Gray-box monitoring of hyperproperties with an application to privacy

Abstract

Runtime verification is a complementary approach to testing, model checking and other static verification techniques to verify software properties. Monitorability characterizes what can be verified (monitored) at run time. Different definitions of monitorability have been given both for trace properties and for hyperproperties (properties defined over sets of traces), but these definitions usually cover only some aspects of what is important when characterizing the notion of monitorability. The first contribution of this paper is a refinement of classic notions of monitorability both for trace properties and hyperproperties, taking into account, among other things, the computability of the monitor. A second contribution of our work is to show that black-box monitoring of HyperLTL (a logic for hyperproperties) is in general unfeasible, and to suggest a gray-box approach in which we combine static and runtime verification. The main idea is to call a static verifier as an oracle at run time allowing, in some cases, to give a final verdict for properties that are considered to be non-monitorable under a black-box approach. Our third contribution is the instantiation of this solution to a privacy property called distributed data minimization which cannot be verified using black-box runtime verification. We use an SMT-based static verifier as an oracle at run time. We have implemented our gray-box approach for monitoring data minimization into the proof-of-concept tool Minion. We describe the tool and apply it to a few case studies to show its feasibility.

Runtime Monitoring of Nonterminating Systems for Alternation-Free HyperLTL Formulas

“…Indeed, a property is monitorable if any observed prefix has the potential to be extended to a good or a bad prefix for the property; a verdict can be issued once the good (bad) extension is observed. The concept of monitorability has also been extended to hyperproperties [4,9,13]. A hyperproperty is in general defined to be monitorable if any observation that a monitor may have at run time can be extended to a good or bad observation that is realizable according to the information available to the monitor.…”

“…The notion of monitorability under the unbounded sequential model [4,13] and that of semantic gray-box monitorability [9] rely on the assumption that the traces of the system under monitoring are of finite length, making it possible for the monitor to observe an unbounded number of execution traces of the system one after the other. This assumption is not true of a nonterminating system, whose traces are of infinite length.…”

“…For a system with traces of finite length, the monitor for a hyperproperty has the opportunity to observe an unbounded number of traces (runs) of the system one after another [4][5][6][7][8][9]. The monitor can indeed establish the relationships among different traces of the system and possibly draw the conclusion of satisfaction or violation on the system.…”

“…Stucki et al [9] propose the concept of semantic gray-box monitorability, which assumes that the monitor has access to an approximation of the system under monitoring. The monitor is also assumed to be able to observe an unbounded number of traces produced by the system one after another.…”

A Synthesis Tool for Optimal Monitors in a Branching-Time Setting

“…As argued in [4], computing the optimal monitor is also an optimal way to incorporate prior knowledge into the monitor. This problem has been studied in the linear-time setting (with lineartime assumptions) by Henzinger and Saraç [21], by Cimatti et al [13], and by Leucker [24], and for hyperproperties by Stucki et al [30].…”