Abstract: Functionality is provided for unwinding program call stacks across native-to-interpreted code and native-to-JIT-compiled code boundaries, as well as across the kernel and user space boundaries, during performance profiling. The system thus enables profiling of code that crosses boundaries from native code to interpreted languages and native code to languages that run on a runtime supporting JIT compilation. Various embodiments provide cross-language profiling with a sufficiently low performance impact so as to enable such profiling to take place in a production environment.

Abstract: There is described a neural network system implemented by one or more computers for determining graph similarity. The neural network system comprises one or more neural networks configured to process an input graph to generate a node state representation vector for each node of the input graph and an edge representation vector for each edge of the input graph; and process the node state representation vectors and the edge representation vectors to generate a vector representation of the input graph. The neural network system further comprises one or more processors configured to: receive a first graph; receive a second graph; generate a vector representation of the first graph; generate a vector representation of the second graph; determine a similarity score for the first graph and the second graph based upon the vector representations of the first graph and the second graph.

Abstract: Functionality is provided for profiling code by unwinding stacks in frame-pointer omitted executables using C++ exception stack unwinding information. Information is extracted from executable files, and used to optimize stack unwinding operations. In at least one embodiment, the system uses information that has been included for exception handling. Storage of such information can be optimized by exploiting patterns in stack deltas.

Abstract: There is described a neural network system implemented by one or more computers for determining graph similarity. The neural network system comprises one or more neural networks configured to process an input graph to generate a node state representation vector for each node of the input graph and an edge representation vector for each edge of the input graph; and process the node state representation vectors and the edge representation vectors to generate a vector representation of the input graph. The neural network system further comprises one or more processors configured to: receive a first graph; receive a second graph; generate a vector representation of the first graph; generate a vector representation of the second graph; determine a similarity score for the first graph and the second graph based upon the vector representations of the first graph and the second graph.

Abstract: There is described a neural network system implemented by one or more computers for determining graph similarity. The neural network system comprises one or more neural networks configured to process an input graph to generate a node state representation vector for each node of the input graph and an edge representation vector for each edge of the input graph; and process the node state representation vectors and the edge representation vectors to generate a vector representation of the input graph. The neural network system further comprises one or more processors configured to: receive a first graph; receive a second graph; generate a vector representation of the first graph; generate a vector representation of the second graph; determine a similarity score for the first graph and the second graph based upon the vector representations of the first graph and the second graph.

Abstract: A method for characterizing a computer program section held in a computer memory system may include dividing the computer program section into segments, where program commands contained in the computer program section may be used to define a program flow relationship between the segments, and determining characteristic data which may be associated with the program flow relationship of the segments. The characteristic data may be compressed to form a signature which identifies the computer program section.

Abstract: The invention relates to a method for recognizing a piece of malware in a computer memory system, comprising the steps of: providing a master signature comprising a number of byte sequences, producing at least one first signature element, said first signature element comprising a subset of the number of byte sequences in the master signature, and applying the first signature element to data stored in the computer memory system in order to recognize a piece of malware stored in the computer memory system.

Abstract: The invention relates to a method for characterizing a computer program section held in a computer memory system, comprising the steps of breaking down the computer program section into segments, wherein program commands contained in the computer program section are used to define a program flow relationship between the segments, and determining characteristic data which can be associated with the program flow relationship of the segments, wherein the characteristic data are compressed to form a signature which identifies the computer program section.