Mthod Of Tracing Abnormal Behavior Based On Software Function Layer

In recent years, the software and its operating environment had undergone aqualitative change. These changes include software’s opening to external environment,the increasing complexity of software architecture, dynamic changing of softwareapplication technology etc. These changes bring many new problems to the softwarecredibility, and software incredibility also causes a huge impact to the modern humanlife. The credibility of software behavior is an important way to achieve softwarecredibility. Therefore, it is an important and urgent task to enhance the credibility ofsoftware behavior. In order to enhance the software behavior credibility, we propose aSSDB (software system behavior transition diagram based on function layer) model.SSDB model is a structure which can establish a behavior transformation diagram fora software. Transformation diagram based on this structure can detect and trace theabnormal behavior. In this paper, the main research work is as follows:Firstly, this paper analyzes the importance of the software expected behaviormodeling for enhancing the software behavior credibility. This paper summarizes andanalyzes methods of software behavior modeling. Then, it shows their advantages anddisadvantages. After analyzing the modeling method, it is found that most existingmodeling methods of software behavior only consider whether this model caneffectively detect the abnormal behavior or not, while how to deal with these detectedabnormal behaviors is lack of effective methods. Although these unhandled exceptionbehavior is detected, but still left behind potential dangers for the security of thesoftware. Therefore, the enhancement of software behavior credibility is not only tofind out the software abnormal behavior, but also solve these abnormal behaviorsprimarily, so as to more effectively enhance the software reliability. Based on this idea,this paper puts forward a kind of new model which could enhance the softwarecredibility more effectively. In order to achieve the purpose of enhancing the softwarecredibility, the main purpose of the new model is locate the abnormal behaviorposition in the source code. In order to achieve this goal, this paper presents a newmodel SSDB which combining the static behavior with dynamic behavior based onthe software function layer. The software behavior transition diagram which based onthe SSDB model can effectively find out the software abnormal behaviors and couldlocate the software abnormal behavior in software source code. And, the location ofabnormal behavior code block has provided a possibility to solve the abnormalbehavior, while it also enhances the credibility of software behavior.Then, this paper presents a SSDB model by the combination of static anddynamic which based on the software function layer. The principle of SSDB model ismonitors and detects the software behaviors by the software dynamic behavior features. Then, this model could locate the software static behavior feature (relevantcode block) of abnormal behavior in the source code. In order to achieve this locating,this model connects the dynamic behavior feature and static behavior feature with thesoftware function layer of the program interface. In this method, we use three kinds ofbehavior characteristics of a behavior to express a software behavior. The softwaredynamic behavior is the state sequences which were captured at runtime. The directlycaptured sequence at runtime should be the system call sequence. The system callsequence need to be transformed into the state sequence by the state layer derivationmethod. Software static behavior feature is the code block of the source code.Software static source code require the open source of tested software. On the basis ofsoftware static source code, we could achieve a program slice of software abnormalbehavior. So that, we could locate the related code block in the source code ofsoftware abnormal behavior with the program slicing algorithm. SSDB model isactually express a software behavior by three different behavior characteristics andrecord the all the software behavior conversion.Finally, this paper presents a two layer detection method, this method is based onthe SSDB model, and can achieve tracing of unusual behavior of software. In thispaper, we detect software abnormal behavior on the basis of software functiontransition diagram. If there is a different node, path or the weight of the pathcompared to the software function diagram. Then, we can determine that an abnormalbehavior has occurred in this software. The tracing of abnormal behaviors depend onthe program slicing technology. Program slicing is a program analysis technique thatcan find all relevant statement of a discovered problem. Program slicing technique ismainly used after find out the software abnormal behavior. Program slicing dependson the criterion of program slicing. The detection methods and tracing methods notonly detect abnormal behavior more precisely, but also could locate the abnormalbehavior more accurately. It offers the possibility to slove the abnormal behaviorcompletely and enhance the software behavior credibility.