Runtime Verification Techniques Research Articles

Elements of Timed Pattern Matching

The rise of machine learning and cloud technologies has led to a remarkable influx of data within modern cyber-physical systems. However, extracting meaningful information from this data has become a significant challenge due to its volume and complexity. Timed pattern matching has emerged as a powerful specification-based runtime verification and temporal data analysis technique to address this challenge. In this paper, we provide a comprehensive tutorial on timed pattern matching that ranges from the underlying algebra and pattern specification languages to performance analyses and practical case studies. Analogous to textual pattern matching, timed pattern matching is the task of finding all time periods within temporal behaviors of cyber-physical systems that match a predefined pattern. Originally we introduced and solved several variants of the problem using the name of match sets, which has evolved into the concept of timed relations over the past decade. Here we first formalize and present the algebra of timed relations as a standalone mathematical tool to solve the pattern matching problem of timed pattern specifications. In particular, we show how to use the algebra of timed relations to solve the pattern matching problem for timed regular expressions and metric compass logic in a unified manner. We experimentally demonstrate that our timed pattern matching approach performs and scales well in practice. We further provide in-depth insights into the similarities and fundamental differences between monitoring and matching problems as well as regular expressions and temporal logic formulas. Finally, we illustrate the practical application of timed pattern matching through two case studies, which show how to extract structured information from temporal datasets obtained via simulations or real-world observations. These results and examples show that timed pattern matching is a rigorous and efficient technique in developing and analyzing cyber-physical systems.

Monitoring of spatio-temporal properties with nonlinear SAT solvers

The automotive industry is increasingly dependent on computing systems with different critical requirements. The verification and validation methods for these systems are now leveraging complex AI methods, for which the decision algorithms introduce non-determinism, especially in autonomous driving. This paper presents a runtime verification technique agnostic to the target system, which focuses on monitoring spatio-temporal properties that abstract the evolution of objects’ behavior in their spatial and temporal flow. First, a formalization of three known traffic rules (from the Vienna convention on road traffic) is presented, where a spatio-temporal logic fragment is used. Then, these logical expressions are translated to a monitoring model written in first-order logic, where they are processed by a non-linear satisfiability solver. Finally, the translation allows the solver to check the validity of the encoded properties according to an instance of a specific traffic scenario (a trace). The results obtained from our tool, which automatically generates a monitor from a formula, show that our approach is feasible for online monitoring in a real-world environment.

Distributed runtime verification of metric temporal properties

Distributed Systems are often composed of geographically separated components, where the clocks may not be perfectly synchronized. As such verifying the correctness of such system properties are a major challenge and are of utmost importance. In this paper, we describe a centralized runtime monitoring technique for distributed system. First, we propose a generalized runtime verification technique for verifying partially synchronous distributed computations for the metric temporal logic (MTL) by exploiting bounded-skew clock synchronization. Second, we introduce a progression-based formula rewriting scheme for monitoring MTL specifications which employs SMT solving techniques and report experimental results. Third, we also quantify each event according to the possible time of occurrence and calculate the probabilistic guarantee for generating the verification verdict. Lastly, we have implemented the entire procedure and report on extensive synthetic experimental results using UPPAAL, a set of cross-chain transactions implemented on Ethereum and an Industrial Control System of a water treatment plant.

Bringing runtime verification home: a case study on the hierarchical monitoring of smart homes using decentralized specifications

We use runtime verification (RV) to check various specifications in a smart apartment. The specifications can be broken down into three types: behavioral correctness of the apartment sensors, detection of specific user activities (known as activities of daily living), and composition of specifications of the previous types. The context of the smart apartment provides us with a complex system with a large number of components with two different hierarchies to group specifications and sensors: geographically within the same room, floor or globally in the apartment, and logically following the different types of specifications. We leverage a recent approach to decentralized RV of decentralized specifications, where monitors have their own specifications and communicate together to verify more general specifications. We leverage the hierarchies, modularity and re-use afforded by decentralized specifications to: (1) scale beyond existing centralized RV techniques, and (2) greatly reduce computation and communication costs.

FinalFilter: Asserting Security Properties of a Processor at Runtime

In an ideal world, it would be possible to build a provably correct and secure processor. However, the complexity of today's processors puts this ideal out of reach. The complete verification of a modern processor remains intractable. Statically verifying even a simple security property -for example, privilege escalation never occurs -remains beyond the state of the art in formal verification. Testing can complement formal verification methods, yet testing is incomplete and bugs in the hardware that leave it vulnerable continue to elude test suites. Further, a crafty malicious actor can evade typical testing coverage metrics. Recent efforts, including that of three of the authors, have explored the use of static analysis on the design files (e.g., hardware description level source code or gate-level netlists) to find suspicious circuitry. These techniques rely on heuristics to define patterns that indicate a likely trojan and then search for instances in the design that match the pattern. However, malicious circuitry that does not match the pattern will be missed, as will inadvertent bugs that open vulnerabilities. By the time the weakness is uncovered, the hardware is already in the end user's hands and vulnerable to attack. In the absence of a full proof of correctness, what is needed is a final filter: a runtime verification technique that works-postdeployment-to detect and respond to security property violations as they occur during execution. In this article, we make the case for final filters using our tool, FinalFilter, as a case study.

Monitoring hyperproperties

Hyperproperties, such as non-interference and observational determinism, relate multiple system executions to each other. They are not expressible in standard temporal logics, like LTL, CTL, and CTL*, and thus cannot be monitored with standard runtime verification techniques. text {HyperLTL} extends linear-time temporal logic (LTL) with explicit quantification over traces in order to express hyperproperties. We investigate the runtime verification problem of text {HyperLTL} formulas for three different input models: (1) The parallel model, where a fixed number of system executions is processed in parallel. (2) The unbounded sequential model, where system executions are processed sequentially, one execution at a time. In this model, the number of incoming executions is a-priori unbounded and may in fact grow forever. (3) The bounded sequential model where the traces are processed sequentially and the number of incoming executions is bounded. We show that the existence of a bound in the parallel and bounded sequential models leads to a different notion of monitorability than in the unbounded sequential model. We show that deciding the monitoriability problem for alternation-free HyperLTL is textsc {PSpace}-complete while the problem is undecidable in general. For every input model, we provide monitoring algorithms along with run-time and storage optimizations. By recognizing properties of specifications such as reflexivity, symmetry, and transitivity, we reduce the number of comparisons between traces. For the sequential models, we present a technique that minimizes the number of traces that need to be stored. We evaluate our optimizations, showing that this leads to a more scalable monitoring and, in particular, a significantly lower memory consumption.

Behavioral model identification and classification of multi-component systems

Learning model from the execution traces has been considered in several domains such as traffic classification, malware detection, and software engineering since it distinguishes which processes actually executed through their traces. Behavioral model learning and classification (in terms of learned models) are taken into accounts to eliminate the shortages of models derived based on non-behavioral features and improve the resulting classifications. So far, no general method has been proposed to automatically derive behavioral models. To this aim, we assume that the models of applications can be abstractly defined in terms of how they execute their depending components, well-known in the domain. To automatically derive such models, we extend the passive automata learning by considering the behavior of the depending components in addition to the observed behaviors. The state merging algorithm of the learning process is equipped with a new equivalence relation which aggregate states modulo counter abstraction of symmetric reduction. To improve the generated model to cover unobserved behaviors, we leverage the technique of complex event processing to complete the model with the unseen interleaving of actions due to the concurrent execution of components. The derived models, specified by parametrized transition systems, can distinguish different executions of instances of each component by assigning a unique symbolic identifier to each instantiation and parameterizing actions with such identifiers. The learned models are used to distinguish the executions of applications in an interleaved execution trace of different systems. The detection procedure is more complicated for parametric models because of the need for relating the information of the trace to symbolic identifiers as the parameters. We utilize runtime verification techniques in a three-step novel approach so as to enhance the performance of the matching process for a trace. To illustrate the applicability of our approach, we have employed it for traffic classification in the network domain and then applied it on some real applications. To demonstrate the effectiveness of our approach in this domain, we compare it to related approaches in terms of their true positive rate, false positive rate, and test time. Our results indicate that our technique prevents including invalid traces so that unobserved behaviors are covered with an acceptable precision. • We extend the passive automata learning for multi-component applications. • The learning approach aggregates those states preserving the behavior of components. • We provide an automata-based classifier based on the runtime verification technique. • We compare our classifier with statistical ones for network applications.

Introduction to the special issue on runtime verification

This article introduces the extended versions of selected papers from the refereed proceedings of the 16th International Conference on Runtime Verification (RV 2016) held in Madrid, Spain, in September 2016. Runtime verification encompasses all aspects of monitoring and analysis of hardware, software, and system executions in general. Runtime verification techniques are lightweight dynamic techniques to assess and enforce correctness, reliability, and robustness during system execution. These techniques are significantly more powerful and versatile than conventional testing, and more practical than exhaustive formal verification (at the price of incomplete coverage).

Democratization of runtime verification for internet of things

Internet of Things (IoT) devices have gained more prevalence in ambient assisted living (AAL) systems. Reliability of AAL systems is critical especially in assuring the safety and well-being of elderly people. Runtime verification (RV) is described as checking whether the observed behavior of a system conforms to its expected behavior. RV techniques generally involve heavy formal methods; thus, it is poorly utilized in the industry. Therefore, we propose a democratization of RV for IoT systems by presenting a model-based testing (MBT) approach. To enable modeling expected behaviors of an IoT system, we first describe an extension to a UML profile. Then, we capture the expected behavior of an interaction that is modeled on a Sequence Diagram (SD). Later, the expected behaviors are translated into runtime monitor statements expressed in Event-Processing Language (EPL), which are executed at the edge of the IoT network. We further demonstrate our contributions on a sample AAL system.

Introduction to the special issue on runtime verification

Runtime verification (RV) consists of a broad collection of light-weight scalable analysis techniques to verify and to guarantee at runtime important properties such as correctness, safety, reliability, security, and robustness. The papers in this special issue address some of the RV core problems providing an overview of a wide range of application domains where RV tools and techniques are currently employed. The papers are based on selected contributions from the 2015 Conference on Runtime Verification, an annual forum for scientists from both academia and industry to discuss on how to monitor, analyze and guide the execution of programs and from the 2015 Workshop on Static Analysis meets Runtime Verification.

Predictive runtime verification of timed properties

Runtime verification (RV) techniques are used to continuously check whether the (un-trustworthy) output of a black-box system satisfies or violates a desired property. When we consider runtime verification of timed properties, physical time elapsing between actions influences the satisfiability of the property. This paper introduces predictive runtime verification of timed properties where the system is not entirely a black-box but something about its behaviour is known a priori. A priori knowledge about the behaviour of the system allows the verification monitor to foresee the satisfaction (or violation) of the monitored property. In addition to providing a conclusive verdict earlier , the verification monitor also provides additional information such as the minimum (maximum) time when the property can be violated (satisfied) in the future. The feasibility of the proposed approach is demonstrated by a prototype implementation, which is able to synthesize predictive runtime verification monitors from timed automata.

Verifying data- and control-oriented properties combining static and runtime verification: theory and tools

Static verification techniques are used to analyse and prove properties about programs before they are executed. Many of these techniques work directly on the source code and are used to verify data-oriented properties over all possible executions. The analysis is necessarily an over-approximation as the real executions of the program are not available at analysis time. In contrast, runtime verification techniques have been extensively used for control-oriented properties, analysing the current execution path of the program in a fully automatic manner. In this article, we present a novel approach in which data-oriented and control-oriented properties may be stated in a single formalism amenable to both static and dynamic verification techniques. The specification language we present to achieve this that of ppDATEs, which enhances the control-oriented property language of DATEs, with data-oriented pre/postconditions. For runtime verification of ppDATE specifications, the language is translated into a DATE. We give a formal semantics to ppDATEs, which we use to prove the correctness of our translation from ppDATEs to DATEs. We show how ppDATE specifications can be analysed using a combination of the deductive theorem prover KeY and the runtime verification tool LARVA. Verification is performed in two steps: KeY first partially proves the data-oriented part of the specification, simplifying the specification which is then passed on to LARVA to check at runtime for the remaining parts of the specification including the control-oriented aspects. We show the applicability of our approach on two case studies.

Modelling software fault management with runtime verification

To achieve the software fault tolerance at runtime, based on runtime verification techniques, this paper proposes a runtime model of running program, which is used to define the actions and constrains for runtime software fault management. This model contains the descriptions of event, path, scope and adjustment. A runtime fault management system prototype, which mainly includes the rule description, event acquisition, fault diagnosis and handling, is implemented to verify the model. Two test cases are used to estimate the effect of the prototype, and the results show that this method can handle faults successfully at runtime.

Runtime Verification on Robotics Systems

Runtime verification is a technique for generating monitors from formal specification of expected behaviors for the underlying system. It can be applied to automatically evaluate system execution, either on-line or off-line, analyzing extracted execution traces; or it can be used online during operation, potentially steering the application back to a safety region if a property is violated. As a so-called light-weighted formal method, runtime verification bridges the gap between system design and implementation and shorten the distance of software quality assurance between the software testing and model checking and theorem proving. Runtime verification is considered as a highly scalable and automatic technique. Most of current runtime verification research are endeavored on the program context, in other words, on the program side and falls in the implementation level. These applications limited the benefits of runtime verification that bridges the gap among types of applications. With the proliferation of embedded systems and mobile device, dynamically verifying the firmware and mobile apps becomes a new emerging area. Due to the characteristics of runtime verification technique and limitations of the robotics systems, so far, very few research and project are located in the runtime verification on the firmware of embedded systems, which appear in most of robotics systems. Robotics systems are programmed on the firmware and only observed on device. In this paper, the authors first discussed the current runtime verifications on the embedded systems with limitations. After that, a layered runtime verification framework will be presented for the firmware verification. The case study is applied on the commonly recognized educational toolkit – LEGO Mindstorm robotics systems.

Integrated static code analysis and runtime verification

SummaryStatic code analysis tools automatically generate alerts for potential software faults that can lead to failures. However, these tools usually generate a very large number of alerts, some of which are subject to false positives. Because of limited resources, it is usually hard to inspect all the alerts. As a complementary approach, runtime verification techniques verify dynamic system behavior with respect to a set of specifications. However, these specifications are usually created manually based on system requirements and constraints. In this paper, we introduce a noval approach and a toolchain for integrated static code analysis and runtime verification. Alerts that are generated by static code analysis tools are utilized for automatically generating runtime verification specifications. On the other hand, runtime verification results are used for automatically generating filters for static code analysis tools to eliminate false positives. The approach is illustrated for the static analysis and runtime verification of an open‐source bibliography reference manager software. Copyright © 2014 John Wiley & Sons, Ltd.

Runtime Verification for Biochemical Programs

The biochemical paradigm is well-suited for modelling autonomous systems and new programming languages are emerging from this approach. However, in order to validate such programs, we need to define precisely their semantics and to provide verification techniques. In this paper, we consider a higher-order biochemical calculus that models the structure of system states and its dynamics thanks to rewriting abstractions, namely rules and strategies. We extend this calculus with a runtime verification technique in order to perform automatic discovery of property satisfaction failure. The property specification language is a subclass of LTL safety and liveness properties.

Copilot: monitoring embedded systems

Runtime verification (RV) is a natural fit for ultra-critical systems that require correct software behavior. Due to the low reliability of commodity hardware and the adversity of operational environments, it is common in ultra-critical systems to replicate processing units (and their hosted software) and incorporate fault-tolerant algorithms to compare the outputs, even if the software is considered to be fault-free. In this paper, we investigate the use of software monitoring in distributed fault-tolerant systems and the implementation of fault-tolerance mechanisms using RV techniques. We describe the Copilot language and compiler that generates monitors for distributed real-time systems, and we discuss two case-studies in which Copilot-generated monitors were used to detect onboard software and hardware faults and monitor air-ground data link messaging protocols.

Introduction to the special issue on runtime verification

Runtime verification is a research area that is concerned with monitoring and dynamic analysis of evolving executions with respect to precisely specified properties. The primary motivation for this field of study, at its inception over a decade ago, was to overcome the scalability limitations of exhaustive design-time formal verification. Traditionally, model checking techniques suffer from state explosion that limits the size of systems that can be verified. Moreover, model checkers operate on models and thus introduce additional proof obligations on the correctness of abstraction or model creation. On the other hand, verification based on theorem proving usually involves a significant amount of manual effort that, effectively, limits the size of the system that can be verified. By concentrating on the current execution of the actual system, runtime verification techniques allow us to have automatic analysis that is less dependent on the size of the system and, at the same time, does not require as much abstraction. Early efforts in the runtime verification community focused on characterizing properties suitable for checking at run time [2], on the generation of efficient monitors for properties specified in a variety of formal languages [7, 8] and on improving efficiency of monitoring by static analysis [3]. These efforts led to the development of mature tools, such as the MOP framework [9], within less than one decade of runtime verification research. A somewhat separate line of research was concerned with “specification-less” monitoring, which targets runtime checking algorithms for a set of common and well-defined problems. Typically, these algorithms are related to concurrency within the system, such as freedom from race conditions [5], atomicity [11], serializability [4], etc. The runtime verification domain has seen an increased interest over the recent years, generating enough traction for the community to form its own international conference. This

Verification and analysis of domain-specific models of physical characteristics in embedded control software

ContextA considerable portion of the software systems today are adopted in the embedded control domain. Embedded control software deals with controlling a physical system, and as such models of physical characteristics become part of the embedded control software. ObjectiveDue to the evolution of system properties and increasing complexity, faults can be left undetected in these models of physical characteristics. Therefore, their accuracy must be verified at runtime. Traditional runtime verification techniques that are based on states/events in software execution are inadequate in this case. The behavior suggested by models of physical characteristics cannot be mapped to behavioral properties of software. Moreover, implementation in a general-purpose programming language makes these models hard to locate and verify. Therefore, this paper proposes a novel approach to perform runtime verification of models of physical characteristics in embedded control software. MethodThe development of an approach for runtime verification of models of physical characteristics and the application of the approach to two industrial case studies from the printing systems domain. ResultsThis paper presents a novel approach to specify models of physical characteristics using a domain-specific language, to define monitors that detect inconsistencies by exploiting redundancy in these models, and to realize these monitors using an aspect-oriented approach. We complement runtime verification with static analysis to verify the composition of domain-specific models with the control software written in a general-purpose language. ConclusionsThe presented approach enables runtime verification of implemented models of physical characteristics to detect inconsistencies in these models, as well as broken hardware components and wear and tear of hardware in the physical system. The application of declarative aspect-oriented techniques to realize runtime verification monitors increases modularity and provides the ability to statically verify this realization. The complementary static and runtime verification techniques increase the reliability of embedded control software.

Runtime verification of concurrency-specific correctness criteria

We give an overview of correctness criteria specific to concurrent shared-memory programs and runtime verification techniques for verifying these criteria. We cover a spectrum of criteria, from ones focusing on low-level thread interference such as races to higher-level ones such as linearizability. We contrast these criteria in the context of runtime verification. We present the key ideas underlying the runtime verification techniques for these criteria and summarize the state of the art. Finally, we discuss the issue of coverage for runtime verification for concurrency and present techniques that improve the set of covered thread interleavings.