Log auditing is a basic intrusion detection mechanism, whereby attacks are detected by uncovering matches of sequences of events against signatures. We argue that this problem is naturally expressed as a model-checking problem against linear Kripke models. A variant of the classic linear time temporal logic of Manna and Pnueli with first-order variables is first investigated in this framework. In passing, we show that model-checking this logic against linear models is NP-complete -- polynomial-time in the propositional case --, which contrasts with the fact that it is PSPACE-complete against general models. Despite this improvement, this logic is in dire need of refinement, as far as expressiveness and efficiency are concerned. We therefore propose a second, less standard logic consisting of flat, Wolperstyle linear-time formulae. We describe an efficient online algorithm, making the approach attractive for complex log auditing tasks. We present a few optimizations that the use of a formal semantics affords us, using abstract interpretation techniques, and report briefly on preliminary practical experience.

We propose OBDD-based symbolic model checking algorithms for simply-timed systems, i.e. finite state graphs where transitions carry a duration. These durations can be arbitrary natural numbers. A simple and natural semantics for these systems opens the way for improved efficiency.

Abstract: Problem statement: Application scenarios of Wireless Sensor Networks (WSN) create interesting design challenges since the sensor nodes used to collect and communicate data may fail suddenly and unpredictably. The issue of real-time and reliable data delivery is extremely important for taking effective decisions in WSN. Approach: In this study we proposed architecture for reliable and real-time approach for data placement using sensor clusters. Instead of storing information in individual cluster heads as suggested in some protocols, in our architecture we suggest storing of information of all clusters within a cell in the corresponding base station. For data dissemination and action we have used Action and Relay Stations (ARS). Results: We developed programming model for formal specification of our architecture. Conclusion: Present model not only offers real time sensing and monitoring, but also provides real time dynamic decision making based on the sensed data. Moreover it prolongs network life time.