CPC G06F 11/364 (2013.01) [G06F 11/3612 (2013.01); G06F 8/35 (2013.01); G06F 9/45516 (2013.01); G06F 9/542 (2013.01); G06F 11/0706 (2013.01); G06F 11/0778 (2013.01); G06F 11/3006 (2013.01); G06F 11/323 (2013.01); G06F 11/3409 (2013.01); G06F 11/3466 (2013.01); G06F 11/3476 (2013.01); G06F 11/3495 (2013.01); G06F 11/362 (2013.01); G06F 11/3636 (2013.01); G06F 11/3644 (2013.01)] | 20 Claims |
1. A computing system comprising:
one or more processors; and
one or more computer-readable hardware storage media having thereon computer-executable instructions that are structured such that, when executed by the one or more processors, the computer-executable instructions configure the computing system to at least:
access an execution record of a prior execution of software, wherein the execution record includes an execution trace that reproducibly represents the prior execution of the software within a particular execution environment in a manner that enables a data input to each instruction that was executed within the particular execution environment during the prior execution of the software to be known;
use the execution trace of the execution record to rerun the prior execution of the software precisely as the software was previously run within the particular execution environment by using the execution trace to supply each rerun instruction with the data input that was used for that instruction during the prior execution of the software;
based on rerunning the prior execution of the software, identify a particular execution pattern in the prior execution of the software;
analyze a plurality of execution records using machine learning techniques to determine that the particular execution pattern corresponds to an execution behavior; and
determine that the execution behavior was present within the prior execution of the software.
|