Patent ID: 8301433

Claim:
A software behavior modeling apparatus, comprising: a stack information recording unit configured to obtain i-th stack frame information for identifying a first stack frame stacked on a call stack at a time when a specific event occurs and (i−1)-th stack frame information for identifying a second stack frame stacked on the call stack at a time before the specific event occurs during the execution of software under a software execution environment, while specifying an order that the first and second stack frame are stacked on the call stack, and to record the first stack frame information in an order of an occurrence of the specific event; a termination information recording unit configured to compare, sequentially from a bottom of the call stack, (i−1)-th stack information with i-th stack information both recorded by the stack information recording unit, where i represents a natural number, and to record termination information indicating a boundary between an identical portion and a non-identical portion, the identical portion indicating a portion where the (i−1)-th stack information and the i-th stack information are identical and have a same position on the call stack, the non-identical portion indicating a portion following the first and second stack frame in which a difference is detected between the (i−1)-th stack information and the i-th stack information; a first stack difference information generating unit configured to generate, by a computer, stack difference information formed between the (i−1)-th stack information and the i-th stack information, the stack difference information being a combination of a portion of the (i−1)-th stack information with a portion of the i-th stack information, both portions being located from an uppermost stack frame to the termination information; and a model generating unit configured to generate a software behavior model by taking a hash value of the stack difference information or deriving a correlation rule between an identifier of the specific event and the stack difference information.