TWI789075B - Electronic device and method for detecting abnormal execution of application program - Google Patents

Abstract

An electronic device and a method for detecting abnormal execution of an application program are provided. The method includes: receiving an execution record of the application program executed by a client-electronic-device, wherein the execution record includes a plurality of application program execution times respectively corresponding to a plurality of execution time points; using the plurality of application program execution times to calculate an execution count threshold value, and using the plurality of application program execution times to determine whether to adopt the execution count threshold value; in response to deciding to adopt the execution count threshold value, using the plurality of application program execution times and the execution count threshold value to determine an execution status of the application at the plurality of execution time points; and in response to determining the execution status is an abnormal state, issuing an exception notification corresponding to the application.

Description

Electronic device and method for detecting abnormal execution of application programs

The invention relates to an electronic device and method for detecting abnormal execution of application programs.

Detecting abnormal usage behavior of applications is usually time-consuming and labor-intensive. In addition, even if the administrator of the application program obtains the execution record of the application program, there is still no efficient way to determine whether the application program is running abnormally. Therefore, it is necessary to provide an improved electronic device and method for detecting abnormal execution of application programs.

The invention provides an electronic device and method for detecting abnormal execution of application programs, which can improve the efficiency of managers in detecting abnormal execution of application programs.

The electronic device for detecting abnormal execution of application programs of the present invention includes a storage medium, a transceiver and a processor. The storage medium stores multiple modules. The processor is coupled to the storage medium and the transceiver, and accesses and executes multiple modules, wherein the multiple modules include an execution record receiving module, an execution times threshold calculation and determination module, an execution status determination module, and an execution status Report mods. The execution record receiving module receives the execution record of the application program executed by the user terminal electronic device through the transceiver, wherein the execution record includes multiple execution times of the application program respectively corresponding to multiple execution time points. The execution times threshold calculation and determination module uses the execution times of multiple applications to calculate the execution times threshold, and uses the execution times of multiple applications to determine whether to adopt the execution times threshold. The execution state judgment module determines the execution state of the application program at multiple execution time points by using multiple application program execution times and execution number thresholds in response to the execution count threshold calculation and determination module deciding to adopt the execution count threshold. The execution status report module sends an exception notification corresponding to the application program through the transceiver in response to the execution status judging module determining that the execution status is an abnormal state.

The method for detecting the abnormal execution of the application program of the present invention includes: receiving the execution record of the application program executed by the electronic device at the client end, wherein the execution record includes multiple execution times of the application program respectively corresponding to multiple execution time points; Calculating the threshold value of the number of execution times of the application program, and using the execution times of multiple applications to determine whether to use the threshold value of the number of execution times; in response to determining the threshold value of the number of execution times, using the number of execution times of multiple applications and the threshold value of the number of execution times to determine the application program execution status at multiple execution time points; and sending an exception notification corresponding to the application program in response to determining that the execution status is an abnormal state.

Based on the above, the electronic device and method for detecting abnormal execution of an application program of the present invention can be calculated by using the number of execution times of the application program at (different) execution time points and the threshold value calculation adjustment value of the number of execution times set by the administrator Execution times threshold. In addition, it may also be determined whether to adopt the calculated execution times threshold (for example, using the maximum and minimum values of the application program execution times to assist the judgment). Based on this, the execution status of the application program can be judged by using a more appropriate threshold value of execution times that is more in line with the requirements of the administrator, thereby improving the efficiency of the administrator in detecting abnormal execution of the application program.

FIG. 1 is a schematic diagram of an electronic device 100 for detecting abnormal execution of an application program according to an embodiment of the present invention. The electronic device 100 may include a storage medium 110 , a transceiver 120 and a processor 130 . In an embodiment, the electronic device 100 may further include an input and output device 140 .

The storage medium 110 is, for example, any type of fixed or removable random access memory (random access memory, RAM), read-only memory (read-only memory, ROM), flash memory (flash memory) , hard disk drive (hard disk drive, HDD), solid state drive (solid state drive, SSD) or similar components or a combination of the above components, and are used to store multiple modules or various application programs executable by the processor 130 . In this embodiment, the storage medium 110 can store a plurality of modules including an execution record receiving module 111 , an execution times threshold calculation and determination module 112 , an execution status determination module 113 , and an execution status reporting module 114 . The functions of these modules will be explained later.

The transceiver 120 transmits and receives signals in a wireless or wired manner.

The processor 130 is, for example, a central processing unit (central processing unit, CPU), or other programmable general purpose or special purpose micro control unit (micro control unit, MCU), microprocessor (microprocessor), digital signal processing Digital signal processor (DSP), programmable controller, application specific integrated circuit (ASIC), graphics processing unit (graphics processing unit, GPU), image signal processor (image signal processor, ISP) ), image processing unit (image processing unit, IPU), arithmetic logic unit (arithmetic logic unit, ALU), complex programmable logic device (complex programmable logic device, CPLD), field programmable logic gate array (field programmable gate array , FPGA) or other similar components or combinations of the above components. The processor 130 can be coupled to the storage medium 110 , the transceiver 120 and the input/output device 140 , and access and execute multiple modules and various application programs stored in the storage medium 110 .

The I/O device 140 is coupled to the processor 130 and used for transmitting signals. For example, the processor 130 can receive input signals or transmit output signals through the input and output device 140 . For example, the input/output device 140 may include various input/output devices such as a mouse, a keyboard, a screen, a touch panel, and/or a speaker.

In this embodiment, the execution record receiving module 111 can receive the execution record of the application program executed by the client electronic device through the transceiver 120, wherein the execution record can include multiple execution times of the application program respectively corresponding to multiple execution time points . The application program in this embodiment is, for example, software or an execution program executed by the user terminal electronic device.

Next, the execution times threshold calculation and determination module 112 can calculate the execution times threshold by using the execution times of a plurality of application programs. This will be further explained below.

In an embodiment, the plurality of execution time points may include a plurality of current execution time points, and the plurality of application execution times may include a plurality of current application execution times respectively corresponding to the plurality of current execution time points.

Table 1 is an example of multiple current application program execution times respectively corresponding to multiple current execution time points (that is, time point 1, ... until time point 4) (in the example of Table 1, the application at time point 2 Program P is not executed). Table 1 execution time Execution times of application P time point 1 1 time time point 3 5 times time point 4 2 times

The execution times threshold calculation and determination module 112 can calculate the execution times threshold by using a plurality of current application execution times. For example, the execution count threshold calculation and determination module 112 may use the maximum value among the execution counts of each current application program in Table 1 as the execution count threshold, but the present invention is not limited thereto.

In an embodiment, the execution times threshold may include an execution times upper threshold and an execution times lower threshold.

In one embodiment, in order to make the threshold value of the number of executions more in line with the needs of the management personnel of the electronic device 100, the management personnel of the electronic device 100 can input the adjustment values C1 and C2 for calculating the threshold value of the number of executions through the input and output device 140 (in other words, execute The times threshold calculation and determination module 112 can receive the execution times threshold calculation adjustment values C1 and C2 through the input and output device 140 . Next, the execution times threshold calculation and determination module 112 can use a plurality of current application execution times and the execution times thresholds to calculate the adjustment values C1 and C2. For example, the execution times threshold calculation and determination module 112 can calculate the execution times threshold according to the following formula 1 and formula 2. THRESHOLD(UPPER-BOUND) = MEAN( COUNT(S) ) + C1 * STD( COUNT(S) ) … (Formula 1) THRESHOLD(LOWER-BOUND) = MEAN( COUNT(S) ) + C2 * STD( COUNT(S) ) … (Formula 2) Where S is the current execution time point (that is, time point 1, ... until time point 4 in Table 1), COUNT(1) is the number of application execution times at time point 1, ... until COUNT(4) is the application at time point 4 The number of program execution times, MEAN(COUNT(S)) is the average value of COUNT(1), ... until COUNT(4), C1 and C2 are the adjustment values for calculating the threshold value of execution times, STD(COUNT(S)) is COUNT(1 )... until the standard deviation of COUNT(4), THRESHOLD (UPPER-BOUND) is the upper threshold of execution times, and THRESHOLD (LOWER-BOUND) is the lower threshold of execution times.

The execution times threshold calculation and decision module 112 can use Table 1 and formula 1 to obtain MEAN( COUNT(S) ) as 2.66 and STD( COUNT(S) ) as 2.08, and assume that the execution times threshold calculation and decision module 112 The execution times threshold calculation adjustment value C1 received by the input and output device 140 is 1, and the execution times threshold calculation and determination module 112 can use Formula 1 to calculate the execution times upper threshold value as 4.74 times.

In addition, assuming that the execution count threshold calculation and determination module 112 receives the execution count threshold calculation adjustment value C2 through the input and output device 140 as 0.5, the execution count threshold calculation and determination module 112 can use formula 2 and the above-mentioned MEAN( COUNT(S) ) and STD( COUNT(S) ) calculate the lower threshold of execution times to be 3.70 times.

In an embodiment, the plurality of execution time points may further include a plurality of historical execution time points, and the plurality of application program execution times may further include a plurality of historical application program execution times respectively corresponding to the plurality of historical execution time points.

Table 2 is the execution times of multiple historical application programs corresponding to multiple historical execution time points (here, it is assumed that the historical execution time points are time point 1, ... until time point 4), and respectively corresponding to multiple current execution time points (It is assumed here that the current execution time point is time point 5, ... time point 9) an example of multiple current application program execution times (in the example in Table 2, at time point 2 and time point 8, the application program P and not implemented). In other words, the execution record receiving module 111 can first obtain the execution times of the application program P from the time point 1, ... until the time point 4, and then obtain the execution times of the application program P from the time point 5, ... until the time point 9, so as to obtain the table 2 shows the execution record. Table 2 execution time Execution times of application P time point 1 1 time time point 3 5 times time point 4 2 times time point 5 1 time time point 6 1 time time point 7 3 times time point 9 1 time

The execution count threshold calculation and determination module 112 can use multiple current application execution counts, the execution count threshold calculation adjustment value, and multiple historical application execution counts to calculate the execution count threshold. For example, the execution count threshold calculation and determination module 112 can use the following formula 3 and formula 4 to calculate the execution count threshold. THRESHOLD(UPPER-BOUND) = MEAN( COUNT(U) ) + C1 * STD( COUNT(U) ) … (Formula 3) THRESHOLD(LOWER-BOUND) = MEAN( COUNT(U) ) + C2 * STD( COUNT(U) ) … (Formula 4) Where U is the historical execution time point (i.e. time point 1, ... until time point 4 in Table 2) and the current execution time point (i.e. time point 5, ... time point 9 in Table 2), COUNT(1) is the time The number of application execution times at point 1, ... until COUNT(9) is the number of application execution times at time point 9, MEAN(COUNT(U)) is the average of COUNT(1), COUNT(2), ... until COUNT(9) value, C1 and C2 are the adjustment values for calculating the execution times threshold, STD(COUNT(U)) is the standard deviation from COUNT(1), COUNT(2), ... until COUNT(9), THRESHOLD(UPPER-BOUND) is the execution The upper limit threshold of the number of times, THRESHOLD (LOWER-BOUND) is the lower limit threshold of the number of executions.

The execution times threshold calculation and decision module 112 can use Table 2 and formula 3 to obtain MEAN( COUNT(U) ) as 2.0 and STD( COUNT(U) ) as 1.52, and assume that the execution times threshold calculation and decision module 112 The execution times threshold calculation adjustment value C1 received by the input and output device 140 is 1, and the execution times threshold calculation and determination module 112 can calculate the execution times upper limit threshold value as 3.52 times using Formula 3.

In addition, assuming that the execution count threshold calculation and determination module 112 receives the execution count threshold calculation adjustment value C2 through the input and output device 140 as 0.5, the execution count threshold calculation and determination module 112 can use formula 4 and the above-mentioned MEAN( COUNT(U) ) and STD( COUNT(U) ) calculate the execution times lower limit threshold value is 2.76 times.

After the execution times threshold is calculated, the execution times threshold calculation and determination module 112 can use the execution times of a plurality of application programs to determine whether to adopt the execution times threshold.

In one embodiment, the execution count threshold calculation and determination module 112 can determine whether the execution count upper limit threshold is smaller than the maximum value among the execution counts of multiple application programs. In response to the execution times upper threshold being smaller than the maximum number of execution times of the plurality of application programs, the execution times threshold calculation and determination module 112 may determine to adopt the execution times upper threshold. After determining to adopt the upper threshold value of execution times, the execution times threshold calculation and determination module 112 may store the upper threshold value of execution times in the storage medium 110 .

In addition, the execution times threshold calculation and determination module 112 can determine whether the execution times lower limit threshold is greater than the minimum value among the execution times of multiple application programs. In response to the execution times lower limit threshold being greater than the minimum value among the execution times of multiple application programs, the execution times threshold calculation and determination module 112 may determine to adopt the execution times lower limit threshold. After determining to adopt the execution times lower limit threshold, the execution times threshold calculation and determination module 112 may store the execution times lower limit threshold in the storage medium 110 .

For example, in the above-mentioned embodiment of Table 2 (and Formula 3 and Formula 4), since the upper threshold value of the number of execution times calculated by using Formula 3 is 3.52 times, it is smaller than the maximum value (5 times), the execution times threshold calculation and determination module 112 may decide to adopt this execution times upper limit threshold.

In addition, since the execution times threshold value 2.76 times calculated by formula 4 is greater than the minimum value (1 time) among the execution times of each application program in Table 2, the execution times threshold calculation and determination module 112 can decide to adopt this execution times Lower threshold value.

On the other hand, if the execution times upper limit threshold is greater than the maximum execution times of multiple application programs, the execution times threshold calculation and determination module 112 may decide not to use the execution times upper limit threshold.

In addition, if the execution times lower limit threshold is smaller than the minimum value among the execution times of multiple application programs, the execution times threshold calculation and determination module 112 may decide not to use the execution times lower limit threshold.

In other words, in the above-mentioned embodiment of Table 2, if the execution times threshold calculation and decision module 112 decides not to use the execution times upper limit threshold, or decides not to use the execution times lower limit threshold, the execution times threshold calculation and decision module 112 The upper threshold value of execution times and the lower threshold value of execution times calculated by using Table 2 and formulas 3 and 4 can be deleted. After the pending execution record receiving module 111 subsequently receives the number of executions of the application program (at a subsequent point in time), the execution times threshold calculation and determination module 112 can use the method described in the previous embodiment to calculate the upper limit threshold value of the execution times again And the lower limit threshold of execution times. For example, the calculation and determination module 112 of the threshold value of execution times can take the subsequent received time point 10, ... until time point 12 as the current time point, and use the time point 1, ... until time point 9 shown in Table 2 as is the historical time point, and using the current application program execution times corresponding to time point 10, ... until time point 12, and the historical application program execution times corresponding to time point 1, ... until time point 9 shown in Table 2, To calculate the upper limit threshold value of execution times and the lower limit threshold value of execution times.

In response to the execution times threshold calculation and determination module 112 deciding to use the execution times threshold, the execution state determination module 113 can use multiple application program execution times and execution frequency thresholds to determine the execution status of the application program at multiple execution time points . For example, if the application execution times of the specific application P at the specific execution time point is greater than the lower limit threshold value of the execution times, the execution state determining module 113 may determine that the execution state of the application program P at the specific execution time point is abnormal.

In response to the execution status judging module 113 determining that the execution status is an abnormal status, the execution status reporting module 114 can issue an abnormal notification (eg, warning or alarm) corresponding to the application through the transceiver 120 . For example, if the number of execution times of the application program P at a specific execution time point is greater than the lower threshold of execution times, the execution status reporting module 114 can issue an early warning through the transceiver 120 . If the application execution times of the specific application P at a specific execution time point are greater than the upper threshold of execution times, the execution status reporting module 114 can send an alarm through the transceiver 120 .

FIG. 2 is a flowchart illustrating a method for detecting abnormal execution of an application program according to an embodiment of the present invention, wherein the method can be implemented by the electronic device 100 . In step S201, an execution record of an application program executed by the user terminal electronic device is received, wherein the execution record includes a plurality of execution times of the application program respectively corresponding to a plurality of execution time points. In step S202, a threshold value of execution times is calculated by using a plurality of execution times of application programs, and whether to adopt the threshold value of execution times is determined by using a plurality of execution times of application programs. In step S203 , in response to determining to use the execution times threshold, a plurality of application program execution times and execution times thresholds are used to determine the execution status of the application program at multiple execution time points. In step S204, an exception notification corresponding to the application is issued in response to determining that the execution state is an abnormal state.

In summary, the electronic device and method for detecting abnormal execution of an application program of the present invention can use the number of execution times of the application program at (different) execution time points and the threshold value of the number of execution times set by the administrator to calculate the adjustment value To calculate the threshold of execution times. In addition, it may also be determined whether to adopt the calculated execution times threshold (for example, using the maximum and minimum values of the application program execution times to assist the judgment). Based on this, the execution status of the application program can be judged by using a more appropriate threshold value of execution times that is more in line with the requirements of the administrator, thereby improving the efficiency of the administrator in detecting abnormal execution of the application program.

100: Electronic device for detecting abnormal execution of application programs 110: storage media 111: Execution record receiving module 112: Execution times threshold calculation and decision module 113: Execution status judgment module 114: Execution status report module 120: Transceiver 130: Processor 140: Input and output device S201~S204: steps

FIG. 1 is a schematic diagram of an electronic device for detecting abnormal execution of an application program according to an embodiment of the present invention. FIG. 2 is a flowchart illustrating a method for detecting abnormal execution of an application program according to an embodiment of the present invention.

S201~S204: steps

Claims (10)

An electronic device for detecting abnormal execution of an application program, comprising: Storage media, storing multiple modules; transceivers; and A processor, coupled to the storage medium and the transceiver, and accessing and executing the multiple modules, wherein the multiple modules include: The execution record receiving module receives, through the transceiver, the execution record of the application program executed by the electronic device at the user end, wherein the execution record includes a plurality of execution times of the application program respectively corresponding to a plurality of execution time points; The execution times threshold calculation and determination module uses the execution times of the multiple applications to calculate the execution times threshold, and uses the execution times of the multiple applications to determine whether to adopt the execution times threshold; The execution state determination module, in response to the execution times threshold calculation and determination module deciding to adopt the execution times threshold, and using the execution times of the multiple applications and the execution times threshold to determine whether the application is in Execution status at the plurality of execution time points; and The execution status report module sends an exception notification corresponding to the application program through the transceiver in response to the execution status judging module determining that the execution status is an abnormal status. The electronic device for detecting abnormal execution of an application program as described in claim 1, wherein the multiple execution time points include multiple current execution time points, and the multiple application program execution times include corresponding to the multiple Multiple current application execution times at the current execution time point, where The execution times threshold calculation and determination module calculates the execution times threshold by using the execution times of the plurality of current application programs. The electronic device for detecting abnormal execution of an application program as described in claim 2 further includes an input and output device coupled to the processor, wherein The execution times threshold calculation and determination module receives an execution times threshold calculation adjustment value through the input and output device; The execution times threshold calculation and determination module calculates the execution times threshold by using the plurality of current application execution times and the execution times threshold calculation adjustment value. The electronic device for detecting abnormal execution of application programs as described in claim 3, wherein the multiple execution time points further include multiple historical execution time points, and the multiple execution times of application programs further include corresponding to the Multiple historical application execution times at multiple historical execution time points, where The execution times threshold calculation and determination module calculates the execution times threshold by using the plurality of current application execution times, the execution times threshold calculation adjustment value and the plurality of historical application execution times. The electronic device for detecting abnormal execution of an application program as described in claim 1, wherein the execution times threshold includes an execution times upper threshold and an execution times lower threshold, wherein: In response to the execution times upper threshold being smaller than the maximum number of execution times of the plurality of application programs, the execution times threshold calculation and determination module decides to adopt the execution times upper threshold; In response to the execution times lower limit threshold being greater than the minimum value among the multiple application program execution times, the execution times threshold calculation and decision module decides to adopt the execution times lower limit threshold. A method for detecting abnormal execution of an application program, comprising: receiving an execution record of the application program executed by the client electronic device, wherein the execution record includes a plurality of execution times of the application program respectively corresponding to a plurality of execution time points; Using the execution times of the multiple applications to calculate the threshold of execution times, and using the execution times of the multiple applications to determine whether to adopt the threshold of execution times; Determining the execution status of the application program at the plurality of execution time points by using the execution times of the plurality of application programs and the threshold value of the execution times in response to determining to adopt the threshold value of execution times; and An exception notification corresponding to the application is issued in response to determining that the execution state is an abnormal state. The method for detecting abnormal execution of an application program as described in claim 6, wherein the plurality of execution time points include a plurality of current execution time points, and the plurality of execution times of the application program include corresponding to the plurality of Execution times of multiple current application programs at the current execution time point, wherein the step of calculating the threshold value of execution times by using the multiple execution times of application programs includes: The threshold value of execution times is calculated by using the plurality of execution times of current application programs. The method for detecting abnormal execution of an application program as described in claim 7, wherein the step of calculating the threshold value of the number of execution times by using the execution times of the plurality of application programs further includes: Receive the adjustment value of the execution times threshold calculation; The execution times threshold is calculated by using the plurality of current application execution times and the execution times threshold calculation adjustment value. The method for detecting abnormal execution of an application program as described in claim 8, wherein the plurality of execution time points further include a plurality of historical execution time points, and the plurality of execution times of the application program further include corresponding to the Multiple historical application program execution times at multiple historical execution time points, wherein the step of using the multiple application program execution times to calculate the threshold value of the execution times further includes: The execution times threshold is calculated by using the plurality of current application execution times, the execution times threshold calculation adjustment value, and the plurality of historical application execution times. The method for detecting abnormal execution of an application program as described in claim 6, wherein the execution times threshold value includes an execution times upper limit threshold value and an execution times lower limit threshold value, wherein the plurality of application program execution times are used to determine whether to use The step of performing the threshold value of times includes: In response to the execution times upper limit threshold being smaller than the maximum value among the plurality of application program execution times, the execution times threshold calculation and determination module decides to adopt the execution times upper limit threshold; In response to the execution times lower limit threshold being greater than the minimum value among the multiple application program execution times, the execution times threshold calculation and decision module decides to adopt the execution times lower limit threshold.

Images