Abstract: A software behavior modeling device which forms a model of a behavior of software includes; an event information acquisition unit configured to acquire event information indicating a specific event which occurs during execution of the software; a stack information acquisition unit configured to acquire stack information stored in a call stack at a time of occurrence of the specific event; a score setting unit configured to set a score in accordance with a storage location in which each element included in the stack information is stored in the call stack; and a model generating unit configured to form a model of a relationship between the specific event and the element by using the score, and to generate a behavior model of the software.

Abstract: A software behavior modeling apparatus includes: a stack information recording unit, a termination information recording unit, a stack difference information generating unit configured to generate, as stack difference information, information formed by combining information being located from an uppermost stack frame until the termination information is detected, by using the termination information recorded by the termination information recording unit, and a model generating unit configured to generate a software behavior model based on the stack difference information.

Abstract: A software behavior modeling device which forms a model of a behavior of software includes; an event information acquisition unit configured to acquire event information indicating a specific event which occurs during execution of the software; a stack information acquisition unit configured to acquire stack information stored in a call stack at a time of occurrence of the specific event; a score setting unit configured to set a score in accordance with a storage location in which each element included in the stack information is stored in the call stack; and a model generating unit configured to form a model of a relationship between the specific event and the element by using the score, and to generate a behavior model of the software.

Abstract: A software operation modeling device (100) includes: a stack information recording unit (120), an end information recording unit (150), a stack difference information generation unit (130) for generating information for generating stack difference information by concatenating a call stack upper node of stack information with information until the end information is detected by using the end information recorded by the end information recording unit (150), and a model generation unit (140) for generating a software operation model from the stack difference information.