US 11,704,129 B2
Transparent interpretation and integration of layered software architecture event streams
Adam Bates Yuile, Champaign, IL (US); Wajih Ul Hassan, Champaign, IL (US); and Mohammad Noureddine, Urbana, IL (US)
Assigned to The Board of Trustees of the University of Illinois, Urbana, IL (US)
Filed by Board of Trustees of the University of Illinois, Urbana, IL (US)
Filed on Nov. 24, 2020, as Appl. No. 17/247,038.
Claims priority of provisional application 62/940,114, filed on Nov. 25, 2019.
Prior Publication US 2021/0157583 A1, May 27, 2021
Int. Cl. G06F 16/00 (2019.01); G06F 9/30 (2018.01); G06F 9/54 (2006.01); G06F 40/205 (2020.01); G06F 16/17 (2019.01)
CPC G06F 9/3005 (2013.01) [G06F 9/3017 (2013.01); G06F 9/542 (2013.01); G06F 16/1734 (2019.01); G06F 40/205 (2020.01)] 22 Claims
OG exemplary drawing
 
1. A system comprising:
a memory; and
one or more processing devices coupled to the memory, the one or more processing devices to:
analyze program code, including a control flow graph, of one or more applications executable by an operating system of a computing device to determine event-logging functions of the program code that generate event logs;
extract log message strings from the program code that describe event-logging statements associated with the event-logging functions;
generate regular expressions from the log message strings, the regular expressions comprising a template format of the log message strings that replace format specifiers with runtime-dependent arguments;
identify, via control flow analysis, a plurality of possible control flow paths of the log message strings through the control flow graph;
generate, during runtime execution of the program code on the computing device, a universal log file from a combination of system logs and process-specific event log messages of the one or more applications;
identify, via parsing the universal log file, log entries that most closely match one or more of the regular expressions of the log message strings, to identify matching log message string (LMS) entries; and
add the matching LMS entries, using a process-specific identifier of each matching LMS entry, as vertices to a universal provenance graph that associates the matching LMS entries with the system logs consistent with the plurality of possible control flow paths of the log message strings.