Automata-less Monitoring via Trace-Checking (Extended Version)

2025-11-14

AI Summary

To address the double-exponential blowup in monitoring complexity arising from deterministic finite automaton (DFA) construction for Linear Temporal Logic (LTL) formulas in runtime verification, this paper proposes a direct trace-evaluation method that bypasses automata construction entirely. The core innovation lies in the first formal characterization and exploitation of semantic properties of safety and co-safety formulas, enabling complete avoidance of DFA generation over the safety and co-safety fragments of LTLf and LTL. By combining syntactic fragment identification with semantics-driven online evaluation, the method reduces monitoring time complexity to polynomial in both trace length and formula size: LTLf monitoring achieves PTIME, while key decision problems for LTL are optimized to PSPACE. This approach significantly enhances monitoring efficiency and establishes a new paradigm for lightweight, scalable runtime verification.

Technology Category

• Natural Language Processing: Safety and Robustness
• Knowledge Representation and Reasoning: Description Logics
• Constraint Satisfaction and Optimization: Satisfiability Modulo Theories

Application Category

• Security and Privacy: Large-scale security measurements
• Search and Retrieval-Augmented AI: Web evaluation methodologies and metrics
• Graph Algorithms and Modeling for the Web: Efficient manipulation of static and dynamic Web-related graphs

Abstract

In runtime verification, monitoring consists of analyzing the current execution of a system and determining, on the basis of the observed finite trace, whether all its possible continuations satisfy or violate a given specification. This is typically done by synthesizing a monitor--often a Deterministic Finite State Automaton (DFA)--from logical specifications expressed in Linear Temporal Logic (LTL) or in its finite-word variant (LTLf). Unfortunately, the size of the resulting DFA may incur a doubly exponential blow-up in the size of the formula. In this paper, we identify some conditions under which monitoring can be done without constructing such a DFA. We build on the notion of intentionally safe and cosafe formulas, introduced in [Kupferman&Vardi, FMSD, 2001], to show that monitoring of these formulas can be carried out through trace-checking, that is, by directly evaluating them on the current system trace, with a polynomial complexity in the size of both the trace and the formula. In addition, we investigate the complexity of recognizing intentionally safe and cosafe formulas for the safety and cosafety fragments of LTL and LTLf. As for LTLf, we show that all formulas in these fragments are intentionally safe and cosafe, thus removing the need for the check. As for LTL, we prove that the problem is in PSPACE, significantly improving over the EXPSPACE complexity of full LTL.

Problem

• Avoid doubly exponential blow-up in automata synthesis from LTL formulas
• Enable monitoring through direct trace-checking without constructing DFAs
• Identify conditions where polynomial complexity monitoring is achievable

Innovation

• Automata-less monitoring via trace-checking
• Polynomial complexity in trace and formula
• Intentional safety and cosafety formulas