Granted Patent B2

US 12,579,276 · App. 17/835,074 · Granted Mar 17, 2026

Inventors: Ashutosh Kulshreshtha (Cupertino, CA); Walter T. Hulick, Jr. (Pearland, TX); Chandra Mohan Babu Nadiminti (Dublin, CA)

Assignee: Cisco Technology, Inc.

G06F21/577G06F21/52G06F2221/033

Abstract

Claims (55)

1 . A computing system, the computing system comprising:

one or more processors; and

one or more computer-readable non-transitory storage media comprising instructions that, when executed by the one or more processors, cause one or more components of the computing system to perform operations comprising:

training a machine learning model with a first set of call stacks associated with a first application, wherein the first application causes a problem;

training the machine learning model with a second set of call stacks associated with a second application, wherein the second application does not cause the problem;

using the trained machine learning model to generate a problem likelihood score for a first call stack of the first set of call stacks, wherein the problem likelihood score indicates a predicted probability that the first call stack caused the problem;

determining one or more call stacks associated with a new application;

determining whether the problem occurs in the new application;

comparing, in response to determining that the problem occurs, the one or more call stacks associated with the new application to the first call stack; and

generating a score indicating a likelihood that the first call stack caused the problem in the new application.

2 . The computing system of claim 1 , wherein the instructions cause the one or more components of the computing system to perform further operations comprising generating a notification comprising the score indicating the likelihood that the first call stack caused the problem.

3 . The computing system of claim 2 , wherein:

the new application is instantiated in a development environment; and

the notification is sent prior to execution of the new application.

4 . The computing system of claim 1 , wherein the instructions cause the one or more components of the computing system to perform further operations comprising receiving traces of the one or more call stacks of the new application to determine whether the problem occurs in the new application.

5 . The computing system of claim 1 , wherein the problem includes one of a known vulnerability, a known weakness, and both a known vulnerability and a known weakness.

6 . The computing system of claim 1 , wherein the instructions cause the one or more components of the computing system to perform further operations comprising:

storing known application vulnerabilities and associated applications, call stacks, system calls, application versions, call stack versions, and call iterations in a knowledge database; and

further training the machine learning model using, at least in part, a test data set, the test data set derived from the known application vulnerabilities and the call stacks associated with the known application vulnerabilities.

7 . The computing system of claim 1 , wherein generating the score indicating the likelihood that the first call stack caused the problem in the new application is based on whether the first call stack is included in the new application.

8 . A method performed by a computing system, the method comprising:

training a machine learning model with a first set of call stacks associated with a first application, wherein the first application causes a problem;

training the machine learning model with a second set of call stacks associated with a second application, wherein the second application does not cause the problem;

using the trained machine learning model to generate a problem likelihood score for a first call stack of the first set of call stacks, wherein the problem likelihood score indicates a predicted probability that the first call stack caused the problem;

determining one or more call stacks associated with a new application;

determining whether the problem occurs in the new application;

comparing, in response to determining that the problem occurs, the one or more call stacks associated with the new application to the first call stack; and

generating a score indicating a likelihood that the first call stack caused the problem in the new application.

9 . The method of claim 8 , further comprising generating a notification comprising the score indicating the likelihood that the first call stack caused the problem.

10 . The method of claim 9 , wherein:

The new application is instantiated in a development environment; and

the notification is sent prior to execution of the new application.

11 . The method of claim 8 , further comprising receiving traces of the one or more call stacks of the new application to determine whether the problem occurs in the new application.

12 . The method of claim 8 , wherein the problem includes one of a known vulnerability, a known weakness, and both a known vulnerability and a known weakness.

13 . The method of claim 8 , further comprising:

storing known application vulnerabilities and associated applications, call stacks, system calls, application versions, call stack versions, and call iterations in a knowledge database; and

further training the machine learning model using, at least in part, a test data set, the test data set derived from the known application vulnerabilities and the call stacks associated with the known application vulnerabilities.

14 . The method of claim 8 , wherein generating the score indicating the likelihood that the first call stack caused the problem in the new application is based on whether the first call stack is included in the new application.

15 . One or more computer-readable non-transitory storage media embodying instructions that, when executed by a processor of a computing system, cause performance of operations comprising:

training a machine learning model with a first set of call stacks associated with a first application, wherein the first application causes a problem;

training the machine learning model with a second set of call stacks associated with a second application, wherein the second application does not cause the problem;

using the trained machine learning model to generate a problem likelihood score for a first call stack of the first set of call stacks, wherein the problem likelihood score indicates a predicted probability that the first call stack caused the problem;

determining one or more call stacks associated with a new application;

determining whether the problem occurs in the new application;

comparing, in response to determining that the problem occurs, the one or more call stacks associated with the new application to the first call stack; and

generating a score indicating a likelihood that the first call stack caused the problem in the new application.

16 . The one or more computer-readable non-transitory storage media of claim 15 , wherein the instructions cause the performance of further operations comprising generating a notification comprising the score indicating the likelihood that the first call stack caused the problem.

17 . The one or more computer-readable non-transitory storage media of claim 16 , wherein:

the new application is instantiated in a development environment; and

the notification is sent prior to execution of the new application.

18 . The one or more computer-readable non-transitory storage media of claim 15 , wherein the problem includes one of a known vulnerability, a known weakness, and both a known vulnerability and a known weakness.

19 . The one or more computer-readable non-transitory storage media of claim 15 , wherein generating the score indicating the likelihood that the first call stack caused the problem in the new application is based on whether the first call stack is included in the new application.

20 . The one or more computer-readable non-transitory storage media of claim 15 , the operations further comprising:

storing known application vulnerabilities and associated applications, call stacks, system calls, application versions, call stack versions, and call iterations in a knowledge database; and

further training the machine learning model using, at least in part, a test data set, the test data set derived from the known application vulnerabilities and the call stacks associated with the known application vulnerabilities.

Assignments (1)

Continuity (2)

References Cited (28)