Non-Intrusive Monitoring of Service-Based Systems

Abstract

This paper presents a framework for monitoring the compliance of systems composed of Web-services with requirements set for them at runtime. This framework assumes systems composed of Web-services which are co-coordinated by a service composition process expressed in BPEL and uses event calculus to specify the requirements to be monitored. These requirements may include behavioral properties of a system which are automatically extracted from the specification of its composition process in BPEL and/or assumptions that system providers can specify in terms of events extracted from this specification.

Diagnosis and Threat Detection Capabilities of the SERENITY Monitoring Framework

“…Within this diagnosis window, the set of the alternative explanations that can be generated for E1 includes the explanations Φ 11 and Φ 12 , as we discussed in Section [15,22]) = ∅ and, by virtue of Definition 2, a null precondition will need to be considered in both of these cases or, equivalently, the evaluation of the basic probability in the explainability of E1 will need to be based on the precondition sets CND(E1,Φ 11 , [15,22]…”

“…Based on these results, the basic probability in the explainability of E1 will be: m EX (Explainable(E1, [15,22] [15,22])={P NULL }, we will have: ∏ E u ∈CND(E1,Φ 11, [15,22] ) m GN (Genuine(E u , [15,22], {Φ 11 })) = 1, and ∏ E u ∈CND(E1,Φ 12, [15,22] ) m GN (Genuine(E u , [15,22], {Φ 12 })) = 1.…”

“…Thus, (1) will be equal to: m EX (Explainable(E1, [15,22], ∅) = {1 × m GN (Genuine(C 111 , [15,22],{Φ 11 })} + {1×{m GN (Genuine(Φ 12 , [15,22], {Φ 12 })) + m GN (Genuine(C 121 , [15,22], {Φ 12 })) -m GN (Genuine(Φ 12 , [15,22],{Φ 12 })) × m GN (Genuine(C 121 , [15,22],{Φ 12 }))} − {1× m GN (Genuine(C 111 , [15,22],{Φ 11 })} × {1×{m GN (Genuine(Φ 12 , [15,22], {Φ 12 })) + m GN (Genuine(C 121 , [15,22], {Φ 12 })) -m GN (Genuine(Φ 12 , [15,22],{Φ 12 })) × m GN (Genuine(C 121 , [15,22],{Φ 12 }))} (2) Note, however, as there are no recorded events that can be unified with C 111 and C 121 in the event log, we have: m GN (Genuine(C 111 , [15,22],{Φ 11 })) = 0 m GN (Genuine(C 121 , [15,22],{Φ 12 })) = 0 Thus, (2) becomes: m EX (Explainable(E1, [15,22], ∅) = m GN (Genuine(Φ 12 , [15,22], {Φ 12 }))) (3) E2, however, can be unified with Φ 12 and EXP E2 = {E NULL }. Thus, we will have m GN (Genuine(Φ 12 , [15,22],{Φ 11 })) = m IL (Occurred(E2)) × m EX (Explainable(E2)) = α 2 Therefore, it will be m EX (Explainable(E1, [15,22]…”

“…Thus, we will have m GN (Genuine(Φ 12 , [15,22],{Φ 11 })) = m IL (Occurred(E2)) × m EX (Explainable(E2)) = α 2 Therefore, it will be m EX (Explainable(E1, [15,22]…”

“…To generate such explanations, the diagnostic mechanism used abductive reasoning [22]. Then, following the identification of possible explanations, the diagnosis mechanism also assesses the plausibility of explanations by identifying any effects that they would have beyond the events that they were generated from and checking whether these effects correspond to events that have been recorded in the event log of the monitoring framework and are genuine.…”