Runtime monitoring and verification of systems with hidden information

Abstract

Public reporting burden for this collection of information is estimated to average 1 hour per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing this collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing this burden to Department of Defense, Washington Headquarters Services, Directorate for Information Operations and Reports (0704-0188), 1215 Jefferson Davis Highway, Suite 1204, Arlington, VA 22202-4302. Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number. PLEASE DO NOT RETURN YOUR FORM TO THE ABOVE ADDRESS.

Online, library-based visual formal specification monitoring system for monitoring log-files with visible and hidden data

“…The underlying technique in this part is based on HMM's, overviewed below. The algorithms used for RM of statechart assertion rules in the presence of hidden data are detailed in [9]. The main components of the toolset are described in this section.…”

“…3. Rather, an HMM whose states are B, S, and F is learned from learning-phase log-files and is later used in runtime for the purpose of monitoring [9]. We now specify a variant of rule R21a, R21b: "flag whenever there is more than one suspicious credit card charge transaction of more than $500 between two consecutive payroll deposits".…”

“…The dtrahmm tool creates an HMM from a learning-phase log-file, using the algorithm described in [9]. In a nutshell, this algorithm creates an HMM using frequency analysis, such as the ratio of rows where HiddenState="B" and where the next row has HiddenState="S" to the total number of rows minus one constitutes the probability of the HMM transition B → S.…”

“…As seen there, the process uses an HMM generated in a learning phase. When observing a runtime log-file, the Alpha method described in [9] processes the HMM and a runtime log-file and generates a list of < HMM-state, probability > pairs, one for every cycle, where a cycle corresponds to a row of the csv log-file (i.e., row No. 1 is cycle 1, row No.…”

“…In [7,9], the author describes an RM technique and algorithm for systems with hidden and visible inputs and outputs. The technique uses deterministic statechart assertions as formal specification.…”