Citation Context

...o a monitor. Correctness properties specify the form of individual executions of a system and are usually formulated in some variant of linear temporal logic, such as LTL [51], as seen for example in =-=[35,32,31,37,38,60]-=-. In this section, we recall the ideas of 8LTL3 as one example of a linear-time temporal logic specially designed for runtime verification. For a technical presentation, see [10,8]. As especially in ...

Citation Context

...toring MITL[a,b] Formulae In this section we present a procedure for deciding the satisfiability of an MITL [a,b] formula by a sufficiently long signal. This procedure, partly inspired by [Pnu03] and =-=[HR02b]-=-, is very simple. It works in a bottom-up fashion on the parse tree of the formula. Starting from the leaves we construct for every sub-formula ψ a signal sψ such that sψ[t] =1iff (s, t) |= ψ. When th...

Citation Context

...oral Logic Past time linear temporal logic (ptLTL) formulae are routinely used to express safety requirements. In this section we show how the dynamic programming based monitor generator presented in =-=[7]-=- can be organized as a logic engine in our MoP environment. 4.1.1 Syntax and Semantics We allow the following constructors for ptLTL formulae, where A is a set of “atomic propositions”: F ::= true | f...

Citation Context

...complaints. At customer’s site, monitors check for bugs that escaped the testing phase and may trigger recovery actions [5]. Various runtime verification approaches for LTL have been proposed already =-=[13, 16, 17, 15, 23]-=-. However, the current approaches suffer—to our opinion—from the treatment of the following obstacle: The semantics of LTL is defined over infinite (behavioural) traces whereas monitoring a running sy...

Citation Context

...t edit automata [15], which extend security automata ([9]). 17 But the correctness of the Polymer policy inlining cannot be proven either, as its semantics is not formally presented. In a recent work [3], a simpler version of the Polymer language is presented with its semantics, both in the context of a lambda calculus. Using this semantics, the authors prove uncircumventability of the monitor, i.e. that the untrusted program can not perform security relevant actions by circumventing the monitor. Many logic-based formalisms are used to express security properties for monitoring purposes (e.g. [10]). However, it seems that these languages are less convenient for specification of the existing systems automata-based languages, as it is hard to represent the full behavior of the system through a limited set of temporal-logic properties. Yet, in our framework we need a formalism convenient for specification of both programs and requirements to them. Moreover, temporal logic formulae can be translated to automata by applying a tableaux procedure [14]. Model-carrying code (MCC) [19] is based on the idea of supplying untrusted code with additional information to simplify its verification again...

Citation Context

...e on finite execution traces [53]. Even though this algorithm is not dependent on rewriting (but it could be easily implemented in Maude by rewriting as we did with its dual variant for past time LTL =-=[32, 5]-=-), for the sake of completeness we present it in some detail in Section 5. This algorithm evaluates a formula bottom-up for each point in the trace, going backwards from the final state towards the in...