US Patent No. 10,558,509

DETECTING ANOMALIES IN PROGRAM EXECUTION


Patent No. 10,558,509
Issue Date February 11, 2020
Title Detecting Anomalies In Program Execution
Inventorship Rachel E. Craik, North York (CA)
Allan Kielstra, Ajax (CA)
Ying Chau Raymond Mak, Thornhill (CA)
Melanie Ullmer, Scarborough (CA)
Assignee International Business Machines Corporation, Armonk, NY (US)

Claim of US Patent No. 10,558,509

1. A method comprising:logging, with one or more processing devices, key run time events that occur during execution of a program, wherein each key run time event is associated with one or more computer operations and wherein each key run time event has a corresponding key run time event type and a corresponding key run time event data structure, wherein logging includes:
monitoring a recurrent event, the recurrent event including a recurring sequence of one or more of the key run time events; and
storing records associated with the key run time events, wherein each record includes the corresponding key run time event type and is based on the key run time event data structure associated with the key run time event;
analyzing the records, with the one or more processing devices, to determine if the recurring sequence of one or more of the key run time events in the recurrent event occurred with an expected frequency; and
generating, with the one or more processing devices, a security alert if the recurring sequence of one or more of the key run time events in the recurrent event occurred with a frequency more than a threshold frequency away from the expected frequency.