HyperProb: A Model Checker for Probabilistic Hyperproperties

Untitled

“…Our approach builds on a symbolic representation of the family of the controllers and an abstraction refinement strategy allowing for an effective exploration of the families. A detailed experimental evaluation demonstrates that our approach considerably outperforms HyperProb [18], a state-of-the-art tool based on SMT reasoning. In particular, our approach scales to more complicated synthesis problems where HyperProb times out, and, for the first time, effectively supports in the synthesis procedure structural constraints on the resulting controllers.…”

“…Our experimental evaluation focuses on the following key questions: Q1: How does the proposed deductive approach perform in comparison to the stateof-the-art SMT based approach implemented in HyperProb [18]? Q2: Can the deductive approach effectively handle synthesis problems that include structural constraints?…”

“…In particular, we propose an abstraction refinement strategy that relates multiple computation trees and allows us to deductively identify sets of violating controllers that can be safely removed from the search space (Section 4). A detailed experimental evaluation (Section 5) demonstrates that our approach considerably outperforms the state-of-the-art tool HyperProb [18]. In particular, our approach scales to more complicated synthesis problems where HyperProb times out, and supports, for the first time, various structural constraints.…”

“…We first consider the main case studies presented in [18], namely, TA (timing attack), PW (password leakage), TS (thread scheduling) and PC (probabilistic conformance). A short description of the models and considered variants can be found in Appendix B.…”

“…The solution proposed for the former logic is to consider only the class of deterministic memoryless controllers, where the problem is shown to be NP-complete by a suitable SMT encoding. Despite recent improvements of HyperProb [18,20], a state-of-the-art tool implementing this approach, its scalability remains very limited: the complexity of the encoding gets out of reach even for modest models. For instance, a simple side-channel analysis introduced in [2] (checking that the probability of certain outcomes is equal) on an MDP with 244 states leads to an SMT problem with over a million variables, which HyperProb fails to solve.…”