Extended Finite State Machine Research Articles

An enhanced state-aware model learning approach for security analysis in lightweight protocol implementations

Owing to the emergence and rapid advances of new-generation information and digitalization technologies, the concept of model-driven digital twin has received widespread attentions and is developing vigorously. Driven by data and simulators, the digital twin can create the virtual twins of physical objects to perform monitoring, simulation, prediction, optimization, and so on. Hence, the application of digital twin can increase efficiency and security of systems by providing reliable model and decision supports. In this paper, we propose a state-aware model learning method to simulate and analyze the lightweight protocol implementations in edge/cloud environments. We introduce the data flow of program execution and network interaction inputs/outputs (I/O) into the extended finite state machine (EFSM) to expand the modeling scope and insight. We aim to calibrate the states and construct an accurate state-machine model using a digital twin based layered approach to reasonably reflect the correlation of a device’s external behavior and internal data. This, in turn, improves our ability to verify the logic and evaluate the security for protocol implementations. This method firstly involves instrumenting the target device to monitor variable activity during its execution. We then employ learning algorithms to produce multiple rounds of message queries. Both the I/O data corresponding to these query sequences and the state calibration information derived from filtered memory variables are obtained through the mapper and execution monitor, respectively. These two aspects of information are combined to dynamically and incrementally construct the protocol’s state machine. We apply this method to develop SALearn and evaluate the effectiveness of SALearn on two lightweight protocol implementations. Our experimental results indicate that SALearn outperforms existing protocol model learning tools, achieving higher learning efficiency and uncovering more interesting states and security issues. In total, we identified two violation scenarios of rekey logic. These situations also reflect the differences in details between different implementations.

Automatic Conversion of Smart Contracts for Non-Blocking Verification

Smart contracts are programs stored on a blockchain ledger, thus being immutable after deployment, which makes assessment of their correctness before deployment vital. Extended finite state machines (EFSM) offer a structured framework for modeling complex systems, thus providing a systematic approach to scrutinize smart contract functionalities. This paper describes a methodology to automatically convert from the abstract syntax tree of a smart contract to an EFSM model. A smart contract implementing a casino is the specific use case, and verification of the EFSM model reveals it to be blocking. This blocking represents that a malicious player can lock the funds of the casino so that they can never be retrieved.

Algebraic Implementation of Extended Finite State Machine Networks

Algebraic Implementation of Extended Finite State Machine Networks

EFSM Model-Based Testing for Android Applications

Model-based testing provides an effective means for ensuring the quality of Android apps. Nevertheless, existing models that focus on event sequences and abstract them into Finite State Machines (FSMs) may lack precision and determinism because of the different data values of events that can result in various states of Android applications. To address this issue, a novel model based on Extended Finite State Machines (EFSMs) for Android apps is proposed in this paper. The approach leverages machine learning to infer data constraints on events and annotates them on state transitions, leading to a more precise and deterministic model. Additionally, a state abstraction strategy is presented to further refine the model. Besides, test diversity plays a vital role in enhancing test suite effectiveness. To achieve high coverage and fault detection, test cases are generated from the EFSM model with the help of a Genetic Algorithm (GA), guided by test diversity. To evaluate the effectiveness of our approach, this paper carries out experiments on 93 open-source apps. The results show that our approach performs better in code coverage and crash detection than the existing open-source model-based testing tools. Particularly, the 19 unique crashes that involve complex data constraints are detected by our approach.

An Integrated Framework for Autonomous Sensor Placement With Aerial Robots

Aerial manipulators have the unique ability to cover wide-spread areas within a single mission, making them ideal for the transport and placement of sensors required to build an instrumented environment. Recent work in the field has focused on controllers for aerial interaction that account for compliance during contact-based tasks, omitting integration concerns that are critical to an automated solution. Furthermore, state-of-the-art flying base manipulators are often mechanically and computationally complex, reducing their endurance. Within this work, we present an interactive framework for autonomous sensor placement that incorporates both mechanical and software based compliance, optimised for use on a simple coplanar quadrotor. Under appropriate actuation and perception constraints, we detail the development of a control, perception, and motion planning strategy to enable sensor placement that relies solely on onboard computation and sensing, thus presenting a fully contained and accessible sensor placement approach capable of robust interaction with the environment. An extended finite-state machine is developed to facilitate automated mission planning. Extensive flight experiments are performed to validate the effectiveness of each sub-system, as well as the integrated solution. Experiments result in trajectory tracking errors under <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$10 \,\mathrm{mm}$</tex-math></inline-formula> as well as onboard mass estimation errors under <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$0.7 $</tex-math></inline-formula> % for sensors of various weights. A statistical analysis of 162 flight experiments shows the proposed framework's ability to autonomously place sensors within <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$10 \,\mathrm{cm}$</tex-math></inline-formula> of the target with a success rate of <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$93.8 $</tex-math></inline-formula> % and <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$95 $</tex-math></inline-formula> % confidence interval of (89%, 97%), thus confirming the robustness of our approach. <xref ref-type="fn" rid="fn1" xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">¹</xref>

Verification Approach for Refactoring Transformation Rules of State-Based Models

With the increased adoption of Model-Driven Engineering (MDE), where models are being used as the primary artifact of software, it is apparent that greater attention to the quality of the models is necessary. Traditionally, refactoring is used to enhance the quality of software systems at the source-code level; however, applying refactoring at the model level will have a more significant improvement on the system. After refactoring a model, proving that it still preserves its original behavior is crucial. In this paper, we present a process for applying refactoring transformations to the Extended Finite State Machine (EFSM) models using verified transformation rules that have been proven to preserve the model's original behavior. We provide a simplified three-step verification approach that can be used to prove that a transformation rule will generate a transformed model that is semantically equivalent to the original model. To do this, we formally define semantical equivalence at three different levels of granularity: models, sub-models, and transitions. Additionally, we introduce five model transformation rules and we demonstrate how our verification approach is used to prove the correctness of these rules. Finally, we present two case studies where we apply the proposed transformation process which adopts the five verified transformation rules. Using model testing, we show that applying a sequence of transformations using the verified transformation rules will keep both the original and the transformed model semantically equivalent. Additionally, the case studies show that model transformation can be used to enhance certain pre-defined model characteristics.

An automated framework for verifying or refuting trace properties of extended finite state machines

Model checkers and interactive proof assistants are both used in the assurance of critical systems. Where theorem proving involves the use of axioms and inference rules to mathematically prove defined properties, model checkers can be used to provide concrete counterexamples to refute them. Thus, the two techniques can be thought of as complementary, and it is helpful to use both in tandem to take advantage of their respective strengths. However, this requires us to translate our system model and our desired properties between the two tools which is a time-consuming and error prone process if done manually. The key contribution of this work is a set of automated tools to translate between the Isabelle/HOL proof assistant and the Symbolic Analysis Laboratory (SAL) model checker. We focus on systems specified as extended finite state machines (EFSMs) and on properties specified in linear temporal logic (LTL). We present our representations in the two tools and demonstrate the applicability of our system with respect to an academic example and two realistic case studies. This is a significant contribution to broadening the applicability of these formal approaches, since it allows two powerful verification tools to be easily used in tandem without the risk of human error.

A Research for Executable Path Automatic Generation Method Based on EFSM

Extended finite state machine (EFSM) is currently one of the most widely used model in the field of software testing. EFSM model is an enhanced model based on finite state machine (FSM). Automated test data generation is still a challenging problem due to the complexity of EFSM which extends the input and output parameters, context variables as well as the predicate condition. These reasons lead to conflict of the context variable with the enable conditions in the transition path. In order to avoid infeasible path generation, this paper proposes a method based on modified breadth first search to generate feasible transition path (MBFS-FTP). To solve the problem of state explosion in path generation, this paper converts state diagram to transition diagram on EFSM model. In order to make the EFSM static model can be driven execution, this paper uses UML model and generate executable model, so that implements EFSM execute dynamically. When using breadth-first search algorithm (MBFS) on every target transition to generate an executable transition path, the conflict detection algorithm is utilized to the transition path for conflict decision, avoiding the occurrence of an infeasible transition path. Considering target transition has multiple feasible transition paths, this paper combines suggested penalized value of definition-predicate-use (def-p-use) pair and length of feasible transition path, and then develops the measurement method of feasible transition path, and obtained a set of feasible transition path containing all of transitions. Through the experiment on two actual EFSM model, verifying the effectiveness of MBFS-FTP for feasible transition automatic generation, the experimental results show that MBFS-FTP can reduce the feasible transition path length, and make transition paths are more easily to be triggered at the times of generating test cases lately, furthermore, it can improve the efficiency of generate feasible transition path and save a lot of time.

N-Switch and All-Path Test Coverage Criterion for Extended Finite State Machine

N-Switch and All-Path Test Coverage Criterion for Extended Finite State Machine

Modeling and Security Verification of State-Based Smart Contracts

Smart contracts are programs that are stored on a blockchain ledger with code immutable after deployment. Thus, verifying the correct behavior of smart contracts before deployment is vital. This paper demonstrates how a security vulnerability verification in a casino smart contract can be transformed to non-blocking verification. To this end, the contract is first modeled as interacting extended finite state machines (EFSM), with one EFSM for each function. Modeling the security vulnerability as a condition in the EFSM system, non-blocking verification reveals the system to be blocking. Investigating the counterexample produced by the verification shows that a transfer that is refused by its receiver may block the casino so that all remaining funds are forever locked into the contract, thus revealing a severe vulnerability. It is then demonstrated how the same technique can show the absence of this vulnerability, by verifying that the EFSM model of an improved casino contract is indeed non-blocking.

Assessing test suites of extended finite state machines against model‐ and code‐based faults

SummaryTests can be derived from extended finite state machine (EFSM) specifications considering the coverage of single‐transfer faults, all transitions using a transition tour, all‐uses, edge‐pair, and prime path with side trip. We provide novel empirical assessments of the effectiveness of these test suites. The first assessment determines for each pair of test suites if there is a difference between the pair in covering EFSM faults of six EFSM specifications. If the difference is found significant, we determine which test suite outperforms the other. The second assessment is similar to the first; yet, it is carried out against code faults of 12 Java implementations of the specifications. Besides, two assessments are provided to determine whether test suites have better coverage of certain classes of EFSM (or code) faults than others. The evaluation uses proper data transformation of mutation scores and p‐value adjustments for controlling Type I error due to multiple tests. Furthermore, we show that subsuming mutants have an impact on mutation scores of both EFSM and code faults; and accordingly, we use a score that removes them in order not to invalidate the obtained results. The assessments show that all‐uses tests were outperformed by all other tests; transition tours outperformed both edge‐pair and prime path with side trips; and single‐transfer fault tests outperformed all other test suites. Similar results are obtained over the considered EFSM and code fault domains, and there were no significant differences between the test suites coverage of different classes of EFSM and code faults.

Real-Time Fault Diagnosis and Fault-Tolerant Control Strategy for Hall Sensors in Permanent Magnet Brushless DC Motor Drives

The Hall sensor is the most commonly used position sensor of the permanent magnet brushless direct current (PMBLDC) motor. Its failure may lead to a decrease in system reliability. Hence, this article proposes a novel methodology for the Hall sensors fault diagnosis and fault-tolerant control in PMBLDC motor drives. Initially, the Hall sensor faults are analyzed and classified into three fault types. Taking the Hall signal as the system state and the conducted MOSFETs as the system event, the extended finite state machine (EFSM) of the motor in operation is established. Meanwhile, a motor speed observer based on the super twisting algorithm (STA) is designed to obtain the speed signal of the proposed strategy. On this basis, a real-time Hall sensor fault diagnosis strategy is established by combining the EFSM and the STA speed observer. Moreover, this article proposes a Hall signal reconstruction strategy, which can generate compensated Hall signal to realize fault-tolerant control under single or double Hall sensor faults. Finally, theoretical analysis and experimental results validate the superior effectiveness of the proposed real-time fault diagnosis and fault-tolerant control strategy.

Model-based test case generation from UML sequence diagrams using extended finite state machines

The effectiveness of model-based testing (MBT) is mainly due to its potential for automation. If the model is formal and machine-readable, test cases can be derived automatically. One of the most used formal modeling techniques is the interpretation of a system as an extended finite state machine (EFSM). However, formal models are not a common practice in the industry. The Unified Modeling Language (UML) has become the de facto standard for software modeling. Nevertheless, due to the lack of formal semantics, its diagrams can be given ambiguous interpretations and are not suitable for testing automation. This article introduces a systematic procedure for the generation of tests from UML models that uses concepts of model-driven engineering (MDE) for formalizing UML sequence diagrams into extended finite state machines and providing a precise semantics for them. It also applies ModelJUnit and JUnit libraries for an automatic generation of test cases. A case study was conducted in a real software towards the evaluation of its applicability.

Generating feasible protocol test sequences from EFSM models using Monte Carlo tree search

Feasible test sequences generation is a key step in protocol conformance testing based on the Extended Finite State Machine (EFSM) model. To guarantee the feasibility of generated test sequences, transition executability analysis (TEA) technique is widely applied in automatic test derivation. However, the TEA method often suffers from the famous state explosion problem, which has become a major obstacle to its efficient application.

Mitigating TCP Protocol Misuse With Programmable Data Planes

This article proposes a new approach for detecting and mitigating the impact of misbehaving TCP end-hosts, specifically the Optimistic ACK attack, and Explicit Congestion Notification (ECN) abuse. In contrast to the state-of-the-art, we show that it is possible to mitigate such misbehavior leveraging emerging programmable data planes while not requiring any end-host or protocol modifications. A key challenge in doing so is to implement expressive, complex and stateful functions in the data plane within its restricted programming model. In this regard, we propose a security monitoring function that uses Extended Finite State Machine (EFSM) abstraction for monitoring stateful protocols in the data plane. We also design a mechanism for mapping a protocol’s EFSM to programmable data plane primitives. Our evaluation results demonstrate that our approach can fully or partially restore the throughput loss caused by misbehaving end-hosts that manipulate TCP congestion control through misinformation.

Composable Finite State Machine-based Modeling for Quality-of-Information-aware Cyber-physical Systems

Time plays a major role in the specification of Cyber-physical Systems (CPS) behavior with concurrency, timeliness, asynchrony, and resource limits as their main characteristics. In addition to timeliness , the specification of CPS needs to assess and unambiguously define its behavior with respect to the other Quality-of-Information (QoI) properties: (1) Correctness, (2) Completeness, (3) Consistency, and (4) Accuracy. Very often, CPS need to handle these QoI properties, and any combination thereof, multiple times when performing computation and communication processes. However, a model-driven and systematic approach to specify CPS behavior that jointly considers combined QoI aspects is possible but missing in existing methodologies. As the first contribution of this work, we provide an extension to an established model of computation (MoC) based on “Functions driven by Finite State Machine” (FunState) to enable a model-driven composition mechanism to create CPS behavior specifications from reusable components. Second, we present a novel set of design patterns to illustrate the modeling of QoI-aware CPS specifications that can be applied in several state-of-the-art Electronic System Level (ESL) methodologies. The time semantics of the MoC are formalized using the tagged-signal-model, and the presented model-driven approach enables the composition of multiple design patterns. The main benefits of the presented model-driven approach and design patterns to create CPS specifications are as follows: (a) reduce modeling effort, errors, and time through the reuse of known recipes to re-incurring tasks and allow to automatically generate repetitive control flows based on extended Finite State Machines; (b) increase system robustness and facilitate the creation of holistic QoI management allowing to unambiguously define system behavior for scenarios with single/multiple QoI requirement violations in different models of computation; (c) dynamically validate timing behavior of system implementations to enable a multi-objective optimization of nonfunctional properties that influence CPS timing. We demonstrate the aforementioned benefits through the modeling and evaluation of an infrastructure-assisted automated driving case study using Infrastructure-to-Vehicle (I2V) communications to distribute QoI critical road environment information.

A Learn-to-Rank Method for Model-Based Regression Test Case Prioritization

Regression testing plays an indispensable role in software maintenance, which refers to retest the software following modifications to determine whether the changes have introduced new faults. However, regression testing requires massive amounts of effort to achieve a high fault detection rate. To address this issue, the test case prioritization technique is used to improve the fault detection rate by adjusting the execution order of test cases. For model-based regression test case prioritization, existing approaches have been developed using the single aspect of model-related information extracted from the previous executed test cases. In this paper, a novel learn-to-rank technique is proposed to prioritize test cases by combining the multidimensional features of Extended Finite State Machine (EFSM) under test to improve fault detection rate. Specifically, our method utilizes the random forest algorithm to combine multiple existing heuristic prioritization methods. Detailed experiments are conducted to evaluate the proposed method’s performance in terms of Average Percentage Fault Detected (APFD). The experimental results show that the mean APFD value of our method reaches 0.884 for five subject EFSMs, which is 33.9% higher than the compared methods.

Fundamental results for learning deterministic extended finite state machines from queries

Regular language inference, initiated by Angluin, has many developments, including applications in software engineering and testing. However, the capability of finite automata to model the system data is quite limited and, in many cases, extended finite state machine formalisms, that combine the system control with data structures, are used instead. The application of Angluin-style inference algorithms to extended state machines would involve constructing a minimal deterministic extended finite state machine consistent with a deterministic 3-valued deterministic finite automaton. In addition to the usual, accepting and rejecting, states of finite automaton, a 3-valued deterministic finite automaton may have “don't care” states; the sequences of inputs that reach such states may be considered as accepted or rejected, as is convenient. The aforementioned construction reduces to finding a minimal deterministic finite automaton consistent with a 3-valued deterministic finite automaton, that preserves the deterministic nature of the extended model that also handles the data structure associated with it. This paper investigates fundamental properties of extended finite state machines in relation to Angluin's language inference problem and provides an inference algorithm for such models.

ReFSM: Reverse engineering from protocol packet traces to test generation by extended finite state machines

Protocol reverse engineering is helpful to automatically obtain the specifications of protocols that are useful for network management, network security systems and test case generation tools. To achieve better accuracy, these kinds of applications require good models that can capture not only the order of exchanging messages (control flow aspect) but also the data being transmitted (data flow aspect). However, current techniques only focus on inferring the control flow represented as a Finite State Machine (FSM) and without interpreting the data flow. The Extended Finite State Machine (EFSM), embedding memory in the states and data guard in the FSM transitions, is a method commonly used to represent the data flow. In this work, we propose ReFSM, a novel approach to infer the EFSMs of protocols from only network packet traces. The proposed method is evaluated by using datasets of real-world network traffic traces of four protocols: FTP, SMTP, BitTorrent and PPLive. Based on the results, the coverage, accuracy scores of correctness and behavior of inferred models are always higher than 90%. The precision and recall values of message type identification are, at least, well above 94% and 96%, respectively. The inferred EFSMs are close to the correct model derived from protocol specification.

Synthesis of least restrictive controllable supervisors for extended finite-state machines with variable abstraction

This paper presents an algorithm that combines modular synthesis for extended finite-state machines (EFSM) with abstraction of variables by symbolic manipulation, in order to compute least restrictive controllable supervisors. Given a modular EFSM system consisting of several components, the proposed algorithm synthesises a separate supervisor for each specification component. To synthesise each supervisor, the algorithm iteratively selects components (plants and variables) from a synchronous composition until a least restrictive controllable solution is obtained. This improves on previous results of the authors where abstraction is only performed by the selection of components and not variables. The paper explains the theory of EFSM synthesis and abstraction and its algorithms. An example of a flexible manufacturing system illustrates how the proposed algorithm works to compute a modular supervisor.