Centralized vs Decentralized Monitors for Hyperproperties

2024-05-21

International Conference on Concurrency Theory

AI Summary

This work addresses the practical challenge of runtime monitoring for hyperproperties expressed in Hyper-recHML logic. We present the first provably correct method for synthesizing both centralized and distributed monitors. To ensure consistency of distributed monitoring outcomes, we establish—novelly—the weak bisimulation equivalence between centralized and distributed monitors, and design a semantics-preserving synthesis algorithm grounded in this equivalence. Our approach automatically generates monitors that are sound (no false positives) and violation-complete (no false negatives) for arbitrary Hyper-recHML formulas: centralized monitors yield exact verdicts, while distributed monitors enable decentralized, scalable, collaborative verification. Experimental evaluation demonstrates that our framework achieves both theoretical rigor and practical efficacy, providing a systematic solution to hyperproperty runtime verification.

Technology Category

• Machine Learning: Hardware-aware ML
• Multiagent Systems: Distributed Problem Solving
• Knowledge Representation and Reasoning: Computational Complexity of Reasoning

Application Category

• Economics, Online Markets and Human Computation: Incentives in network design for Web infrastructures and ecosystems
• Systems and Infrastructure for Web, Mobile and WoT: Applied ML and AI for Web-based mobile applications
• Graph Algorithms and Modeling for the Web: Efficient manipulation of static and dynamic Web-related graphs

Abstract

This paper focuses on the runtime verification of hyperproperties expressed in Hyper-recHML, an expressive yet simple logic for describing properties of sets of traces. To this end, we consider a simple language of monitors that observe sets of system executions and report verdicts w.r.t. a given Hyper-recHML formula. We first employ a unique omniscient monitor that centrally observes all system traces. Since centralised monitors are not ideal for distributed settings, we also provide a language for decentralized monitors, where each trace has a dedicated monitor; these monitors yield a unique verdict by communicating their observations to one another. For both the centralized and the decentralized settings, we provide a synthesis procedure that, given a formula, yields a monitor that is correct (i.e., sound and violation complete). A key step in proving the correctness of the synthesis for decentralized monitors is a result showing that, for each formula, the synthesized centralized monitor and its corresponding decentralized one are weakly bisimilar for a suitable notion of weak bisimulation.

Problem

• Centralized versus decentralized monitoring for hyperproperties
• Runtime verification of Hyper-recHML logic properties
• Synthesis procedures for correct monitors in both settings

Innovation

• Centralized omniscient monitor observing all traces
• Decentralized monitors communicating for verdicts
• Synthesis procedure ensuring correctness and bisimilarity