The Complexity of Monitoring Hyperproperties

Bonakdarpour, Borzoo; Finkbeiner, Bernd

doi:10.1109/csf.2018.00019

Cited by 45 publications

(56 citation statements)

References 21 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…HyperLTL [8] is a successor of the temporal logic SecLTL [14] used to characterize temporal information flow. The model-checking [8,25,26], satisfiability [18,19,21], monitoring problem [1][2][3][4][22][23][24]33,34], and the first-order extension [31] of HyperLTL have been studied before. In [11], it has been shown that existential quantification in a HyperLTL formula can be reduced to strategic choice.…”

Section: Related Workmentioning

confidence: 99%

See 1 more Smart Citation

Synthesis from hyperproperties

et al. 2019

Self Cite

View full text Add to dashboard Cite

We study the reactive synthesis problem for hyperproperties given as formulas of the temporal logic HyperLTL. Hyperproperties generalize trace properties, i.e., sets of traces, to sets of sets of traces. Typical examples are information-flow policies like noninterference, which stipulate that no sensitive data must leak into the public domain. Such properties cannot be expressed in standard linear or branching-time temporal logics like LTL, CTL, or CTL *. Furthermore, HyperLTL subsumes many classical extensions of the LTL realizability problem, including realizability under incomplete information, distributed synthesis, and fault-tolerant synthesis. We show that, while the synthesis problem is undecidable for full HyperLTL, it remains decidable for the ∃ * , ∃ * ∀ 1 , and the linear ∀ * fragments. Beyond these fragments, the synthesis problem immediately becomes undecidable. For universal HyperLTL, we present a semi-decision procedure that constructs implementations and counterexamples up to a given bound. We report encouraging experimental results obtained with a prototype implementation on example specifications with hyperproperties like symmetric responses, secrecy, and information flow.

show abstract

Section: Related Workmentioning

confidence: 99%

“…. ,ȧ n } ∪ #) 2 , where we use the dot symbol to encode that a stone starts at this position of the trace. We writeã if we do not care if this symbol is an a orȧ and use * as syntactic sugar for an arbitrary symbol of the alphabet.…”

Section: Theorem 10 Realizability Of ∀ * ∃ * Hyperltl Is Undecidablementioning

confidence: 99%

Synthesis from hyperproperties

et al. 2019

Self Cite

View full text Add to dashboard Cite

show abstract

“…In [5], the authors study the complexity of monitoring hyperproperties. They show that the form and size of the input as well as the formula have a significant impact on the feasibility of the monitoring process.…”

Section: Structure Of This Articlementioning

confidence: 99%

“…Efficient model checking, synthesis, and satisfiability checking tools for HyperLTL already exist [12,[19][20][21][22]25,26]. Implementing an efficient runtime verification tool for HyperLTL specifications is, despite recent theoretical progress [1,[5][6][7]24,28,29,37], difficult: In principle, the monitor not only needs to process every observed trace, but must also store every trace observed so far, so that future traces can be compared with the traces seen so far.…”

Section: Introductionmentioning

confidence: 99%

Efficient monitoring of hyperproperties using prefix trees

Finkbeiner

Hahn

Stenger

et al. 2020

Int J Softw Tools Technol Transfer

Self Cite

View full text Add to dashboard Cite

Hyperproperties, such as non-interference and observational determinism, relate multiple computation traces with each other and are thus not monitorable by tools that consider computations in isolation. We present the monitoring approach implemented in the latest version of RVHyper, a runtime verification tool for hyperproperties. The input to the tool are specifications given in the temporal logic HyperLTL, which extends linear-time temporal logic (LTL) with trace quantifiers and trace variables. RVHyper processes execution traces sequentially until a violation of the specification is detected. In this case, a counterexample, in the form of a set of traces, is returned. RVHyper employs a range of optimizations: a preprocessing analysis of the specification and a procedure that minimizes the traces that need to be stored during the monitoring process. In this article, we introduce a novel trace storage technique that arranges the traces in a tree-like structure to exploit partially equal traces. We evaluate RVHyper on existing benchmarks on secure information flow control, error correcting codes, and symmetry in hardware designs. As an example application outside of security, we show how RVHyper can be used to detect spurious dependencies in hardware designs.

show abstract

“…In [3], the authors study the complexity of monitoring hyperproperties. They show that the form and size of the input, as well as the formula have a significant impact on the feasibility of the monitoring process.…”

Section: Introductionmentioning

confidence: 99%

Constraint-Based Monitoring of Hyperproperties

Hahn

Stenger

Tentrup

2019

Tools and Algorithms for the Construction and Analysis of Systems

View full text Add to dashboard Cite

Verifying hyperproperties at runtime is a challenging problem as hyperproperties, such as non-interference and observational determinism, relate multiple computation traces with each other. It is necessary to store previously seen traces, because every new incoming trace needs to be compatible with every run of the system observed so far. Furthermore, the new incoming trace poses requirements on future traces. In our monitoring approach, we focus on those requirements by rewriting a hyperproperty in the temporal logic HyperLTL to a Boolean constraint system. A hyperproperty is then violated by multiple runs of the system if the constraint system becomes unsatisfiable. We compare our implementation, which utilizes either BDDs or a SAT solver to store and evaluate constraints, to the automata-based monitoring tool RVHyper.

show abstract

The Complexity of Monitoring Hyperproperties

Cited by 45 publications

References 21 publications

Synthesis from hyperproperties

Synthesis from hyperproperties

Efficient monitoring of hyperproperties using prefix trees

Constraint-Based Monitoring of Hyperproperties

Contact Info

Product

Resources

About