US 11,755,458 B2
Automatic software behavior identification using execution record
Leslie Yvette Richardson, Seattle, WA (US); Jackson Michael Davis, Carnation, WA (US); Del Myers, Seattle, WA (US); Thomas Lai, Redmond, WA (US); Andrew R. Sterland, Issaquah, WA (US); Jordi Mola, Bellevue, WA (US); and James M. Pinkerton, Kirkland, WA (US)
Assigned to Microsoft Technology Licensing, LLC, Redmond, WA (US)
Filed by Microsoft Technology Licensing, LLC, Redmond, WA (US)
Filed on Jan. 21, 2021, as Appl. No. 17/154,853.
Application 17/154,853 is a continuation of application No. 16/284,913, filed on Feb. 25, 2019, granted, now 10,922,210.
Prior Publication US 2021/0141709 A1, May 13, 2021
This patent is subject to a terminal disclaimer.
Int. Cl. G06F 11/00 (2006.01); G06F 11/34 (2006.01); G06F 11/36 (2006.01); G06F 9/54 (2006.01); G06F 11/07 (2006.01); G06F 11/30 (2006.01); G06F 11/32 (2006.01); G06F 8/35 (2018.01); G06F 9/455 (2018.01)
CPC G06F 11/364 (2013.01) [G06F 11/3612 (2013.01); G06F 8/35 (2013.01); G06F 9/45516 (2013.01); G06F 9/542 (2013.01); G06F 11/0706 (2013.01); G06F 11/0778 (2013.01); G06F 11/3006 (2013.01); G06F 11/323 (2013.01); G06F 11/3409 (2013.01); G06F 11/3466 (2013.01); G06F 11/3476 (2013.01); G06F 11/3495 (2013.01); G06F 11/362 (2013.01); G06F 11/3636 (2013.01); G06F 11/3644 (2013.01)] 20 Claims
OG exemplary drawing
 
1. A computing system comprising:
one or more processors; and
one or more computer-readable hardware storage media having thereon computer-executable instructions that are structured such that, when executed by the one or more processors, the computer-executable instructions configure the computing system to at least:
access an execution record of a prior execution of software, wherein the execution record includes an execution trace that reproducibly represents the prior execution of the software within a particular execution environment in a manner that enables a data input to each instruction that was executed within the particular execution environment during the prior execution of the software to be known;
use the execution trace of the execution record to rerun the prior execution of the software precisely as the software was previously run within the particular execution environment by using the execution trace to supply each rerun instruction with the data input that was used for that instruction during the prior execution of the software;
based on rerunning the prior execution of the software, identify a particular execution pattern in the prior execution of the software;
analyze a plurality of execution records using machine learning techniques to determine that the particular execution pattern corresponds to an execution behavior; and
determine that the execution behavior was present within the prior execution of the software.