KR20190052447A - Apparatus and method for detecting software procedure change operation based on pattern using control flow graph - Google Patents

Abstract

The present invention relates to an apparatus for monitoring a software procedure change operation based on a pattern using a control flow graph (CFG), to detect illegal action and abnormal operation with respect to software, and a method thereof. According to one embodiment of the present invention, the apparatus for monitoring a software procedure change operation based on a pattern using a CFG comprises: a logical module flow selection unit for discriminating each module in a CFG for a source code of software in accordance with order relation; a CFG pattern extraction unit for generating and extracting a sequence pattern, a depth pattern, and a range-position pattern through abstraction in accordance with a purging probability of a purging test with respect to each discriminated module and a transition probability distribution of each module; and a dynamic tracking unit using the sequence pattern, the depth pattern, and the range-position pattern to measure or detect an abnormality degree in accordance with procedure change of the source code of the software.

Description

TECHNICAL FIELD [0001] The present invention relates to a pattern-based software procedure change operation monitoring apparatus and a method thereof,

The present invention relates to an apparatus and method for monitoring a pattern-based software procedure change operation using a CFG, and more particularly, to a method and apparatus for abstracting a CFG extracted from a software source code, And more particularly, to a pattern-based software procedure change operation monitoring apparatus and method for detecting illegal and abnormal operation of software by measuring an abnormality of a source code.

Information security in the enterprise means protecting information from various threats. In other words, information security means management and technical methods to prevent information from being damaged, altered, or leaked during collection, processing, storage, retrieval, transmission and reception of information.

This information security can be understood from the provider side and the user side that provide information. The supplier side represents a series of actions to safely protect and operate information assets such as network, system hardware, database, communication, and computer facilities from internal and external threat factors. The user side is to prevent leakage and abuse of personal information Represents a series of actions.

In recent years, it has expanded the scope of information security monitoring, not only for hacking offenses by unspecified hackers outside the enterprise, but also for hacking crimes against insiders (ie internal programmers, contract / subcontractor programmers) inside the company .

Research related to this is in the process of investigating the malicious modification of the source code and monitoring the abnormal behavior of the program.

There are three major types of software risks that can be generated by internal personnel during software development and operation / maintenance. First, there is a risk of leaving hacking code (for example, a backdoor) somewhere in the source code; second, the risk of changing the system settings without changing the source code and causing it to behave differently at a particular point in time; It can be a risk to change the flow of logic.

 Extractable information is limited because it is based on syntax to perform anomaly detection when the source code is changed based only on the syntax or signature of the source code. However, in order to perform anomaly detection, it is possible to extract a plurality of information through a graph theory by changing one CFG (Control Flow Graph), that is, into a graph form.

Therefore, in order to detect the risk of software that can be generated by the internal manpower, it is necessary to detect a pattern-based software procedure change using CFG.

Korean Registered Patent No. 10-1541603 (Registered on July 28, 2015) Korean Registered Patent No. 10-1421136 (Registered on July 14, 2014)

An object of the present invention is to provide a method and apparatus for abstracting a CFG extracted from a source code of software by abstracting it through a purging technique and a trigram, And a pattern-based software procedure change operation monitoring device using the CFG.

The pattern-based software procedure change operation monitoring device using the CFG according to an embodiment of the present invention includes a CFG (Control Flow Graph) for the source code of the software, Logical module flow selection; A sequence pattern, a depth pattern, and a range-position pattern are generated and abstracted through an abstraction according to the purging probability of the purging test for each module and the transition probability distribution of each module A CFG pattern extracting unit; And a dynamic tracing unit for measuring or detecting an abnormality in accordance with a procedure change of the source code of the software using the sequence pattern, the depth pattern, and the range-position pattern.

The logical module flow selection unit can distinguish the first module and the second module as logical functional units according to the successive relationship of the important modules.

Wherein the CFG pattern extracting unit selects a module having a high probability in a branching module by calculating a transition probability distribution for each module with respect to a result of performing a purging test on modules between the first module and the second module, And a module in which the exception processing and the termination code are implemented among the branching modules can be omitted.

The CFG pattern extracting unit performs a clustering process of generating predetermined nodes in a bundle by using a trigram for the modules between the first module and the second module, and calculates a discrete probability distribution for all the trigrams So that the sequence pattern can be generated.

The CFG pattern extracting unit may generate depth depth information by grasping a connection depth indicating the number of CFG nodes between the first module and the second module in a plurality of source code files.

The CFG pattern extracting unit may generate the range-position pattern by learning about a change position and a change range of input / output parameters commonly used in the first module and the second module.

The parameter may be an array, a variable, or a memory.

The dynamic tracking unit may measure the degree of abnormality of the sequence pattern by measuring the degree of following the discrete probability distribution of the corrected CFG trigram.

The dynamic tracking unit can detect the degree of abnormality of the depth pattern by measuring the degree of the inter-module depth of the modified CFG following the discrete probability distribution.

The dynamic tracking unit may detect an operation on a change position and a change range by checking valid values of input / output parameters for input / output parameters commonly used in the first module and the second module.

The method of monitoring a pattern-based software procedure change operation using a CFG according to an embodiment of the present invention includes a step of classifying each module according to a sequential relation in which a critical module is consecutive in a CFG (Control Flow Graph) ; A sequence pattern, a depth pattern, and a range-position pattern are generated and abstracted through an abstraction according to the purging probability of the purging test for each of the above-identified modules and the transition probability distribution of each module step; And measuring or detecting an abnormality in accordance with a procedure change of the source code of the software using the sequence pattern, the depth pattern, and the range-position pattern as confirming the modification to the source code of the software. . ≪ / RTI >

In the dividing step, the first module and the second module may be distinguished from each other as a logical functional unit according to the successive relation of the important modules.

Wherein the generating and extracting step calculates a transition probability distribution for each module with respect to a result of performing a purging test on modules between the first module and the second module and selects a module having a higher probability in the branching module, It is possible to combine the modules that are executed together with probability and to omit the module in which the exception processing and termination code of the branch module are implemented.

The generation and extraction step may include a grouping process of generating predetermined nodes in a bundle in a trigram scheme for the modules between the first module and the second module and calculating a discrete probability distribution for all trigrams Thereby generating the sequence pattern.

The generating and extracting step may generate the depth packet by detecting a connection depth indicating the number of CFG nodes between the first module and the second module on the plurality of source code files.

The generating and extracting step may generate the range-position pattern by learning about a change position and a change range of input / output parameters commonly used in the first module and the second module.

The measuring or detecting step may detect the degree of abnormality of the sequence pattern by measuring the degree of following the discrete probability distribution of the corrected CFG trigram.

The measurement or detection step may detect the degree of abnormality of the depth pattern by measuring the degree of inter-module depth of the modified CFG following the discrete probability distribution.

The measurement or detection step may detect an operation on the change position and the change range by checking the valid values for the input / output parameters for the input / output parameters commonly used in the first module and the second module .

The present invention can detect illegal behavior and abnormal operation of software by abstracting the CFG extracted from the software source code and abstracting it through the purging technique and the trigram to measure the abnormality of the source code by learning the pattern.

In addition, the present invention can extend the scope of the monitoring to the area excluded from the security surveillance by detecting illegal actions of the programmer (contract / service staff) on the source code of the software.

Further, the present invention can be applied to a case in which illegal intention is hidden (for example, only one of 1,000 events is illegally executed), or temporarily fixed after the source code is modified (for example, after insertion of a bypass code It is possible to detect a malicious object code using various source code bypassing methods or exceptional conditions.

 In addition, the present invention minimizes the load and burden of the operating system (stability problems due to un-validated codes, etc.) by learning patterns in the test environment (purging technique) rather than in actual operation.

In addition, the present invention can firmly monitor illegal activities by applying complementary technologies of different purposes.

BRIEF DESCRIPTION OF THE DRAWINGS Figure 1 shows a CFG type illustration,
2 is a view for explaining a CFG extracted from a source code,
FIG. 3 is a diagram illustrating a pattern-based software procedure change operation monitoring apparatus using a CFG according to an embodiment of the present invention.
4A and 4B are diagrams illustrating a process of extracting a purging probability through a purging test,
4C is a diagram illustrating an example of abstraction according to transition probability calculation,
5 is a diagram showing a part of a CFG of an actual code,
6 is a view for explaining the discrete probability distribution of trigrams extracted from the CFG,
7 is a view for explaining a process of extracting depths between important modules in a CFG,
8 is a diagram for explaining a process of learning a change position and a change range of input / output parameters,
9 is a diagram showing a process result of learning a change point and a change range of an input / output parameter,
10 is a diagram showing an example of logical error monitoring of software.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings. In the following description and the accompanying drawings, detailed description of well-known functions or constructions that may obscure the subject matter of the present invention will be omitted. It should be noted that the same constituent elements are denoted by the same reference numerals as possible throughout the drawings.

The terms and words used in the present specification and claims should not be construed in an ordinary or dictionary sense, and the inventor shall properly define the terms of his invention in the best way possible It should be construed as meaning and concept consistent with the technical idea of the present invention.

Therefore, the embodiments described in the present specification and the configurations shown in the drawings are merely the most preferred embodiments of the present invention, and not all of the technical ideas of the present invention are described. Therefore, It is to be understood that equivalents and modifications are possible.

In the accompanying drawings, some of the elements are exaggerated, omitted or schematically shown, and the size of each element does not entirely reflect the actual size. The invention is not limited by the relative size or spacing depicted in the accompanying drawings.

When an element is referred to as " including " an element throughout the specification, it is to be understood that the element may include other elements as well, without departing from the spirit or scope of the present invention. Also, when a part is referred to as being "connected" to another part, it includes not only "directly connected" but also "electrically connected" with another part in between.

The singular expressions include plural expressions unless the context clearly dictates otherwise. It will be understood that terms such as " comprise " or " comprise ", when used in this specification, specify the presence of stated features, integers, , But do not preclude the presence or addition of one or more other features, elements, components, components, or combinations thereof.

Also, as used herein, the term " part " refers to a hardware component such as software, FPGA or ASIC, and " part " However, " part " is not meant to be limited to software or hardware. &Quot; Part " may be configured to reside on an addressable storage medium and may be configured to play back one or more processors. Thus, by way of example, and not limitation, " part (s) " refers to components such as software components, object oriented software components, class components and task components, and processes, Subroutines, segments of program code, drivers, firmware, microcode, circuitry, data, databases, data structures, tables, arrays and variables. The functions provided in the components and " parts " may be combined into a smaller number of components and " parts " or further separated into additional components and " parts ".

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings so that those skilled in the art can easily carry out the present invention. The present invention may, however, be embodied in many different forms and should not be construed as limited to the embodiments set forth herein. In order to clearly illustrate the present invention, parts not related to the description are omitted, and similar parts are denoted by like reference characters throughout the specification.

Before describing a preferred embodiment of the present invention, a CFG (Control Flow Graph) will be described.

CFG means that all paths that a program can traverse during execution are represented by nodes and edges through graphical notation. A node can be represented by a circle, and an edge by a line. This CFG is one of the unique information that can be generated by various codes such as Java language or C language, and is used in the field of compiler optimization.

1 is a diagram showing an example of a CFG type.

Referring to FIG. 1, (a) represents a case where an if-then-else is represented by a CFG, (b) represents a case where a while loop is represented by a CFG, and (c) (Eg, if-break in a while statement), and (d) represents a loop with two entry points as a CFG (eg, a while / for statement in a goto statement).

2 is a view for explaining the CFG extracted from the source code. 2, in the source code 1, a node number 2 is assigned to each column line. The CFG (3) extracts nodes from the source code (1) and expresses the connection relationship between the nodes as an edge. Here, the CFG (3) indicates where the source code (1) can reach when executing the code.

The CFG (3) of FIG. 2 shows a relatively simple case, but the larger the number of edges indicating the number of nodes and the connection relationship between the nodes, the greater the complexity. The CFG (3) itself only represents node connection information (eg, declarations, branch statements, arithmetic statements, etc.) and has no meaning in terms of analysis of source code procedure changes.

Accordingly, in the present invention, all possible transition probabilities are obtained by generating various input variables by applying a fuzzing technique to the extracted CFG, and a trigram-based CFG pattern generation technique, a sequence sequence-pattern unsteadiness detection, depth pattern-based anomaly detection, and range-position-based anomaly detection.

Hereinafter, preferred embodiments of the present invention will be described with reference to the accompanying drawings.

3 is a diagram illustrating a pattern-based software procedure change operation monitoring apparatus using a CFG according to an embodiment of the present invention.

3, a pattern-based software procedure change operation monitoring apparatus (hereinafter, referred to as 'SW procedure change operation monitor apparatus') 100 using CFG according to an embodiment of the present invention includes software (CFG) for the source code of the CFG, and generates and learns the pattern through the purging technique and the abstract by the trigram for the extracted CFG, thereby generating the source code The abnormality is measured.

To this end, the SW procedure change operation monitoring apparatus 100 includes a logical module flow selection unit 110, a CFG pattern extraction unit 120, and a dynamic tracking unit 130.

The logical module flow selection unit 110 selects an important module from the source code of the software and then selects the first module and the second module separately according to the successive line / .

Here, 'module' refers to a logical functional unit composed of various codes and functions. 'Important module' means a module that constitutes the main function of the source code. In this case, 'first module' means a module which is executed first among important modules, and 'second module' means a module which is executed after the first module among important modules. Therefore, after executing the first module, the second module is executed without any exception.

However, 'first module' and 'second module' are relative concepts. For example, if you select the important module 3 (wicket) as the first module in the important module 1 (bidding) → important module 2 (tipping) → important module 3 (wicket) → important module 4 Yes) becomes the second module. In other words, the first module and the second module are not absolute concepts, as in the case where the first module, the important module 1 (bidding) is the first module, and the second module, the important module 2 (tentative), becomes the second module.

The CFG pattern extracting unit 120 extracts a CFG from the source code and then extracts a sequence, a depth, and a range-position pattern through pattern generation through abstracting the extracted CFG. In this case, the CFG pattern extracting unit 120 performs model learning on the source code.

First, an abstraction of the CFG extracted from the source code will be described.

The CFG pattern extracting unit 120 performs a fuzzing test to extract a purging probability, and then performs an abstraction according to a transition probability distribution per module. Here, the purging test is a process of randomly generating an input value in the first module 10 and extracting a pattern of the resultant value.

FIGS. 4A and 4B are diagrams for explaining a process of extracting a purging probability through a purging test, and FIG. 4C is a diagram illustrating an example of abstraction according to transition probability calculation.

Referring to FIG. 4A, the CFG pattern extracting unit 120 performs a purging test on the modules between the first module 10 and the second module 20 of the CFG. That is, the CFG pattern extracting unit 120 substitutes a random input value into the first module 10 to generate a pattern of the resultant value.

Referring to FIG. 4B, the CFG pattern extracting unit 120 calculates a transition probability distribution per module with respect to a result of performing a purging test on the modules between the first module 10 and the second module 20 of the CFG . This corresponds to the probability learning from the first module 10 to the second module 20.

4C, the CFG pattern extracting unit 120 extracts a transition probability distribution calculation result to abstract and summarize a sequence of modules between the first module 10 and the second module 20 of the CFG A module having a higher probability is selected from the branch module and a module having the highest probability is combined into one module and the module having the exception processing and termination code of the branch module is omitted.

In the 'abstraction example 1', a module having a high probability in the branch module is represented as 'A → C → E → D → G → M'. In the case of the branch module E, the transition probability in both directions is the same, I ', and in the case of the termination module M, the previously connected module is displayed and is indicated as' D → H → M'.

Referring to 'abstraction example 2', modules C and E, which are executed with high probability among the branching modules, are merged into one.

The reason why the CFG-based abstraction process is performed is as follows. As shown in FIG. 5, since there are many nodes between the first module and the second module in the CFG of the actual source code, But it is difficult to interpret CFG itself. 5 is a diagram showing a part of a CFG of an actual code. Accordingly, it is preferable that the CFG pattern extracting unit 120 performs the pattern extraction process after the abstracting process before the pattern extraction.

Hereinafter, the generation process and the extraction process (or learning process) for the sequence pattern, the depth pattern, and the range-position pattern will be described.

First, the CFG pattern extracting unit 120 can generate and extract a sequence pattern.

Specifically, the CFG pattern extracting unit 120 performs a clustering process of generating three nodes in a bundle by using the trigram method of the abstracted CFG module. At this time, the CFG pattern extracting unit 120 measures the frequency of the trigram generated through the clustering process as shown in FIG. 6, and calculates the discrete probability distribution for all the trigrams using the frequency. 6 is a diagram for explaining the discrete probability distribution of the trigrams extracted from the CFG.

Here, the reason why the trigram is used for the module of the abstracted CFG is to include three directional information of 'starting point - intermediate point - destination' in the pattern at present.

As described above, the CFG pattern extracting unit 120 classifies various modules executed in the process of executing the important module (first module → second module) into trigrams to grasp the types, order, frequency, and changes in the parameters of the trigrams Generate and extract patterns that distinguish unnecessary actions (modules) in executing a module.

In this way, the CFG pattern extracting unit 120 calculates a sequence between modules by detecting various edges between the first module and the second module, and extracts a sequence pattern capable of grasping the order characteristics between the modules.

On the other hand, the sequence pattern-based anomaly is obtained according to the degree of following the discrete probability distribution in the inter-module trigram of the CFG modified as shown in Equation (1).

Here, '(T ₁ , ..., T _N )' denotes the modified trigram of the CFG, and 'P (X)' represents the previously generated discrete probability distribution function.

As described above, the measurement of the abnormality with respect to the sequence pattern has the following meaning.

That is, the sequence pattern makes it possible to identify the types of modules to be executed in the course of execution of the important modules, thereby discriminating the actions that are not necessary for the execution of the important modules.

In addition, the sequence pattern can pattern the order characteristics between the modules by bundling the three modules into one using the trigram.

Even in normal nodes, the connection between modules may involve other manipulated inputs / outputs. In such cases, it is difficult to detect through rule-based techniques. However, abnormalities can be detected through sequence patterns. have.

Next, the CFG pattern extracting unit 120 can extract a depth pattern indicating the number of nodes on the CFG between two important modules on various source code files. Here, the depth means the connection depth between the first module and the second module.

To this end, the CFG pattern extracting unit 120 calculates the depth between the important modules by recognizing the number of nodes passing through two important modules on various source code files. At this time, the CFG pattern extracting unit 120 forms the depth between the important modules as a table.

For example, referring to FIG. 7, when the depth of the first module 10 and the second module 20 of the B file is '5', the first modules A, B, C, D, A, B, C, and so on, and the first module 10 and the second module 20 of the B file have a depth of '4', the first module A, the second module B, the second module C, Module '. 7 is a view for explaining a process of extracting depths between important modules in a CFG.

Similarly, in the case where the depth of the first module 10 and the depth of the second module 20 of the A file is four, and the depth of the first module 10 and the depth of the second module 20 of the C file is four And the depth is " 5 ".

On the other hand, the depth pattern-based anomaly is obtained according to the degree of the inter-module depth of the modified CFG following the discrete probability distribution as shown in Equation 2 below.

Here, 'D' denotes the inter-module depth of the modified CFG, and 'P (X)' denotes the previously generated discrete probability distribution function.

Thus, measuring the anomalies for the depth pattern has the following significance.

In other words, the change in the length of the depth on the CFG means that there has been a change in the branch, such as an if statement. This indicates that problems such as bypassing the security procedure may occur. Such a change in the branch pattern can not be detected by detecting the abnormality of the above-described sequence pattern.

Therefore, measuring anomalies based on depth patterns can also detect undefined anomalies by learning the depth pattern itself without having to learn all the rules for the various bypass techniques.

As described above, the measurement of the sequence pattern and the depth pattern-based abnormality corresponds to the probability-based abnormality detection method that detects the procedure change using the discrete probability distribution.

In addition, the CFG pattern extracting unit 120 learns the range and position of input / output parameters (array, variable, memory, etc.) Extracts a range-position pattern indicating a change in the parameter pattern of the end.

The CFG pattern extracting unit 120 learns which module changes the parameter (array, variable, memory) commonly used in the first module and the second module and how the changed range of the changed module is. FIG. 8 is a view for explaining a process of learning a change position and a change range of input / output parameters, and FIG. 9 is a diagram illustrating a process result of learning a change point and a change range of input / output parameters.

8, when the CFG pattern extracting unit 120 starts learning about the input / output parameters (S11), the CFG pattern extracting unit 120 extracts common parameters (for example, global variables) of the first module and the second module Etc.) (S12).

Thereafter, the CFG pattern extracting unit 120 performs purging input for the first module (S13), and recognizes the parameter change position and the change range by executing the next module (S14, S15, S17). At this time, when the parameter changing position is confirmed (S15), the CFG pattern extracting unit 120 stores the corresponding module in a table and patternizes the table (S16).

If the parameter changing position is not confirmed (S15) and the parameter changing range is confirmed (S17), the CFG pattern extracting unit 120 adjusts the parameter changing range to pattern (S18).

Thereafter, the CFG pattern extracting unit 120 performs step S13 or step S14 again (step S19) by checking whether the CFG pattern arrives at the second module.

9 is a diagram illustrating a case where learning is performed on parameters (array, variable, memory) commonly used in the first module 10 and the second module 20 in which modules are changed and how the changed modules are changed . Here, the memory is changed in the B module and the E module, the arrangement is changed in the C module, and the variables are changed in the A module and the B module. It monitors whether an array or memory reference location is manipulated in the wrong module (executed by an internal or malicious code).

As such, detecting anomalies for the range-position pattern has the following significance.

If you manipulate the input parameters properly without changing the algorithm, you may get unexpected results.

Therefore, it is necessary to manage parameters in order to monitor software procedure changes. This is to judge that there is possibility of manipulation by the insider (or malicious code) when the change position of the parameter and the range of change are different from the learned in real-time monitoring.

In other words, detecting anomalies for a range-position pattern is meaningful for detecting and monitoring illegal manipulations of parameters, even if the algorithm itself is unchanged.

As described above, the CFG pattern extracting unit 120 not only can measure the abnormality by extracting the sequence pattern and the depth pattern, but also can detect the abnormality with respect to the range-position pattern. It is possible to apply it as an application.

3, the dynamic tracking unit 130 may measure abnormality based on the sequence pattern or the depth pattern with respect to the source code of the software, or may measure the abnormality based on the range- The software procedure changes can be detected dynamically.

The dynamic tracking unit 130 measures the degree of abnormality according to the degree of discrete probability distribution of the modified CFG trigram to detect the abnormality of the sequence pattern.

In addition, the dynamic tracking unit 130 measures the degree of abnormality according to the degree of the inter-module depth of the modified CFG following the discrete probability distribution, and detects the degree of abnormality of the depth pattern. At this time, the dynamic tracking unit 130 detects the degree of abnormality of the depth pattern that detects the change of the algorithm structure by the branch statement.

Also, the dynamic tracking unit 130 checks the valid values of the input / output parameters for the parameters (array, variable, memory) commonly used in the important module and detects the operation on the changed position and the changed range.

10 is a diagram showing an example of logical error monitoring of software.

The SW procedure change operation monitoring apparatus 100 can be used for a security check for logical error detection as well as a coverage check of various software because simple source code can be abstracted. Here, the coverage test is one of techniques for checking the quality of software, and is used to detect grammatical errors or unused codes of codes.

Referring to FIG. 10, the SW procedure change operation monitoring apparatus 100 may monitor logical errors of various cases between the first module 10 and the second module 20 to display static and dynamic analysis results.

11 is a diagram illustrating a pattern-based software procedure change operation monitoring method using a CFG according to an embodiment of the present invention.

The SW procedure change operation monitoring apparatus 100 selects the important modules (i.e., the first module and the second module) on the source code of the software (S101). At this time, the SW procedure change operation monitoring apparatus 100 sets up the first module and the second module according to the line / after relation in which the important modules are consecutive on the important module (S102).

Then, the SW procedure change operation monitoring apparatus 100 extracts the CFG from the source code of the software, and then generates and extracts the sequence pattern, the depth pattern, and the range-position pattern through the abstracting of the extracted CFG (S103). At this time, the SW procedure change operation monitoring apparatus 100 checks whether there is a modification of the source code (S104), detects an abnormality degree of the sequence pattern (S105), detects an abnormality degree of the depth pattern (S106) An operation on the change position and the change range of the input / output parameters is detected (S107).

The method according to some embodiments may be implemented in the form of program instructions that can be executed through various computer means and recorded on a computer readable medium. The computer-readable medium may include program instructions, data files, data structures, and the like, alone or in combination. The program instructions recorded on the medium may be those specially designed and constructed for the present invention or may be available to those skilled in the art of computer software. Examples of computer-readable media include magnetic media such as hard disks, floppy disks and magnetic tape, optical media such as CDROMs, DVDs, magneto-optical media such as floptical disks, Magneto-optical media, and hardware devices specifically configured to store and perform program instructions such as ROM, RAM, flash memory, and the like. Examples of program instructions include machine language code such as those produced by a compiler, as well as high-level language code that can be executed by a computer using an interpreter or the like.

Although the foregoing is directed to novel features of the present invention that are applicable to various embodiments, those skilled in the art will appreciate that the apparatus and method described above, without departing from the scope of the present invention, It will be understood that various deletions, substitutions, and alterations can be made in form and detail without departing from the spirit and scope of the invention. Accordingly, the scope of the present invention is defined by the appended claims rather than the foregoing description. All variations within the scope of the appended claims are embraced within the scope of the present invention.

110: Logical module flow selection section
120: CFG pattern extracting unit
130: Dynamic tracking unit

Claims (19)

A logical module flow selection module for classifying each module according to a sequential relation of important modules in a CFG (Control Flow Graph) for a software source code;
A sequence pattern, a depth pattern, and a range-position pattern are generated and abstracted through an abstraction according to the purging probability of the purging test for each module and the transition probability distribution of each module A CFG pattern extracting unit; And
A dynamic tracking unit for measuring or detecting an abnormality according to a procedure change of the source code of the software using the sequence pattern, the depth pattern, and the range-position pattern;
A pattern-based software procedure change operation monitoring device using a CFG.
The method according to claim 1,
Wherein the logical module flow selection unit comprises:
And a CFG for distinguishing the first module and the second module as the logical functional units according to the successive relation of the important modules.
3. The method of claim 2,
Wherein the CFG pattern extracting unit comprises:
A transition probability distribution for each module is calculated with respect to the result of the purging test for the modules between the first module and the second module, a module having a high probability is selected from the branching module, A pattern - based software procedure change operation monitoring device using CFG that omits modules with exception handling and exit code among the branching modules.
3. The method of claim 2,
Wherein the CFG pattern extracting unit comprises:
A clustering process of generating predetermined nodes in a bundle using trigrams of modules between the first module and the second module is performed and a discrete probability distribution for all trigrams is calculated to calculate the sequence pattern Pattern - based software procedure change operation monitoring using CFG generating.
3. The method of claim 2,
Wherein the CFG pattern extracting unit comprises:
A pattern-based software procedure change operation monitoring apparatus using a CFG that generates depth patterns by grasping connection depths indicating the number of nodes on the CFG between the first module and the second module on various source code files.
3. The method of claim 2,
Wherein the CFG pattern extracting unit comprises:
And a pattern-based software procedure change operation monitoring unit that uses the CFG to generate the range-position pattern by learning about a change position and a change range of input / output parameters commonly used in the first module and the second module.
The method according to claim 6,
The parameter is a pattern-based software procedure change operation monitoring device using an array, a variable, and a CFG that is a memory.
5. The method of claim 4,
Wherein the dynamic tracking unit comprises:
And a pattern-based software procedure change operation monitoring unit that uses CFG to measure the degree of abnormality of the sequence pattern following the discrete probability distribution of the modified CFG trigram.
6. The method of claim 5,
Wherein the dynamic tracking unit comprises:
A pattern-based software procedure change operation monitoring apparatus using a CFG that measures the degree of abnormality of the depth pattern and measures the degree of inter-module depth of a corrected CFG following a discrete probability distribution.
The method according to claim 6,
Wherein the dynamic tracking unit comprises:
A pattern-based software procedure change using a CFG that detects validate values for input / output parameters for input / output parameters commonly used in the first module and the second module and detects an operation on a change location and a change range Motion monitoring device.
A step of classifying each module according to a sequential relation of successive important modules in a CFG (Control Flow Graph) of a software source code;
A sequence pattern, a depth pattern, and a range-position pattern are generated and abstracted through an abstraction according to the purging probability of the purging test for each of the above-identified modules and the transition probability distribution of each module step; And
Measuring or detecting an abnormality according to a procedure change of the source code of the software using the sequence pattern, the depth pattern, and the range-position pattern as confirming the modification to the source code of the software;
A method for monitoring a pattern-based software procedure change operation using a CFG.
12. The method of claim 11,
Wherein,
A pattern-based software procedure change operation monitoring method using a CFG that distinguishes a first module and a second module as a logical functional unit according to a sequential relation of the important modules.
13. The method of claim 12,
Wherein the generating and extracting comprises:
A transition probability distribution for each module is calculated with respect to the result of the purging test for the modules between the first module and the second module, a module having a high probability is selected from the branching module, A pattern-based software procedure change operation monitoring method using a CFG that omits a module having an exception processing and an ending code implemented in a branch module.
13. The method of claim 12,
Wherein the generating and extracting comprises:
A clustering process of generating predetermined nodes in a bundle in a trigram scheme for modules between the first module and the second module is performed and a discrete probability distribution for all trigrams is calculated to generate the sequence pattern Pattern - Based Software Procedure Change Behavior Monitoring Using CFG.
13. The method of claim 12,
Wherein the generating and extracting comprises:
A method of monitoring a pattern-based software procedure change operation using a CFG that grasps connection depths indicating the number of nodes on the CFG between the first module and the second module on various source code files to generate the depth pattern.
13. The method of claim 12,
Wherein the generating and extracting comprises:
Based on the pattern-based software procedure change operation using the CFG to generate the range-position pattern by learning about a change position and a change range of input / output parameters commonly used in the first module and the second module.
15. The method of claim 14,
Wherein the measuring or detecting step comprises:
And a pattern-based software procedure change operation monitoring method using a CFG that measures the degree of abnormality of the sequence pattern following the discrete probability distribution of the modified CFG trigram.
16. The method of claim 15,
Wherein the measuring or detecting step comprises:
A method for monitoring a software procedure change operation based on a pattern using a CFG that measures the extent of inter-module depth of a modified CFG following the discrete probability distribution.
17. The method of claim 16,
Wherein the measuring or detecting step comprises:
A pattern-based software procedure change using a CFG that detects validate values for input / output parameters for input / output parameters commonly used in the first module and the second module and detects an operation on a change location and a change range Motion monitoring method.

Images