Runtime Verification over Out-of-order Streams

Abstract

We present an approach for verifying systems at runtime. Our approach targets distributed systems whose components communicate with monitors over unreliable channels, where messages can be delayed, reordered, or even lost. Furthermore, our approach handles an expressive specification language that extends the real-time logic MTL with freeze quantifiers for reasoning about data values. The logic's main novelty is a new three-valued semantics that is well suited for runtime verification as it accounts for partial knowledge about a system's behavior. Based on this semantics, we present online algorithms that reason soundly and completely about streams where events can occur out of order. We also evaluate our algorithms experimentally. Depending on the specification, our prototype implementation scales to out-of-order streams with hundreds to thousands of events per second.First, note that as (0,1] β is syntactic sugar for tU (0,1] β, we can ignore the continuation subformulas in the propositional formulas, since they simplify to t. Furthermore, note that θ w (Ψ α, J 1 ,[x →d ] w ) has only one anchor subformula (different from a propositional constant), since α's temporal constraint (0, 1] is unsatisfiable for J 1 , that is, θ w (mc J 1 , J 1 (0,1] ) = f and hence θ w (β J 1 , J 1 ,[x →d ] ) ≡ f. Finally, note that for β and J 2 , we have the two propositions βLemma 4.1 for MTL carries over to MTL ↓ and its propositional formulas Ψ γ , J,ν w . Lemma 5.2. The following two statements hold.(1) If w, j, ν |≈ γ ∈ 2, then θ w (Ψ γ , J,ν w ) ≡ w, j, ν |≈ γ . ) depends on ψ J,ν , for some K and µ ∈ val w (γ , K) , for ψ φ, with the parent formula γ . Recall that a propositional formula Ψ depends on the proposition p if [p → t](Ψ) [p → f](Ψ). Example 5.5. We revisit Example 5.1 with the formula ↓ r x . α and the observation w = J 0 , ([ ], [ ]) J 1 , ([ ], [r → d]) J 2 , ([ ], [ ]) . Recall that α = (0,1] β, with β = p(x), J 0 = [0, τ ), J 1 = {τ }, and J 2 = (τ , ∞). We have the following relevant valuations.val w (↓ r x . α, J 0 ) = {[ ]} val w (↓ r x . α, J 1 ) = {[ ]} val w (↓ r x . α, J 2 ) = {[ ]} val w (α, J 0 ) = {[ ]} val w (α, J 1 ) = {[x → d]} val w (α, J 2 ) = {[ ]} val w (β, J 0 ) = {[ ]} val w (β, J 1 ) = {[ ]} val w (β, J 2 ) = {[ ], [x → d]}

Runtime Enforcement with Reordering, Healing, and Suppression

“…The approach in [2] verifies distributed systems at runtime where components communicate with monitors over unreliable channels, meaning that messages can be delayed, reordered, or even lost. The authors propose an extension of the real-time logic MTL, which provides a new three-valued semantics that is well suited for runtime verification as it accounts for partial knowledge about a system's behaviour.…”

“…As proposed in some existing works, e.g. [2], we tackle the reordering problem by storing and delaying messages when necessary. In addition, we complement reordering with healing that injects some new actions to ensure progress of the application while satisfying the property being analysed.…”