Method and electronic device for monitoring executable code adapted to be executed on a computer platform, and computer program implementing such a method

Patent metadata

Field	Value
Publication number	US-12248787-B2
Application number	US-202217655243-A
Country	US
Kind code	B2
Filing date	Mar 17, 2022
Priority date	Mar 25, 2021
Publication date	Mar 11, 2025
Grant date	Mar 11, 2025

Abstract

A computer-implemented method for monitoring an executable code having a sequence of software instructions. The method includes acquiring the sequence and generating a first modeling structure of an execution path of the sequence, the first structure having first data groups, each associated with a respective instruction and including identifiers of preceding and following instructions. A second modeling structure of an operation of the sequence is constructed by going through the first groups, the second structure having second data groups, each associated with a respective instruction and including an indicator of possibly belonging to a critical chain. A critical chain corresponds to instructions of a same software function and is computed by solving a subgraph problem with degree restraints, each critical chain corresponding to a subgraph. The method also includes searching for runtime anomaly/anomalies from critical chain(s) determined via the second structure.

First claim

The invention claimed is:

1. A method for monitoring an executable code adapted to be executed on a computer platform, the executable code comprising a sequence of software instructions,
the method being implemented by an electronic monitoring device and comprising:
acquiring the sequence of software instructions;
generating a first modeling structure of an execution path of the sequence of instructions, with the first structure being generated from the sequence of instructions and including a plurality of first groups of data, each of the first groups of data being associated with a respective software instruction and including an identifier of a previous instruction and an identifier of a following instruction;
calculating a second modelling structure of an operation of the sequence of instructions, the second structure comprising a plurality of second groups of data, each of the second groups of data being associated with the respective software instruction and comprising an indicator of possibly belonging to a specific critical chain of instructions, and in a case of belonging to a respective critical chain, of a plurality of respective chains, an identifier of an initial instruction of said respective critical chain;
the second structure being created from the first structure by successively going through the first groups of data;
computing the respective critical chain, of the plurality of respective chains, corresponding to instructions of a same software function, by solving a subgraph problem with degree constraints, each of the plurality of respective critical chains corresponding to a subgraph, a number of instructions included in each of the plurality of respective critical chains being less than or equal to a predefined maximum number, and an optimization parameter being a number of relationships between the instructions included in each of the respective critical chains, said number of relationships corresponding to a number of arcs in a related subgraph; and
searching for runtime anomaly/anomalies from one or more critical chains of instructions determined via the second modeling structure.

2. The method according to claim 1 , wherein during the calculating, for each software instruction belonging to the respective critical chain, each of the second groups of data further comprises a pre-context field and a post-context field, with the pre-context field including an identifier of each instruction preceding the instruction associated with said second groups of data and not belonging to the respective critical chain of which said each instruction is a part, and the post-context field including an identifier of each instruction succeeding an instruction associated with one of said second groups of data and not belonging to the critical chain of which said instruction is a part.

3. The method according to claim 2 , wherein during the calculating, a scope field is added for each of the one or more respective critical chains of instructions in the second modeling structure, the scope field including a number of memory accesses from all instructions in said respective critical chain.

4. The method according to claim 2 , wherein during the calculating, a pre-context variable and a post-context variable are added for each of the one or more respective critical chain chains of instructions in the second modeling structure, the pre-context variable being equal to the most frequent of the instruction identifiers contained in the pre-context fields for said respective critical chain, and the post-context variable being equal to the most frequent of the instruction identifiers contained in the post-context fields for said respective critical chain.

5. The method according to claim 1 , wherein each of the first groups of data further comprises a runtime quantification of an execution of the respective software instruction, and each of the second groups of data further comprises at least a runtime quantification of an execution path of the sequence to said respective software instruction.

6. The method according to claim 5 , wherein the runtime quantification of the execution of the respective software instruction is a number of clock cycles for said execution.

7. The method according to claim 5 , wherein during the calculating, for each software instruction belonging to one of the plurality of respective critical chains, each of the second groups of data further comprises a pre-context field and a post-context field, with the pre-context field including an identifier of each instruction preceding an instruction associated with one of said second groups of data and not belonging to the critical chain of which said associated instruction is a part, and the post-context field including an identifier of each instruction succeeding the instruction associated with one of said second groups of data and not belonging to the critical chain of which said associated instruction is a part, and
wherein each runtime quantification of an execution path to the respective software instruction is calculated from the pre-context field for said instruction and the execution runtime quantifications for said respective instruction and for the instructions identified in the pre-context field.

8. The method according to claim 5 , wherein the method further comprises propagating runtime quantification data from a previous critical chain of instructions to a current critical chain of instructions, runtime quantifications associated with the current critical chain being determined from runtime quantifications associated with the previous critical chain.

9. The method according to claim 8 , wherein during the searching, a runtime anomaly is detected if there is an inconsistency between the runtime quantifications associated with the current critical chain and the runtime quantifications associated with the previous critical chain.

10. The method according to claim 5 , wherein a first runtime quantification included in the second groups of data is a runtime quantification of a shortest execution path between a first instruction of the sequence and the respective instruction; and a second runtime quantification included in the second groups of data is a runtime quantification of a longest execution path between said first instruction and the respective instruction.

11. The method according to claim 1 , wherein the computer platform comprises a plurality of instructions execution units, and each of the first groups of data further comprises an identifier of an execution unit associated with the respective software instruction.

12. The method according to claim 1 , wherein each of the first groups of data further comprises information on possible dependency with other instructions.

13. The method according to claim 12 , wherein the information on possible dependency includes a common register identifier with said other instructions and/or a common memory area identifier with said other instructions.

14. The method according to claim 1 , wherein the sequence of software instructions is a sequence of instructions expressed in machine language, directly interpretable by the computer platform.

15. A non-transitory computer-readable medium including a computer program comprising software instructions that implement a method according to claim 1 when executed by a computer.

16. An electronic device for monitoring an executable code adapted to be executed on a computer platform, the executable code comprising a sequence of software instructions, the device comprising:
an acquisition module configured to acquire the sequence of software instructi

Assignees

• Commissariat Energie Atomique

Inventors

• Asavoae Mihail
• Jan Mathieu

Classifications

• G06F11/3608

  using formal methods, e.g. model checking, abstract interpretation (theorem proving G06N5/013) · CPC title

• G06F9/3897

  with adaptable data path · CPC title

• G06F21/577

  Assessing vulnerabilities and evaluating computer system security · CPC title

• G06F21/554

  involving event detection and direct action · CPC title

• G06F9/3838 Primary

  Dependency mechanisms, e.g. register scoreboarding · CPC title