Patent ID: 9009535
Filing Date: 2015-04-14
Classification: G06F

Abstract:
1. In association with a computer program comprising one or more basic blocks, and concrete data structures that each pertains to a basic block, a computer implemented method comprising: identifying one or more invariants, wherein each invariant is a specific rule associated with one of the concrete data structures and has a particular numerical value representative of a normal operation of the program and wherein a number of basic blocks that pertain to the concrete data structures associated with the one or more invariants is selectively less than a total number of basic blocks included in the computer program; determining at specified times whether an invariant has been violated, wherein instrumentation code, for use in detecting violation of the one or more invariants, is selectively inserted into each concrete data structure associated with the one or more invariants and wherein each concrete data structure associated with the one or more invariants is monitored for invariant violations during computer runtimes and wherein a training procedure is applied to each basic block having a concrete data structure associated with the one or more invariants, in order to determine standards that define violations of said invariants and wherein information pertaining to the instrumentation code and the training procedure is mapped from a given concrete data structure to a given logical data structure that corresponds to the given concrete data structure; and responsive to detecting a violation of one of the invariants, flagging the detected violation as an anomaly.