Formal Verification Environment Research Articles

Non-Invasive Hardware Trojans Modeling and Insertion: A Formal Verification Approach

In modern chip designs, shared resources are used extensively. Arbiters usage is crucial to settle conflicts when multiple requests compete for these shared resources. Making sure these arbiter circuits work correctly is vital not just for their proper functionality, but also for security reasons. The work in this paper introduces a method based on formal verification to thoroughly assess the proper functional aspects of various arbiter setups. This is achieved through SystemVerilog assertions and model checking. Additionally, we explore a non-invasive method for the modeling and insertion of different types of hardware Trojans. These Trojans, with their unique triggers and payloads, are modeled formally without the need for any alterations to the actual circuit. The results provide a detailed analysis of the cost involved in running the formal verification environment on versions of arbiters that are free from Trojans. This analysis is carried out using Questa PropCheck formal analysis tool, which offers valuable insights into the time and memory resources required. Furthermore, the results highlights how the formally modeled and inserted Trojans interfere with hold criteria of the arbiters’ properties, where at least a single property fires due to the inserted Trojan. This work can be extended to be a generic approach with the potential to validate both the proper operation and security aspects of complex systems.

Model Checking for Real-Time Attack Detection in Water Distribution Systems

Water distribution systems represents critical infrastructures. These architectures are really critical and an irregular behaviour can be reflected in human safety. As a matter of fact, an attacker obtaining the control of such of an architecture is able to perpetrate a plethora of damages, both to the infrastructure but also to people. In this paper, we propose an approach to identify irregular behaviours focused on water distribution systems. The designed approach considers formal verification environment. The logs retrieved from water distribution systems are parsed into a formal model and, by exploiting timed temporal logic, we characterize the behaviour of a water distribution system while an attack is happening. The evaluation, referred to a water distribution system, confirmed the effectiveness of the designed approach in the identification of three different irregular behaviours.

Assuring Intelligent Systems: Contingency Management for UAS

Unmanned aircraft systems (UAS) collaborate with humans to operate in diverse, safety-critical applications. However, assurance technologies need to be integrated into the design process in order to guarantee safe behavior, thereby enabling UAS operations in the National Airspace System (NAS). In this paper, formal methods are integrated with learning-enabled systems representations. The generation and representation of knowledge are captured via monadic second-order logic rules in the cognitive architecture Soar. These rules are translated into timed automata, and a proof of correctness for the translation is provided so that safety and liveness properties can be checked in the formal verification environment Uppaal. This approach is agnostic to the learning mechanism used to generate the learned rules (e.g., chunking, etc.). An example of a fault-tolerant, learning-enabled UAS deciding which of four contingency procedures to execute under a lost link scenario while overflying an urban area is used to illustrate the approach.

A trustworthy mechanized formalization of R

The R programming language is very popular for developing statistical software and data analysis, thanks to rich libraries, concise and expressive syntax, and support for interactive programming. Yet, the semantics of R is fairly complex, contains many subtle corner cases, and is not formally specified. This makes it difficult to reason about R programs. In this work, we develop a big-step operational semantics for R in the form of an interpreter written in the Coq proof assistant. We ensure the trustworthiness of the formalization by introducing a monadic encoding that allows the Coq interpreter, CoqR, to be in direct visual correspondence with the reference R interpreter, GNU R. Additionally, we provide a testing framework that supports systematic comparison of CoqR and GNU R. In its current state, CoqR covers the nucleus of the R language as well as numerous additional features, making it pass a significant number of realistic test cases from the GNU R and FastR projects. To exercise the formal specification, we prove in Coq the preservation of memory invariants in selected parts of the interpreter. This work is an important first step towards a robust environment for formal verification of R programs.

Model checking for malicious family detection and phylogenetic analysis in mobile environment

Malware targeting mobile devices is widespread, in fact considering the great amount of sensitive and private information stored in tablets and smartphones they represent an interesting surface attack for malware developers. From the defensive side, the well-known weaknesses of the current anti-malware technologies do not permit only the detection of new obfuscated malicious payloads, but also of obfuscated malware (even with trivial obfuscation techniques applied with automatic morphing engines). In fact, a threat is recognized only if its signature is present in the anti-malware repository and typically the signature extraction consists in a time consuming task performed by security analysts. In this paper we propose a two-fold method aimed to (i) detect the belonging family of a mobile malicious application and (ii) collocate the application in the right position in the phylogenetic tree. We represent application system call traces in terms of automaton and, through the adoption of process mining, we extract temporal logic property verified with the adoption of a formal verification environment. The evaluation on a data-set composed by more than 12,000 Android applications (4552 malicious ranging from 2010 to 2018, 4552 obfuscated with three different obfuscation engines and 3500 legitimate) confirms the effectiveness of the proposed formal methods-based approach, obtaining an accuracy ranging from 0.882 to 0.987 in the analysis of 12 real-world widespread malicious families implementing different behaviours.

Formal methods for prostate cancer Gleason score and treatment prediction using radiomic biomarkers

Prostate cancer is a significant public health burden and a major cause of morbidity and mortality among men worldwide. Only in 2018 were reported 1.3 million of new diagnosed patients. Usually an invasive trans-perineal biopsy is the way to diagnose prostate cancer grade by prostate tissue removal. In this paper we propose a non invasive method to detect the prostate cancer grade (the so-called Gleason score) by computing radiomic biomarkers from magnetic resonance images. Furthermore, the proposed method predicts whether the cancer is suitable for the surgery treatment basing on the pathologist and surgeon suggestions. We represent patient magnetic resonances in terms of formal models and, through an algorithm designed by authors, we infer a set of properties aimed to predict the Gleason score and the treatment. By exploiting a formal verification environment, the properties are verified on two different real-world data-sets, the first one is composed of 36 patients, while the second one of 26, confirming the effectiveness of the proposed method.

Model Checking Based Approach for Compliance Checking


 
 
 Process mining is the set of techniques to retrieve a process model starting from available logging data. The discovered process model has to be analyzed to verify it respects the defined properties, i.e., the so-called compliance checking. Our aim is to use a model checking based approach to verify compliance. First, we propose an integrated-tool approach using existing tools as ProM (a framework supporting process mining techniques) and CADP (a formal verification environment). More precisely, the execution traces from a software system are extracted. Then, using the “Mine Transition System” plugin in ProM, we obtain a labelled transition system, that can be easily used to verify formal properties trough CADP. However, this choice presents the “state explosion” problem, i.e., models discovered through the classical process mining techniques tend to be large and complex. In order to solve this problem, another custom-made approach is shown, which accomplishes a pre- processing on the traces to obtain abstract traces, where abstraction is based on the set of temporal logic formulae specifying the system properties. Then, from the set of abstracted traces, we discover a system described in Lotos, a process algebra specification language; in this way we do not build an operational model for the system, but we produce only a language description from which a model checking environment will automatically obtain the reduced corresponding transition system. Real systems have been used as case studies to evaluate the proposed methodologies.
 
 

Heterogeneous verification in the context of model driven engineering

In some cases it may be useful to represent a problem in many logical domains, since they provide different perspectives for addressing formal verification. However, the maintenance of multiple representations in separate domains can be expensive if there is neither automated assistance nor a clear formal relation between these domains. We have addressed this problem in the context of Model-Driven Engineering (MDE). We defined solid foundations of a theoretical environment for formal verification using heterogeneous verification approaches. The environment is based on the Theory of Institutions which provides a sound basis for representing MDE elements and a way for specifying translations from these elements to other domains used for verification. In this paper we present how this environment can be supported in practice within the Heterogeneous Tool Set (Hets). Hets supports heterogeneous specifications and provides capabilities for monitoring the overall correctness of a heterogeneous proof. We first extend the theoretical environment with the inclusion of an institution for the Object Constraint Language (OCL), and then we define semantic-preserving translations from the OCL-constrained MDE elements to a core language of Hets. With this we can verify basic properties of our specification, and then use the existent connections between logical domains within Hets for broadening the spectrum of domains in which complementary verification properties can be addressed.

Hierarchical Design Method for Multi-Agent Systems

This paper proposes a new hierarchical design method for the specification and the verification of multi agent systems (MAS). For this purpose, the authors propose the model of Refinable Recursive Petri Nets (RRPN) under a maximality semantics. In this model, a notion of undefined transitions is considered. The underlying semantics model is the Abstract Maximality-based Labeled Transition System (AMLTS). Hence, the model supports a definition of a hierarchical design methodology. The example of goods transportation is used for illustrating the approach. For the system assessment, the properties are expressed in CTL logic and verified using the verification environment FOCOVE (Formal Concurrency Verification Environment).

The bedrock structured programming system

We report on the design and implementation of an extensible programming language and its intrinsic support for formal verification. Our language is targeted at low-level programming of infrastructure like operating systems and runtime systems. It is based on a cross-platform core combining characteristics of assembly languages and compiler intermediate languages. From this foundation, we take literally the saying that C is a "macro assembly language": we introduce an expressive notion of certified low-level macros, sufficient to build up the usual features of C and beyond as macros with no special support in the core. Furthermore, our macros have integrated support for strongest postcondition calculation and verification condition generation, so that we can provide a high-productivity formal verification environment within Coq for programs composed from any combination of macros. Our macro interface is expressive enough to support features that low-level programs usually only access through external tools with no formal guarantees, such as declarative parsing or SQL-inspired querying. The abstraction level of these macros only imposes a compile-time cost, via the execution of functional Coq programs that compute programs in our intermediate language; but the run-time cost is not substantially greater than for more conventional C code. We describe our experiences constructing a full C-like language stack using macros, with some experiments on the verifiability and performance of individual programs running on that stack.

From Web Service Artifact to a Readable and Verifiable Model

Models of Web service compositions that are both readable and verifiable will benefit organizations that integrate purportedly reusable Web services. Colored Petri nets (CPNs) are at once verifiable and visually expressive, capable of presenting subtle flaws in service composition. Constructing CPN models from business process execution language (BPEL) artifacts had been a manual process requiring human judgment. Building on results from the workflow community, we automate the mapping of artifacts written in BPEL to models used by CPN Tools - a formal verification environment for development, simulation, and model checking of colored Petri nets. We extend related work that already converts BPEL to Petri nets, to reflect hierarchy and data type (color in CPN terminology), while improving model layout. We present a prototype implementation that mines both a BPEL artifact and the Petri net generated from it by an existing tool. The prototype partitions the Petri net into subnets, lays them out, colors them, and generates their XML file for import into CPN tools. Our results include depictions of subnets produced and initial simulation results for a well-known case study.

An industrially effective environment for formal hardware verification

The Forte formal verification environment for datapath-dominated hardware is described. Forte has proven to be effective in large-scale industrial trials and combines an efficient linear-time logic model-checking algorithm, namely the symbolic trajectory evaluation (STE), with lightweight theorem proving in higher-order logic. These are tightly integrated in a general-purpose functional programming language, which both allows the system to be easily customized and at the same time serves as a specification language. The design philosophy behind Forte is presented and the elements of the verification methodology that make it effective in practice are also described.

Assertion checking environment (ACE) for formal verification of C programs

In this paper we describe an Assertion Checking Environment (ACE) for compositional verification of programs, which are written in an industrially sponsored safe subset of C programming language called MISRA C [Guidelines for the Use of the C Language in Vehicle Based Software, 1998]. The theory is based on Hoare logic [Commun. ACM 12 (1969) 576] and the C programs are verified using static assertion checking technique. First the functional specifications of the program, captured in the form of pre - and post -conditions for each C function, are derived from the specifications. These pre - and post -conditions are then introduced as assertions (also called annotations or formal comments) in the program code. The assertions are then proved formally using ACE and theorem proving tool called Stanford Temporal Prover [The Stanford Temporal Prover User's Manual, 1998]. ACE has been developed by us and consists mainly of a translator c2spl , a GUI and some utility programs. The technique and tools developed are targeted towards verification of real-time embedded software.

Efficient debugging in a formal verification environment

In this paper, we emphasize the importance of efficient debugging in formal verification and present capabilities that we have developed in order to aid debugging in Intel's Formal Verification Environment. We have given the name Counter-Example Wizard to the bundle of capabilities that we have developed to address the needs of the verification engineer in the context of counter-example diagnosis and rectification. The novel features of the Counter-Example Wizard are the multivalue counter-example annotation, constraint-based debugging, and multiple counter-example generation mechanisms. Our experience with the verification of real-life Intel designs shows that these capabilities complement one another and can help the verification engineer diagnose and fix a reported failure. We use real-life verification cases to illustrate how our system solution can significantly reduce the time spent in the loop of model checking, specification, and design modification.

PERTS: an environment for specification and verification of reactive systems

Abstract In this paper, we describe the design and implementation of an environment for specification, analysis and verification of reactive systems. The environment allows the user to develop specification in the graphical formalism of Statecharts and analyze them using a simulation tool. A built-in translator tool translates the specification into an Esterel program for the purpose of carrying out verification. Through such an approach, we have been able to integrate the powerful graphical formalism of Statecharts, which is very appealing to engineers, and the power of the formal verification environment of Esterel. Since we translate Statecharts, which can be non-deterministic, to Esterel programs, which are fully deterministic, the system overcomes the non-determinism in the specifications by enforcing priority. The behavior of Esterel programs generated by the translator follow Harel and Naamad's ‘step’ semantics. In the paper, we describe the main components of the PERTS environment and the principles underlying the translation and illustrate the use of the system for specification and verification using an example.

A Formal Verification Environment for Railway Signaling System Design

A fundamental problem in the design and development of embedded control systems is the verification of safety requirements. Formal methods, offering a mathematical way to specify and analyze the be...

An environment for formal verification based on symbolic computations

We present an environment for formally verifying hardware, based on symbolic computations. This includes a new concurrency model, called the combinational/sequential or C/S concurrency model which has close ties to hardware. We allow fairness constraints and describe methods for specifying them and for formally verifying in their presence. Properties are specified by either CTL formulae or edge-Rabin automata. We give algorithms, in the presence of fairness constraints, for model checking CTL or for checking that the language of our system is contained in the language of a property automation. Finally, techniques are given for hierarchical verification and for detecting errors quickly (early failure detection).

Formal verification of VHDL descriptions in the Prevail environment

Prevail, a formal verification environment for proving the equivalence of two very-high-speed integrated circuit hardware description language (VHDL) design architectures, is described. For simple bit-level combinational descriptions, the environment calls upon a tautology checker. For parameterized repetitive structures and for more abstract sequential designs, the program translates descriptions into recursive functions according to predefined templates and generates a theorem acceptable to the Bover-Moore theorem prover. The specification, implementation, and functional representation of a sequential example are presented. >