Storage of software execution data by behavioral identification

Abstract

Methods and systems for analyzing software. For example, one method can include executing a software program including a function by a computer. The method also includes producing an execution sequence for the function when, during execution, the software program executes the function. The method further includes generating an identifier for the execution sequence, wherein the identifier uniquely identifies a path of execution through the function represented by the execution sequence. In addition, the method includes saving the identifier and making the identifier available to at least one user through a user interface.

What is claimed is: 
     
         1 . A method for processing software, the method comprising:
 executing a software program, by a computer, the software program comprising a function;   when, during execution, the software program executes the function, producing an execution sequence of the function;   generating an identifier for the execution sequence, wherein the identifier uniquely identifies a path of execution through the function represented by the execution sequence;   saving the identifier; and   making the identifier available to at least one user through a user interface.   
     
     
         2 . The method of  claim 1 , further comprising:
 accessing at least one data storage medium storing previously-generated identifiers associated with functions of the software program; and   comparing the identifier to the previously-generated identifiers to determine whether the identifier is already stored in the at least one data storage medium.   
     
     
         3 . The method of  claim 2 , wherein saving the identifier includes saving the identifier when the identifier is not already stored in the at least one data storage medium. 
     
     
         4 . The method of  claim 2 , further comprising incrementing a count value associated with the identifier when the identifier is previously stored in the at least one data storage medium. 
     
     
         5 . The method of  claim 2 , wherein the function includes a defined function or set of instructions. 
     
     
         6 . The method of  claim 1 , wherein identifier for the execution sequence includes a sum of operational code hash values or conditional execution instruction hash values for the execution sequence. 
     
     
         7 . The method of  claim 1 , further comprising:
 executing a second function in the software program when encountering a function call, a call stack, a context switch, a switch statement, a branch point, or a conditional execution instruction;   producing a second execution sequence of the second function;   generating a second identifier for the execution sequence, wherein the second identifier uniquely identifies a path of execution through the second function represented by the second execution sequence; and   saving the second identifier when the identifier is not already stored in the at least one data storage medium.   
     
     
         8 . The method of  claim 1 , further comprising:
 generating a hash table of identifiers associated with functions of the software program, wherein each identifier includes a hash value;   counting a number of times each execution sequence is encountered in the execution of the software program represented by the identifier for each execution sequence and associating a count with the corresponding identifier; and   displaying the hash table of identifiers and the count associated with functions of the software program.   
     
     
         9 . The method of  claim 1 , further comprising:
 selecting the identifier;   identifying source code or function variables representing the execution sequence of the function; and   displaying the identifier with a link to the source code or function variables representing execution sequence of the function.   
     
     
         10 . The method of  claim 1 , further comprising:
 identifying source code or function variables representing the execution sequence of the function; and   saving at least one selected from the group comprising the identifier with a link to the source code or function variables representing execution sequence of the function and the identifier with the source code or values of the function variables representing execution sequence of the function.   
     
     
         11 . At least one non-transitory machine readable storage medium comprising a plurality of instructions adapted to be executed to implement the method of  claim 1 . 
     
     
         12 . A system for processing software, the system comprising:
 a processor configured to
 execute a software program comprising a function; 
 produce an execution sequence of the function during execution of the function; 
 generate an identifier for the execution sequence, wherein the identifier uniquely identifies a path of execution through the function represented by the execution sequence; and 
   at least one data storage medium configured to save the identifier.   
     
     
         13 . The system of  claim 12 , further comprising a user interface configured to make the identifier available to at least one user. 
     
     
         14 . The system of  claim 12 , wherein
 the processor is further configured to generate an index table of identifiers associated with functions of the software program, wherein each identifier includes an index value;   the at least one data storage medium configured to save the index table of identifiers; and   the user interface configured to the index table of identifiers to the at least one user.   
     
     
         15 . The system of  claim 12 , wherein the processor is further configured to
 access the at least one data storage medium storing previously-generated identifiers associated with functions of the software program; and   compare the identifier to the previously-generated identifiers to determine whether the identifier is already stored in the at least one data storage medium.   
     
     
         16 . The system of  claim 15 , wherein the processor is further configured to save the identifier when the identifier is not already stored in the at least one data storage medium. 
     
     
         17 . The system of  claim 16 , further comprising a counter configured to increment a count value associated with the identifier when the identifier is previously stored in the at least one data storage medium. 
     
     
         18 . The system of  claim 12 , wherein the function includes a defined function or a specific code segment with sequential code instructions. 
     
     
         19 . The system of  claim 12 , wherein identifier for the execution sequence is derived from an arithmetic or logic operation on the operational code hash values or conditional execution instruction hash values for the execution sequence. 
     
     
         20 . The system of  claim 12 , further comprising a data buffer configured to collect execution sequences of functions in real-time during of the execution of the software program.