International Business Machines Corporation

Rachel E Craik

Allan Henry Kielstra

Andrew James Craik

Patrick R Doyle

Melanie Ullmer

Ying Chau Raymond Mak

Raymond Mak

Techniques are described for detecting anomalous behavior in program execution. In one example, a method includes logging occurrence of one or more key run time events during execution of a program. Each key run time event has a corresponding key run time event data structure associated with the program, and logging includes storing records associated with the key run time events, wherein each record is based on the key run time event data structure associated with the key run time event. The method further includes analyzing the records to determine if a current pattern of key run time events associated with the program during execution matches an expected pattern of key run time events and generating a security alert if the current pattern of key run time events does not match the expected pattern of key run time events for the program.

Detecting anomalies in program execution

Techniques are described for detecting anomalous behavior in program execution. In one example, a method includes logging occurrence of one or more key events during execution of a program. Each key event has a corresponding key event data structure associated with the program, and logging includes storing records associated with the key events, wherein each record is based on the key event data structure associated with the key event. The method further includes analyzing the records to determine if a current pattern of key events associated with the program during execution matches an expected pattern of key events and generating a security alert if the current pattern of key events does not match the expected pattern of key events for the program.

A method for expanding inline function calls in inlining scenarios includes receiving an ordered list of inlining options for a computer program and a relational data structure representing dependencies between the inlining options, wherein each inlining option includes an associated cost value and an associated benefit value. A maximum-benefit inlining plan for a selected inlining option of the ordered list is then determined, wherein the maximum-benefit inlining plan includes a set of inlining options from the ordered list that provide a maximum combined benefit value for a combined cost value that is equal to or less than a maximum cost budget, subject to the following conditions: each inlining option of the set precedes, or is, the selected inlining option in the ordered list, and for each inlining option of the set, the set also includes each inlining option that the respective inlining option is dependent on.

Growing community of inventors

North York, Canada

Rachel E Craik