Automated Runtime Verification for Web Services

Abstract

This paper presents a methodology to perform passive testing of behavioural conformance for the web services based on the security rule. The proposed methodology can be used either to check a trace (offline checking) or to runtime verification (online checking) with timing constraints, including future and past time. In order to perform this: firstly, we use the Nomad language to define the security rules. Secondly, we propose an algorithm that can check simultaneously multi instances. After that, with each security rule, we propose a graphical statistics, with some fixed properties, that helps to tester easy assess about the service. In addition to the theoretical framework we have developed a software tool, called RV4WS (Runtime Verification engine for Web Service), that helps in the automation of our passive testing approach. In particular, the algorithm presented in this paper are fully implemented in the tool. We also present a mechanism to collect the observable trace in this paper.

Synthesising correct concurrent runtime monitors

“…There is considerable work on runtime monitoring of web services, e.g., [18,7] verifying the correctness of reactive (communication) properties, similar to those expressed through sHML; to the best of our knowledge, none of this work tackles correct monitor synthesis from a specified logic. In [14], Colombo et al develop an Erlang RV tool using the EVM tracing mechanism but do not consider the issue of correct monitor generation.…”

“…The first sub-property is Violation Detectability, Lemma 3, guaranteeing that every violating trace s of formula ϕ is detectable by the respective synthesised monitor, 7 (the only-if case) and that there are no false detections (the if case). This property is easier to verify than Theorem 3 since it requires us to consider the execution of the monitor in isolation and, more importantly, requires us to verify the existence of an execution path that detects the violation; concurrent monitors typically have multiple execution paths and Theorem 3 requires us to prove this property for all of the possible monitor execution paths.…”

On the Verification of Behavioral and Probabilistic Web Services Using Transformation

“…In [14], Cao et al presented a methodology for passive testing of behavioral conformance for web services. However, unlike our proposal, the paper only focuses on security issues.…”

Whitening SOA Testing via Event Exposure

“…Besides service testing, service providers and consumers may also apply some runtime verification techniques to monitor and verify the properties of Web services, such as transactional requirements [34], data consistency [76], [75], conformance of interface contracts [29], [36], timing constraints [19], to just name a few. When some properties are violated at runtime, some mechanisms (e.g., compensation [79]) are usually needed to recover services from failures.…”