Stack-oriented non-intrusive runtime acquisition of inner states In view of the shortcomings of log-based and code instrummentation and the requirements of the non-intrusive runtime monitoring the run

To address the limitations of log-based and code instrumentation methods and meet the requirements of non-intrusive runtime monitoring, we have developed a runtime acquisition framework for IoT service systems. Our approach is stack-oriented and involves an algorithm for semantic reconstruction of C process stack parameters, a bottom-up memory forensics method for Java stack, and a memory acquisition technique for a specified process running in Docker. This method effectively resolves the problem of runtime state acquisition and supports non-intrusive runtime monitoring, electronic forensics, anomaly detection, runtime verification, and other related research. Our experiments have demonstrated that the runtime acquisition is real-time, dynamic, and continuous, and the forensics process is essentially transparent to the target system