Accelerated Learning of Predictive Runtime Monitors for Rare Failure

Abstract

Predictive runtime verification estimates the probability of a future event by monitoring the executions of a system. In this paper we use Discrete-Time Markov Chains (DTMC) as predictive models that are trained from many execution samples demonstrating a rare event: an event that occurs with very low probability. More specifically, we propose a method of grammar inference by which a DTMC is learned with far fewer samples than normal sample distribution. We exploit the concept of importance sampling, and use a mixture of samples, generated from the original system distribution and distributions that are suitably modified to produce more failures. Using the likelihood ratios of the various samples, we ensure the final trained model is faithful to the original distribution. In this way we construct accurate predictive models with orders of magnitude fewer samples. We demonstrate the gains of our approach on a file transmission protocol case study from the literature, and highlight future directions.

Conservative Safety Monitors of Stochastic Dynamical Systems

“…This work was extended using abstraction techniques to simplify the learned models [3]. In [2], the same authors employ importance sampling to efficiently learn discrete time Markov chain (DTMC) models from data, which they then use to synthesize predictive monitors. In [17], the authors use Bayesian networks to model temporal properties of stochastic timed automata.…”

“…Other lines of work use system execution data to learn discrete probabilistic models of the system, which are then used to perform predictive runtime monitoring, as there is rich literature for runtime monitoring of discrete automata. These models range from discrete-time Markov chains (DTMCs) [2] to hidden Markov models (HMMs) [4] to Bayesian networks [17]. However, it is difficult to provide guarantees relating the performance of the automata models to the real system, due to the fact that they are fit using finite data.…”

Neural predictive monitoring and a comparison of frequentist and Bayesian approaches

“…The work of [47,48] addresses the predictive monitoring problem for stochastic black-box systems, where a Markov model is inferred offline from observed traces and used to construct a predictive runtime monitor for probabilistic reachability checking. In contrast to NSC, this method focuses on discrete-space models, which allows the predictor to be represented as a look-up table, as opposed to a neural network.…”