System and method for detecting cyclic activity in an event flow for dynamic application analysis
Disclosed herein are systems and methods for detecting cyclic activity in an event stream. In one aspect, an exemplary method comprises, creating a buffer, determining a threshold for indicating a beginning of a cycle, processing each event by filling the buffer with the event, determining a number of unique events in the buffer, when the number reaches a predetermined size of the buffer, replacing one event with another by excluding the earliest event and including the new event, recalculating the number of unique events, comparing the recalculated number with a threshold for a maximum number of unique events for cycle detection, detecting a beginning of a cycle when the number of unique events is less than or equal to the maximum number of unique events for cycle detection, excluding further events from the event stream, and continuing to recalculate the number of unique events after each addition.
1 . A method for detecting cyclic activity in an event stream during dynamic analysis of an application, the method comprising:
creating a buffer of a predetermined size for the event stream that occurs during an execution of the application, and determining a threshold representing a maximum number of unique events in the buffer for cycle detection;
processing each event in the event stream by filling the buffer with the event and determining a number of unique events in the buffer when the event is added to the buffer;
when a number of events in the buffer reaches the predetermined size of the buffer, replacing one event in the buffer with a new event by excluding an earliest event and including the new event that is newly processed, recalculating the number of unique events in the buffer, and comparing the recalculated number of unique events with the threshold;
detecting a beginning of a cycle in the buffer when the number of unique events in the buffer is less than or equal to the threshold, and, in response to the detection of the beginning of the cycle, excluding further events occurring in the event stream from subsequent analysis by skipping recording of data related to the further events, and continuing to add each of the further events to the buffer and recalculate the number of unique events in the buffer after said further event is added to the buffer,
wherein the threshold is determined using a ratio: Xc=L/K, where Xc represents the maximum number of unique events in the buffer for cycle detection, L represents a parameter for the predetermined size of the buffer which indicates a maximum number of events in the buffer, K represents a configurable parameter.
2 . The method of claim 1 , further comprising:
when the number of unique events in the buffer is greater than the maximum number of unique events in the buffer for cycle detection, continuing to fill the buffer by replacing one event in the buffer with another new event that is newly processed and recalculating the number of unique events in the buffer until the number of unique events in the buffer is less than or equal to the maximum number of unique events in the buffer for cycle detection.
3 . The method of claim 1 , further comprising:
after the beginning of the cycle is detected, when the number of unique events in the buffer increases and exceeds the maximum number of unique events in the buffer for cycle detection, completing the cycle and begin including further additional events occurring in the event stream in the subsequent analysis by recording data related to the further additional analysis; and
clearing the buffer and re-adding new events that have occurred from the event stream to detect another cycle.
4 . The method of claim 3 , further comprising:
creating another buffer to which the further additional events occurring in the event stream are added; and
counting the number of unique events in the another buffer to detect another cycle.
5 . The method of claim 1 , wherein each event in the event stream occurs during the execution of the application when system Application Programming Interface (API) calls are made.
6 . The method of claim 1 , wherein the buffer comprises a ring buffer.
7 . The method of claim 1 , wherein the maximum number of unique events in the buffer for cycle detection is less than the predetermined size of the buffer which indicates a maximum number of events in the buffer, and the maximum number of unique events in the buffer for cycle detection is less than a total number of events included in a total set of possible events during the execution of the application.
8 . The method of claim 1 , wherein the buffer is generated in real time during the dynamic analysis of the application.
9 . A system for detecting cyclic activity in an event stream during dynamic analysis of an application, comprising:
at least one processor configured to:
create a buffer of a predetermined size for the event stream that occurs during an execution of the application, and determining a threshold representing a maximum number of unique events in the buffer for cycle detection;
process each event in the event stream by filling the buffer with the event and determining a number of unique events in the buffer when the event is added to the buffer;
when a number of events in the buffer reaches the predetermined size of the buffer, replace one event in the buffer with a new event by excluding an earliest event and including the new event that is newly processed, recalculating the number of unique events in the buffer, and comparing the recalculated number of unique events with the threshold;
detect a beginning of a cycle in the buffer when the number of unique events in the buffer is less than or equal to the threshold, and, in response to the detection of the beginning of the cycle, exclude further events occurring in the event stream from subsequent analysis by skipping recording of data related to the further events, and continue to add each of the further events to the buffer and recalculate the number of unique events in the buffer after said further event is added to the buffer,
wherein the threshold is determined using a ratio: Xc=L/K, where Xc represents the maximum number of unique events in the buffer for cycle detection, L represents a parameter for the predetermined size of the buffer which indicates a maximum number of events in the buffer, K represents a configurable parameter.
10 . The system of claim 9 , the at least one processor further configured to:
when the number of unique events in the buffer is greater than the maximum number of unique events in the buffer for cycle detection, continue to fill the buffer by replacing one event in the buffer with another new event that is newly processed and recalculating the number of unique events in the buffer until the number of unique events in the buffer is less than or equal to the maximum number of unique events in the buffer for cycle detection.
11 . The system of claim 9 , the at least one processor further configured to:
after the beginning of the cycle is detected, when the number of unique events in the buffer increases and exceeds the maximum number of unique events in the buffer for cycle detection, complete the cycle and begin including further additional events occurring in the event stream in the subsequent analysis by recording data related to the further additional analysis; and
clear the buffer and re-add new events that have occurred from the event stream to detect another cycle.
12 . The system of claim 11 , the at least one processor further configured to:
create another buffer to which the further additional events occurring in the event stream are added; and
count the number of unique events in the another buffer to detect another cycle.
13 . The system of claim 9 , wherein each event in the event stream occurs during the execution of the application when system Application Programming Interface (API) calls are made.
14 . The system of claim 9 , wherein the buffer comprises a ring buffer.
15 . The system of claim 9 , wherein the maximum number of unique events in the buffer for cycle detection is less than the predetermined size of the buffer which indicates a maximum number of events in the buffer, and the maximum number of unique events in the buffer for cycle detection is less than a total number of events included in a total set of possible events during the execution of the application.
16 . A non-transitory computer readable medium storing thereon computer executable instructions for detecting cyclic activity in an event stream during dynamic analysis of an application, including instructions for:
creating a buffer of a predetermined size for the event stream that occurs during an execution of the application, and determining a threshold representing a maximum number of unique events in the buffer for cycle detection;
processing each event in the event stream by filling the buffer with the event and determining a number of unique events in the buffer when the event is added to the buffer;
when a number of events in the buffer reaches the predetermined size of the buffer, replacing one event in the buffer with a new event by excluding an earliest event and including the new event that is newly processed, recalculating the number of unique events in the buffer, and comparing the recalculated number of unique events with the threshold; and
detecting a beginning of a cycle in the buffer when the number of unique events in the buffer is less than or equal to the threshold, and, in response to the detection of the beginning of the cycle, excluding further events occurring in the event stream from subsequent analysis by skipping recording of data related to the further events, and continuing to add each of the further events to the buffer and recalculate the number of unique events in the buffer after said further event is added to the buffer,
wherein the threshold is determined using a ratio: Xc=L/K, where Xc represents the maximum number of unique events in the buffer for cycle detection, L represents a parameter for the predetermined size of the buffer which indicates a maximum number of events in the buffer, K represents a configurable parameter.
17 . The non-transitory computer readable medium of claim 16 , further including instructions for:
when the number of unique events in the buffer is greater than the maximum number of unique events in the buffer for cycle detection, continuing to fill the buffer by replacing one event in the buffer with another new event that is newly processed and recalculating the number of unique events in the buffer until the number of unique events in the buffer is less than or equal to the maximum number of unique events in the buffer for cycle detection.