Formal Representation and Comparative Analysis of Software Runtime Process

Using a software tracing frameworks we obtain sequences of system calls produced during the execution of the pair of programs. We then transform the sequences of system calls into the symbolic sequences and apply a set of string metrics to them. We experimentally compare metrics on the task of differentiating the sources of sequences. We investigate various metrics including edit-distance metrics and hybrid methods. Overall, the best-performing metric is a cosine distance, resulting in order-of-magnitude different values for input pairs of different degrees of similarity.