A Fresh Approach to Learning Register Automata

Abstract

Abstract. This paper provides an Angluin-style learning algorithm for a class of register automata supporting the notion of fresh data values. More specifically, we introduce session automata which are well suited for modeling protocols in which sessions using fresh values are of major interest, like in security protocols or ad-hoc networks. We show that session automata (i) have an expressiveness partly extending, partly reducing that of register automata, (ii) admit a symbolic regular representation, and (iii) have a decidable equivalence and model-checking problem (unlike register automata). Using these results, we establish a learning algorithm to infer session automata through membership and equivalence queries. Finally, we strengthen the robustness of our automaton by its characterization in monadic second-order logic. IntroductionLearning automata deals with the inference of automata based on some partial information, for example samples, which are words that either belong to their accepted language or not. A popular framework is that of active learning defined by Angluin [2] in which a learner may consult a teacher for so-called membership and equivalence queries to eventually infer the automaton in question. Learning automata has a lot of applications in computer science. Notable examples are the use in model checking [12] and testing [3]. See [18] for an overview.While active learning of regular languages is meanwhile well understood and is supported by freely available libraries such as learnlib [19] and libalf [8], extensions beyond plain regular languages are still an area of active research. Recently, automata dealing with potentially infinite data as first class citizens have been studied. Seminal works in this area are that of [1,15] and [14]. While the first two use abstraction and refinement techniques to cope with infinite data, the second approach learns a sub-class of register automata.In this paper, we follow the work on learning register automata. However, we study a different model than [14], having the ability to require that input data is fresh in the sense that it has not been seen so far. This feature has been proposed in [24] in the context of semantics of programming languages, as, forThis work is partially supported by EGIDE/DAAD-Procope (LeMon).example, fresh names are needed to model object creation in object-oriented languages. Moreover, fresh data values are important ingredients in modeling security protocols which often make use of so-called fresh nonces to achieve their security assertions [17]. Finally, fresh names are also important in the field of network protocols and are one of the key ingredients of the π-calculus [20].In general, the equivalence problem of register automata is undecidable (even without freshness). This limits their applicability in active learning, as equivalence queries cannot be implemented (correctly and completely). Therefore, we restrict the studied automaton model to either store fresh data values or read data values from registers. In the termi...

Active learning for extended finite state machines

“…In our earlier work [BJR08], we generated a symbolic automaton from a finite automaton over a large data domain, potentially causing scalability problems for implementations. The authors of [BHLM13] infer EFSMs that they claim to be incomparable with register automata, and that can represent components where data parameters are 'globally fresh', i.e., never before seen or stored since the last reset of the component.…”

On Learning Nominal Automata with Binders

“…Variants of Angluin's algorithm for languages over infinite alphabets have attracted researchers' attention. An L algoritm for register automata is given in [5] where so-called session automata support the notion of fresh data values. Session automata are defined over pairs of finite-infinite alphabets.…”

“…Like [5], [8] works on register automata and data language but the latter aims to the application of dynamic black-box analysis. The key point is that [8] uses a tree queries instead of membership queries and ensures the observation tables closeness and register-consistency.…”

Fast Computations on Ordered Nominal Sets

“…This means one can model data flow in such automata beside the basic control flow provided by ordinary automata. Recently, it has been shown in a series of papers that such models are amenable to learning [8,9,10,11,12,13] with the verification of (closed source) TCP implementations as a prominent example [14].…”