior to be modified.

8. The computing system of claim 6 , wherein the computing system is further configured to:
offer to the user to replace a current setting associated with the particular execution pattern with a replacement setting;
receive an indication that the user has selected to accept the offer; and
automatically replace the current setting associated with the particular execution pattern with the replacement setting in response to receiving the indication that the user has accepted the offer.

9. The computing system of claim 1 , wherein the computing system is further configured to offer a modification of code associated with the execution behavior to a user.

10. The computing system of claim 9 , wherein the computing system is further configured to:
receive an indication that the user has selected the modification; and
automatically perform the modification in response to receiving the indication that the user has selected the modification.

11. The computing system of claim 1 , wherein analyzing the plurality of execution records to determine that the particular execution pattern corresponds to the execution behavior, also includes analyzing previous changes to the particular execution pattern performed by users in order to modify the execution behavior.

12. The computing system of claim 1 , wherein the execution behavior comprises environmental execution behaviors that are specific to some environments in which the software is executed.

13. The computing system of claim 1 , wherein the execution behavior comprises a failure to properly configure an environment resource within the particular execution environment.

14. A method for automatically identifying an execution behavior of software, the method comprising:
recording a plurality of first execution records, each of which includes an execution trace that reproducibly represents a prior execution of a first software application within a particular execution environment in a manner that enables a data input to each instruction that was executed within the particular execution environment during the prior execution of the first software application to be known;
using the execution trace of each of the plurality of first execution records, rerun the prior execution of the first software application precisely as the first software application was previously run within the particular execution environment by using the execution trace to supply each rerun instruction with the data input that was used for that instruction during the prior execution of the software;
using machine learning techniques, and based on rerunning the prior execution of the first software application, identify a particular execution pattern in the prior execution of the first software application that corresponds to a particular execution behavior;
recording a second execution record based on an execution of a second software application;
determining whether the particular execution pattern is within the second execution record; and
in response to determining that the particular execution pattern is within the second execution record, identifying that the execution behavior is present within the second software application.

15. The method of claim 14 , wherein the execution behavior comprises an environmental execution behavior that is specific to some environments in which the first software application or the second software application is executed.

16. The method of claim 14 , wherein the execution behavior comprises a failure to properly configure an environment resource within the particular execution environment in which the first software application is executed.

17. The method of claim 14 , wherein the method further comprises offering a modification of a portion of code associated with the execution behavior to a user.

18. The method of claim 17 , wherein the method further comprises:
receiving an indication that the user has accepted the modification of the portion of the code associated with the execution behavior; and
automatically applying the modification in response to receiving the indication.

19. A method for automatically identifying an execution behavior of software, the method comprising:
accessing an execution record of a prior execution of software, wherein the execution record includes an execution trace that reproducibly represents the prior execution of the software within a particular execution environment in a manner that enables a data input to each instruction that was executed within the particular execution environment during the prior execution of the software to be known;
using the execution trace of the execution record to rerun the prior execution of the software precisely as the software was previously run within the particular execu

Assignees

• Microsoft Technology Licensing Llc

Inventors

• Richardson Leslie Yvette
• Davis Jackson Michael
• Myers Del
• Lai Thomas
• Sterland Andrew R
• Mola Jordi
• Pinkerton James M

Classifications

• G06F11/302 Primary

  where the computing system component is a software system · CPC title

• G06F11/364 Primary

  tracing values on a bus · CPC title

• G06F2201/865

  Monitoring of software · CPC title

• G06F11/3051

  Monitoring arrangements for monitoring the configuration of the computing system or of the computing system component, e.g. monitoring the presence of processing resources, peripherals, I/O links, software programs (verification or detection of system hardware configuration G06F11/2247) · CPC title

• G06F11/3072

  where the reporting involves data filtering, e.g. pattern matching, time or event triggered, adaptive or policy-based reporting · CPC title