Abstract: A malware detection system for evaluating sample programs for malware incorporates an evasion code detector. The evasion code detector includes semantic patterns for identifying conditional statements and other features employed by evasion code. The system inserts breakpoints at conditional statements, compares expected and actual evaluated values of conditional variables of the conditional statements, and changes the execution path of the sample program based on the comparison. Changing the execution path of the sample program to an expected execution path counteracts the evasion code, allowing for the true nature of the sample program to be revealed during runtime.

Abstract: Techniques and solutions are described for facilitating the determination of whether a software program may raise a compliance issue, such as whether processes invoked by the software program may involve the sending of protected information. A compliance tool automatically determines a plurality of processes invoked by a program. A plurality of the invoked processes are compared with a process compliance library comprising at least one process. The comparing produces compliance results. The compliance results are output to a user.

Abstract: A performance information generating method, the method includes: reading, by a computer, context information generated by a context information collection program which performs process while collecting the context information and performance profile information generated by a performance profile information collection program which performs process while collecting the performance profile information; aggregating the performance profile information for each context based on the context information and the performance profile information; and outputting the performance profile information aggregated for each context.

Abstract: Various embodiments may include methods, devices, and non-transitory processor-readable media for performing information flow tracking during execution of a software application. A hybrid static/dynamic analysis may be used to track information flow during execution of a software application. In various embodiments, the method may predict a multiple paths of execution, and may utilize these predictions to analyze only actually executing software code. By analyzing only actually executed software code, the method may provide a lightweight and resource-efficient way of detecting actual data leaks as they occur during execution of a software application.

Abstract: Engineers at a software maker can insert software markers, making a compiler provide object code markers that appear to invoke activities from the protection library, but actually have the effect of providing information to a protection process. The engineers can build a protected object file, from which a software protection tool can provide an executable file. The software protection tool can include any tool that can use a pointer to a program statement, including creating DLL's. Alternatively, the system can identify object code markers by their referencing known functions from CALL instructions.

Abstract: A to-be-stubbed target determining apparatus includes: a processor that executes a determining program; and a memory that stores the determining program; wherein according to determining program, the processor: extracts relational information that represents a relation between a program under test and one or more functions which are called from the program under test; and determines, according to the relational information, from among the one or mode functions, a function that returns a user-defined type of instance accessed in the program under test and a function that returns a value used as a condition of a conditional branch in the program under test, as a first function excluded from functions to be stubbed.

Abstract: A stream of tuples is received to be processed by processing elements operating on one or more computer processors with each processing element having one or more stream operators. A breakpoint is identified for a stream operator that is configured to be triggered when time for processing of a tuple by the first stream operator is predicted to exceed a threshold time. A tuple is received at the stream operator having a set of attributes. A predicted time to process the tuple is determined based on the set of attributes. It is determined that the predicted time exceeds the threshold time. The breakpoint is triggered, in response to determining that the predicted time exceeds the threshold time, to pause processing of the tuple by the first stream operator.

Abstract: A method includes receiving, by a database system, a query statement and forming a runtime plan tree in accordance with the query statement. The method also includes traversing the runtime plan tree including determining whether a function node of the runtime plan tree is qualified for just-in-time (JIT) compilation. Additionally, the method includes, upon determining that the function node is a qualified for JIT compilation producing a string key in accordance with a function of the function node and determining whether a compiled object corresponding to the string key is stored in a compiled object cache.

Abstract: Methods, systems, and apparatus, including computer programs encoded on computer storage media, for performing differential recursive evaluation of recursive aggregates. One of the methods includes receiving an original recursive expression that defines tuples belonging to an output relation, wherein the original recursive expression has a recursive aggregation construct, the recursive aggregation construct having a range and a recursive term. An aggregates delta rule is applied to the initial delta expression to generate a final delta expression having an existential term and a gamma term. The existential term is evaluated to generate tuples related by the range and tuples in the delta relation, and the aggregation construct is evaluated using tuples generated by the existential term as the range of the aggregation construct. The output relation is updated including adding to the output relation any tuples newly generated by evaluating the final delta expression.

Abstract: A software development environment (SDE) and a method of compiling integrated source code. One embodiment of the SDE includes: (1) a parser configured to partition an integrated source code into a host code partition and a device code partition, the host code partition including a reference to a device variable, (2) a translator configured to: (2a) embed device machine code, compiled based on the device code partition, into a modified host code, (2b) define a pointer in the modified host code configured to be initialized, upon execution of the integrated source code, to a memory address allocated to the device variable, and (2c) replace the reference with a dereference to the pointer, and (3) a host compiler configured to employ a host library to compile the modified host code.

Abstract: Performing a speculative replay of code execution. Embodiments include replaying trace data comprising a trace data stream that represents execution of one or more executable entities, including storing first runtime state of replaying the trace data in a first replay data structure. During replay, a first point of interest in the executable entities is encountered. Based on encountering the first point of interest, replay of the trace data is ceased, and a user interface presents a portion of the first runtime state. While presenting the portion of runtime state, the trace data is speculatively replayed. Speculative replay includes automatically selecting a second point of interest in the executable entities, creating a second replay data structure from the first replay data structure, and replaying the trace data until encountering the second point of interest, including storing second runtime state of replaying the trace data in the second replay data structure.

Abstract: Embodiments include computing devices, apparatus, and methods implemented by the apparatus for implementing profile guided indirect jump checking on a computing device, including encountering an indirect jump location of implementing an indirect jump during execution of a program, identifying an indirect jump target of the indirect jump, determining whether the indirect jump location and the indirect jump target are associated in a profile guided indirect jump table, and determining whether the indirect jump location and the indirect jump target are associated in a compiler guided indirect jump table in response to determining that the indirect jump location and the indirect jump target are not associated in the profile guided indirect jump table.

Abstract: The disclosed computer-implemented method for identifying compromised devices within industrial control systems may include (1) monitoring network traffic within a network that facilitates communication for an industrial control system that includes an industrial device, (2) creating, based at least in part on the network traffic, a message protocol profile for the industrial device that describes (A) a network protocol used to communicate with the industrial device and (B) normal communication patterns of the industrial device, (3) detecting at least one message that involves the industrial device and at least one other computing device included in the industrial control system, (4) determining, by comparing the message with the message protocol profile, that the message represents an anomaly, and then (5) determining, based at least in part on the message representing the anomaly, that the other computing device has likely been compromised.

Abstract: A code region of an application is instrumented by a multi-pass profiler with first annotations for generating profile data. The application is executed with the first annotations, wherein executing the application with the first annotations generates first profile data for the code region. The multi-pass profiler identifies, from the first profile data, the code region as a delinquent code region. The multi-pass profiler determines second annotations based, at least in part, on the first profile data and the at least one of the first annotations that defines the delinquent code region. The multi-pass profiler instruments, based on the first profile data, a code sub-region of the delinquent code region with the second annotations for generating profile data. The application is executed with second annotations, wherein executing the application with the second annotations generates second profile data for the code sub-region.

Abstract: The source code of a software artifact may be scanned, and a call tree model with leaf nodes may be generated based on the scan. A set of test cases can be executed against the software artifact and log data from the execution can be collected. A set of untested leaf nodes can be detected and a new set of test cases can be generated to test the untested nodes. The new set of test cases are executed and a subset of the test cases which cover the previously untested nodes are added to the existing set of test cases.

Abstract: The present disclosure provides system and method for executing SPARQL query on a SPARQL engine. For executing the SPARQL query, a function may be instantly integrated with the SPARQL query which leads to extension of the SPARQL query. The extension may be achieved through a user friendly interface which may allow transparent integration of code (i.e., the function) in any language such as JAVA, C, C++ and the like, supporting a particular functionality. The system may integrate the code by addition of newly added code to the SPARQL library after validation. Further, the system may analyze the functionality associated with the code to optimize decision making of a user. The system may further support auto compilation and rating of the functions based on the user feedback and re-usability of the code working in a collaborative environment. Further the system may enable also enable to integrate external tools and web services.

Abstract: A partition mobility facility in which a partition that is executing one or more applications that have optimized code with one or more extended features is to be moved from a source system to a target system. If the target system does not support the extended mode features, then action is taken to remove the code having those features to facilitate migration.

Abstract: A system for testing a software application includes (a) a memory unit includes a database and a set of modules; and (b) a processor that executes the set of modules. The set of modules include (i) a test case module that processes an input received from a user through a first user interface view of an electronic document; (ii) a test action module that processes an input includes (a) keywords in a second user interface view of the electronic document, and (b) unique identification number for each of the one or more test action, (iii) a test case execution module that executes the test case by executing the one or more action item; (iv) a comparison module that compare the obtained test case execution result with a predetermined result; and (v) a validation module that validate the software application based on the comparison.

Abstract: A method, system, and computer program product for performing user-initiated logging and auto-correction in hardware/software systems. Embodiments commence upon identifying a set of test points and respective instrumentation components, then determining logging capabilities of the instrumentation components. The nature and extent of the capabilities and configuration of the components aid in generating labels to describe the various logging capabilities. The labels are then used in a user interface so as to obtain user-configurable settings which are also used in determining auto-correction actions. A measurement taken at a testpoint may result in detection of an occurrence of a certain condition, and auto-correction steps can be taken by retrieving a rulebase comprising a set of conditions corresponding to one or more measurements, and corrective actions corresponding to the one or more conditions.

Abstract: An error guide including a set of error resolutions is stored. A set of log files is received which includes log entries generated by a set of processes associated with an application program. Each log entry includes a set of attributes including a first attribute specifying a message, a second attribute specifying a message identifier, a third attribute specifying process, and a fourth attribute specifying a message type. The log files are parsed based on the third and fourth attributes to identify a log entry associated with a particular process and message type. A message identifier of the log entry is compared with the error message guide to identify an error resolution that corresponds to a message of the log entry. The identified error resolution is displayed on an electronic screen.

Abstract: Exemplary methods for distributed multi-component network-aware service placement in a resource pool include utilizing a hierarchy of agents associated with computing resources of a cloud architecture. An agent in the hierarchy can merge solution encodings to find cover sets indicating feasible placement solutions that can cover an entire application placement request. The agent can partition the components across its children nodes such that global network traffic is minimized. An application graph is generated with components as vertices and edges indicating connections between the components and having associated weights indicating a data transfer rate between the components. The edges can be sorted, and each cover set can be processed by repeatedly assigning unassigned pairs of components having higher data transfer rates to a common assignment set. If multiple placement solutions are found, determined placement costs for each can be used to identify the preferred placement.

Abstract: Techniques for performing position analysis on a representation of an application source code are disclosed herein. An application source code is scanned to produce a representation of the application source code, start locations within the representation are determined, corresponding stop locations within the representation are determined, and a set of data impact locations within the representation are determined. The set of data impact locations are then used in a dataflow analysis to determine a position of high control of the data within the representation.

Abstract: Dynamic verification of a computer software application execution path by detecting execution of a target instruction of a computer software application, wherein the computer software application is configured to generate a token at an instruction near a waypoint instruction of the computer software application, and wherein the waypoint instruction lies along an execution path that leads to the target instruction. Determining, responsive to detecting execution of the target instruction, whether a token exists. Performing a computer-security-related remediation action responsive to determining that the token does not exist.

Abstract: Methods, systems, and articles of manufacture for computing program equivalence based on a hierarchy of program semantics and related canonical representations are provided herein. A method includes defining a program semantic representation for a first program; generating a search query based on said semantic representation for the first program; executing said search query against an index of multiple programs to determine a set of candidate programs among the multiple programs, wherein said index comprises a program semantic representation defined for each of the multiple programs; and identifying one or more programs among the set of candidate programs that match the first program by performing one or more comparisons, across the set of candidate programs, of a canonical representation associated with each program in the identified set of candidate programs to a canonical representation associated with the first program.

Abstract: Methods, systems, and apparatus, including computer programs encoded on computer storage media, for generating widened types for static analysis. One of the methods includes receiving an output generated by a program parser for a source code file, wherein the output identifies a respective original type for each of one or more source code elements in the source code file. A respective widened type name is generated for each of one or more source code elements in the output, the widened type name being different from an original type name of the original type of the source code element. Static analysis are generated results for the source code file, wherein the static analysis results reference each source code element of the one or more source code elements by a respective widened type name for the source code element instead of by a respective original type name of the source code element.

Abstract: A method of testing software uses a debugger and a breakpoint handler. The debugger inserts a breakpoint in a target application and enters at least one filtering condition associated with the breakpoint in a data structure. When during execution the target application encounters a breakpoint at an address, the target application transfers execution to the breakpoint handler. The breakpoint handler uses the address to retrieve filtering conditions from the data structure, executes code for evaluating the filtering condition, and transfers execution back to the target application if the filtering condition is not met.

Abstract: Support for dynamic behavior is specified while reducing reliance on JIT compilation and large runtimes; semantic characteristics are selectively attached to types and type members outside source code. A directives document contains human-readable directives in a parsable format for submission to an innovative compiler. The directives specify whether a type T or type member M is required, optional, or prohibited in a runtime environment. Some reference an application, library, assembly, or namespace group, and others reference group components: type, type instantiation, method, method instantiation, field, property, or event. Some directives force a generic instantiation. Some directives indirectly reference a type through a parameter, type parameter, or generic directive. Some directives reference degrees to manage runtime activation of type instances, runtime introspection over types, reflection, and/or runtime or static serialization.

Abstract: An optimizing compiler includes a vector optimization mechanism that optimizes vector instructions by eliminating one or more vector element reverse operations. The compiler can generate code that includes multiple vector element reverse operations that are inserted by the compiler to account for a mismatch between the endian bias of the instruction and the endian preference indicated by the programmer or programming environment. The compiler then analyzes the code and reduces the number of vector element reverse operations to improve the run-time performance of the code. The compiler generates a debugger table that specifies which instructions have corresponding reformatting operations. A debugger then uses the debugger table to display contents of the vector register, which is displayed in regular form as well as in a form that is reformatted according to information in the debugger table.

Abstract: A solution for managing software dependencies during software testing and debugging includes a capture module configured to capture a software call stack of a software execution environment, each software call of the software call stack including a call signature and a call result. The solution defines a set of proxied software calls within the software call stack suitable for simulating conversation responses to runtime software calls by a target application. Once a set of proxied software calls is defined, a playback module recognizes runtime software calls by the target application that are within the set of proxied software calls and responds to the recognized runtime software call with a captured call result corresponding to the recognized software call.

Abstract: A method for providing integrity and consistency of a cloud storage service to a group of mutually trusted clients may be provided. The cloud storage service may offer a set of operations, such as read, write, update, delete in respect to stored data to the clients, whereby each client only executes its own client operations when consuming one of the set of operations of the cloud storage service, and wherein each client detects data correctness of the cloud storage service based on a protocol providing fork-linearizablity.

Abstract: An engine identifying segments or portions of one source material or source file common to or found in another source material or file. The engine may receive a first data stream in binary form as well as a second stream in binary form. The engine may include a data stream processor or pre-processor programmed to translate the first and second data streams to generate respective first and second processed data streams. The commonality between the first and second processed data streams may be greater than the commonality between the first and second data streams themselves. Also, a comparator may be programmed to compare the first and second process data streams and identify binary segments found in both the first and second processed data streams.

Abstract: Methods for dynamically instrumenting a program while the program is executing are described. In some embodiments, profiling hooks may be selectively inserted into and removed from a program while the program is running. The hooks may gather profiling information, such as the frequency and duration of function calls, for a selected set of functions. The hooks may be inserted into the program without requiring a special build or modifications to the binary by modifying machine-level instructions for the program stored in system memory. The ability to selectively insert instrumentation into the machine-level instructions stored in the system memory allows a set of functions to be selected during execution of the program and hooks for each function of the set of functions to be dynamically inserted or removed during execution of the program to precisely capture profiling information for the set of functions.

Abstract: An optimizing compiler includes a vector optimization mechanism that optimizes vector instructions by eliminating one or more vector element reverse operations. The compiler can generate code that includes multiple vector element reverse operations that are inserted by the compiler to account for a mismatch between the endian bias of the instruction and the endian preference indicated by the programmer or programming environment. The compiler then analyzes the code and reduces the number of vector element reverse operations to improve the run-time performance of the code. The compiler generates a debugger table that specifies which instructions have corresponding reformatting operations. A debugger then uses the debugger table to display contents of the vector register, which is displayed in regular form as well as in a form that is reformatted according to information in the debugger table.

Abstract: A method for providing for standardization of variable names in an integrated development environment is provided. The method includes scanning a project source code for variable names, where the project source code is managed by a development team in an integrated development environment. The method includes determining that the project source code contains a non-standard variable name, where the distinction between a standard variable name and the non-standard variable name is defined by a set of standards and semantic rules. The method then includes identifying a location of the non-standard variable name in the project source code.

Abstract: Systems and methods for predicting a software build error are described herein. In one example, a method includes detecting a plurality of changes in software. The method also includes identifying a plurality of change lists, wherein a change list is identified for each of the plurality of changes in the software. Additionally, the method includes identifying a characteristic for each change list in the plurality of change lists. Furthermore, the method includes calculating a plurality of probabilities based at least in part on the characteristic of each of the plurality of change lists, wherein each of the probabilities indicates the likelihood of one of the plurality of change lists creating the software build error. The method also includes reporting the plurality of probabilities of the software build error.

Abstract: Methods, systems, and apparatuses, including computer programs encoded on computer readable media, for generating a plurality of tokens from one or more source files. The one or more source files include source code in a first programming language. The source code includes one or more static conditionals that include a conditional expression and branch code that is operative when the conditional expression is true. Various configurations are possible based upon the conditionals. A first static conditional that includes one or more nested static conditionals within the branch code associated with the first static conditional is determined. Each of the one or more nested static conditionals is hoisted to a beginning of the branch code associated with the first static conditional. Each innermost branch code does not contain a static conditional, and each possible configuration is preserved.

Abstract: A method of enabling an executed control flow path through computer program code to be determined. The method comprising modelling cumulative instruction counts for control flow paths through the computer program code, and inserting at least one probe within the computer program code to enable a cumulative instruction count value for at least one control flow path of the computer program code to be accessed.

Abstract: An application management system modifies developer-submitted applications, such as mobile applications, to add various types of functionality before such applications are made available for purchase. The added functionality may, for example, enable end users to make in-application purchases of content items from an application store. As another example, Digital Rights Management (DRM) functionality may be added for controlling user access to content items, such as content items available in an application store.

Abstract: This disclosure generally describes methods and systems, including computer-implemented methods, computer-program products, and computer systems, for providing a proactive failure recovery model for distributed computing. One computer-implemented method includes building a virtual tree-like computing structure of a plurality of computing nodes, for each computing node of the virtual tree-like computing structure, performing, by a hardware processor, a node failure prediction model to calculate a mean time between failure (MTBF) associated with the computing node, determining whether to perform a checkpoint of the computing node based on a comparison between the calculated MTBF and a maximum and minimum threshold, migrating a process from the computing node to a different computing node acting as a recovery node, and resuming execution of the process on the different computing node.

Abstract: A computer identifies lines of code of a product program that have been modified after an initial test of the product program. The computer determines the overlap between lines of code that have been modified and a mapped test case. The computer determines a weighted value for the mapped test case based on two or more of, an environment of the test case, the degree of the overlap, a time the test case was last executed, a time the test case takes to execute, and a priority of a defect. The environment of the test case is configured to replicate a working environment where the product program is to be deployed and includes an operating system, a hardware configuration, and the configuration of the operating system.

Abstract: A computer identifies lines of code of a product program that have been modified after an initial test of the product program. The computer determines the overlap between lines of code that have been modified and a mapped test case. The computer determines a weighted value for the mapped test case based on two or more of, an environment of the test case, the degree of the overlap, a time the test case was last executed, a time the test case takes to execute, and a priority of a defect. The environment of the test case is configured to replicate a working environment where the product program is to be deployed and includes an operating system, a hardware configuration, and the configuration of the operating system.

Abstract: Methods and apparatus for automatically generating translation programs for translating computing services templates to service blueprints are disclosed. An example method includes generating a population of translation logic elements from a plurality of verified computing services template translation programs, where each of the verified programs is configured to correctly translate at least one computing services template of a plurality of known templates to a respective service blueprint. The example method further includes identifying a new computing services template and programmatically augmenting the population of translation logic elements. The example method also includes generating one or more additional translation programs based on the augmented population of translation logic elements and validating each of the one or more additional computing services template translation programs.

Abstract: A device may select a program code function associated with a graphical model. The program code function may include a set of identifiers. The device may select an identifier from the set of identifiers. The device may determine a particular set of entities that are referenceable at a program code location of the identifier. The particular set of entities may include a first set of entities of the program code function for which the identifier is within a lexical scope of the first set of entities and a second set of entities of the graphical model for which the program code function is within the graphical scope of the second set of entities. The device may determine whether the identifier corresponds to a particular entity of the particular set of entities. The device may provide information associated with determining whether the identifier corresponds to the particular entity.

Abstract: A method and an apparatus that instructs a compiler server to build or otherwise obtain a compiled code corresponding to a compilation request received from an application are described. The compiler server may be configured to compile source codes for a plurality of independent applications, each running in a separate process, using a plurality of independent compilers, each running in a separate compiler process. A search may be performed in a cache for a compiled code that satisfies a compilation request received from an application. A reply message including the compiled code can be provided for the application, wherein the compiled code is compiled in direct response to the request, or is obtained from the cache if the search identifies in the cache the compiled code that satisfies the compilation request.

Abstract: Methods and apparatuses that collect code coverage information for selected code locations when executing executable code are described. Source code in one or more files may be annotated at the selected code locations. The executable code may be compiled from the annotated source code using standard compilers. The code coverage information may be collected into a run time data store accessible by other applications. In response to receiving a code coverage request, the code coverage information can be retrieved from the data store to compare with annotations identified from the source code. A code coverage report can be generated to indicate whether one or more of the selected code locations are not covered when executing the executable code.

Abstract: A diagnostic system in an aspect-oriented data processing environment is provided. The environment comprises a data processing system having an operating system for executing an application, wherein the application comprises an object class. The environment also comprises means for loading the object class at runtime and storage means for storing a diagnostic aspect. An aspect implements concerns (e.g. logging, security) that cross-cut the application. The object class of the application is loaded at runtime and the diagnostic aspect is read from the storage means. The means for loading now combines the object class with the diagnostic aspect, so that for example, diagnostics can be captured and repairs on the application can be carried out.