A Unified Approach for Static and Runtime Verification: Framework and Applications

Abstract

Abstract. Static verification of software is becoming ever more effective and efficient. Still, static techniques either have high precision, in which case powerful judgements are hard to achieve automatically, or they use abstractions supporting increased automation, but possibly losing important aspects of the concrete system in the process. Runtime verification has complementary strengths and weaknesses. It combines full precision of the model (including the real deployment environment) with full automation, but cannot judge future and alternative runs. Another drawback of runtime verification can be the computational overhead of monitoring the running system which, although typically not very high, can still be prohibitive in certain settings. In this paper we propose a framework to combine static analysis techniques and runtime verification with the aim of getting the best of both techniques. In particular, we discuss an instantiation of our framework for the deductive theorem prover KeY, and the runtime verification tool Larva. Apart from combining static and dynamic verification, this approach also combines the data centric analysis of KeY with the control centric analysis of Larva. An advantage of the approach is that, through the use of a single specification which can be used by both analysis techniques, expensive parts of the analysis could be moved to the static phase, allowing the runtime monitor to make significant assumptions, dropping parts of expensive checks at runtime. We also discuss specific applications of our approach.

A Specification Language for Static and Runtime Verification of Data and Control Properties

“…The StaRVOOrS framework (Static and Runtime Verification of ObjectOriented Software), which we originally suggested in [3], combines the use of the deductive source code verifier KeY [7] with that of the runtime monitoring tool Larva [11]. KeY is a deductive verification system for data-centric functional correctness properties of Java source code, which generates, from JML and Java, proof obligations in dynamic logic (a modal logic for reasoning about programs) and attempts to prove them.…”

“…However, one of the challenges is to identify a specification notation in which properties which refer to both the data-and control-flow of a system can not only be expressed, but also decomposed to ensure applicability of the different verification techniques. In order to address this issue we have, in a previous paper [3], proposed the StaRVOOrS framework. One key part of that framework was the proposal of a specification notation, called ppDATE, and a verification methodology, to specify and verify both control-oriented properties and data-oriented properties.…”

A Model-Based Approach to Combining Static and Dynamic Verification Techniques

“…At a most basic level, one takes conjuncts and sees which of these can be verified statically e.g., [2,4], leaving the rest to be verified at runtime:…”

Compliance Checking in the Open Payments Ecosystem

“…2. We envisage adopting techniques from recent work combining these two forms of verification [1,2,8,4]. One of the major challenges is the diverse nature of compliance it attempts to address.…”