Protecting customers against supply chain attacks by detecting a behavior change between versions of an application program

1 . A method of evaluating an application program to protect a customer against a supply chain attack, the method comprising:

executing a first version of the application program to identify a first set of behaviors exhibited by the first version of the application program during execution;

executing a second version of the application program to identify a second set of behaviors exhibited by the second version of the application program during execution;

identifying a plurality of differing behaviors of the first and second versions of the application program, each of the plurality of differing behaviors comprising a behavior that is not common to both the first set of behaviors and the second set of behaviors;

merging behaviors of the plurality of differing behaviors that are similar; and

detecting a behavior change of the application program in response to identifying a behavior of the plurality of differing behaviors that cannot be merged with another behavior of the plurality of differing behaviors; and

issuing a behavior change notification in response to detecting the behavior change of the application program.

2 . The method of claim 1 , wherein the method is performed on a computer system of the customer.

3 . The method of claim 1 , wherein the method is performed as an in-the-cloud service for the customer.

4 . The method of claim 1 , wherein the application program is provided by a supplier to the customer over the Internet.

5 . The method of claim 1 , wherein the plurality of differing behaviors are identified using a Jaccard similarity algorithm.

6 . A system comprising a memory and at least one processor, the memory storing instructions that when executed by the at least one processor cause the system to:

execute a first version of an application program to identify a first set of behaviors exhibited by the first version of the application program during execution;

execute a second version of the application program to identify a second set of behaviors exhibited by the second version of the application program during execution;

identify a plurality of differing behaviors of the first and second versions of the application program, each of the plurality of differing behaviors comprising a behavior that is not common to both the first set of behaviors and the second set of behaviors;

merge behaviors of the plurality of differing behaviors that are similar;

detect a behavior change of the application program when a behavior of the plurality of differing behaviors cannot be merged with another behavior of the plurality of differing behaviors; and

detect no behavior change of the application program when each of the plurality of differing behaviors can be merged with another behavior of the plurality of differing behaviors.

7 . The system of claim 6 , wherein the instructions stored in the memory when executed by the at least one processor cause the system to:

issue a behavior change notification in response to detecting the behavior change of the application program.

8 . The system of claim 6 , wherein the application program is provided by a supplier to a customer.

9 . The system of claim 8 , wherein the system is an execution platform of the customer.

10 . The system of claim 8 , wherein the system is provided to the customer as an in-the-cloud service.