公开(公告)号：US10063567B2

公开(公告)日：2018-08-28

申请号：US14939467

申请日：2015-11-12

Applicant: VIRTUAL SOFTWARE SYSTEMS, INC.

Inventor： Richard D. Fiorentino ,  Charles H. Kaman ,  Mario Troiani ,  Erik Muench

IPC: H04L29/06 ,  G06F9/54

CPC classification number: H04L63/14 ,  G06F9/54 ,  G06F11/1438 ,  G06F11/1492 ,  G06F21/52 ,  H04L63/123 ,  H04L63/1408

Abstract: A method of detecting aberrant behavior in a software application is described. The method includes instantiating replicated applications on computing devices using identical initial setting. Each replicated application is a replicated instance of the software application. Information associated with a first API call from the first replicated application, and information associated with a second API call from the second replicated application is received. The information includes a call identifier of the API call and a digest. The call identifier is unique during the lifetime of the replicated application issuing it and is identical across the replicated applications. If the first and second call identifiers are identical, the method determines whether the first and second digests match. The method also includes, in response to the first and second digests not matching, signaling that aberrant behavior has occurred. Apparatus and computer readable media are also described.

公开(公告)号：US20160142422A1

公开(公告)日：2016-05-19

申请号：US14939467

申请日：2015-11-12

Applicant: VIRTUAL SOFTWARE SYSTEMS, INC.

Inventor： Richard D. Fiorentino ,  Charles H. Kaman ,  Mario Troiani ,  Erik Muench

IPC: H04L29/06 ,  G06F9/54

CPC classification number: H04L63/14 ,  G06F9/54 ,  G06F11/1482 ,  G06F11/1683 ,  G06F11/2041 ,  G06F11/2097 ,  G06F2201/82 ,  H04L63/123 ,  H04L63/1408

Abstract: A method of detecting aberrant behavior in a software application is described. The method includes instantiating replicated applications on computing devices using identical initial setting. Each replicated application is a replicated instance of the software application. Information associated with a first API call from the first replicated application, and information associated with a second API call from the second replicated application is received. The information includes a call identifier of the API call and a digest. The call identifier is unique during the lifetime of the replicated application issuing it and is identical across the replicated applications. If the first and second call identifiers are identical, the method determines whether the first and second digests match. The method also includes, in response to the first and second digests not matching, signaling that aberrant behavior has occurred. Apparatus and computer readable media are also described.

Abstract translation: 描述了一种在软件应用中检测异常行为的方法。 该方法包括使用相同的初始设置实例化计算设备上的复制应用程序。 每个复制的应用程序是软件应用程序的复制实例。 与来自第一复制应用程序的第一API调用相关联的信息以及与来自第二复制应用程序的第二API调用相关联的信息被接收。 该信息包括API调用的呼叫标识符和摘要。 呼叫标识符在发布它的复制应用程序的生存期内是唯一的，并且在复制的应用程序中是相同的。 如果第一和第二呼叫标识符相同，则该方法确定第一和第二摘要是否匹配。 该方法还包括响应于不匹配的第一和第二摘要，表明发生了异常行为。 还描述了装置和计算机可读介质。