Introduction Formal Problem Definition Automatic Enforcer Synthesis Conclusion Predictive Runtime Enforcement Srinivas Pinisetty 1 , Viorel Preoteasa 1 , Stavros Tripakis 1 , 2 , Thierry J´ eron 3 , es Falcone 4 , Herv´ e Marchand 3 Yli` Aalto University, Finland University of California, Berkeley INRIA Rennes - Bretagne Atlantique, France LIG, Universit´ e Grenoble, INRIA, Grenoble, France Computational Logic Day 2016, Aalto University, Finland Pinisetty , Preoteasa, Tripakis, J´ eron, Falcone, Marchand Predictive Runtime Enforcement Computational Logic Day 2016 1 / 23
Introduction Formal Problem Definition Automatic Enforcer Synthesis Conclusion Runtime verification and enforcement Runtime verification Runtime enforcement Property ϕ Property ϕ Verification events events events verdicts Monitor Enforcer a · a · b · · · a · a · · · | = ϕ ? · True · · · a · b · · · Input: stream of events. Does σ satisfy ϕ ? Modified to satisfy the Output: stream of verdicts . property. Output: stream of events . Pinisetty , Preoteasa, Tripakis, J´ eron, Falcone, Marchand Predictive Runtime Enforcement Computational Logic Day 2016 2 / 23
Introduction Formal Problem Definition Automatic Enforcer Synthesis Conclusion Runtime enforcement (previous work: non-predictive ) ϕ σ ∈ Σ ∗ o ∈ ϕ Event Event Enforcer Emitter Receiver Pinisetty , Preoteasa, Tripakis, J´ eron, Falcone, Marchand Predictive Runtime Enforcement Computational Logic Day 2016 3 / 23
Introduction Formal Problem Definition Automatic Enforcer Synthesis Conclusion Runtime enforcement (previous work: non-predictive ) ϕ σ ∈ Σ ∗ o ∈ ϕ Event Event Enforcer Emitter Receiver Enforcer for ϕ operating at runtime ϕ : any regular property (defined as automaton). Pinisetty , Preoteasa, Tripakis, J´ eron, Falcone, Marchand Predictive Runtime Enforcement Computational Logic Day 2016 3 / 23
Introduction Formal Problem Definition Automatic Enforcer Synthesis Conclusion Runtime enforcement (previous work: non-predictive ) ϕ σ ∈ Σ ∗ o ∈ ϕ Event Event Enforcer Emitter Receiver Enforcer for ϕ operating at runtime ϕ : any regular property (defined as automaton). An enforcer behaves as a function E : Σ ∗ → Σ ∗ . Input ( σ ∈ Σ ∗ ): any sequence of events over Σ (Event emitter is a black-box). Pinisetty , Preoteasa, Tripakis, J´ eron, Falcone, Marchand Predictive Runtime Enforcement Computational Logic Day 2016 3 / 23
Introduction Formal Problem Definition Automatic Enforcer Synthesis Conclusion Runtime enforcement (previous work: non-predictive ) ϕ σ ∈ Σ ∗ o ∈ ϕ Event Event Enforcer Emitter Receiver Enforcer for ϕ operating at runtime ϕ : any regular property (defined as automaton). An enforcer behaves as a function E : Σ ∗ → Σ ∗ . Input ( σ ∈ Σ ∗ ): any sequence of events over Σ (Event emitter is a black-box). Output ( o ∈ Σ ∗ ): a sequence of events such that o | = ϕ . Pinisetty , Preoteasa, Tripakis, J´ eron, Falcone, Marchand Predictive Runtime Enforcement Computational Logic Day 2016 3 / 23
Introduction Formal Problem Definition Automatic Enforcer Synthesis Conclusion Predictive runtime enforcement problem (this work) ψ, ϕ σ ∈ ψ o ∈ ϕ Event Predictive Event Emitter Enforcer Receiver Predictive enforcer for ϕ operating at runtime Given property ϕ (to enforce) and input property ψ defined as automaton. Automatically synthesize an enforcer. Pinisetty , Preoteasa, Tripakis, J´ eron, Falcone, Marchand Predictive Runtime Enforcement Computational Logic Day 2016 4 / 23
Introduction Formal Problem Definition Automatic Enforcer Synthesis Conclusion Predictive runtime enforcement problem (this work) ψ, ϕ σ ∈ ψ o ∈ ϕ Event Predictive Event Emitter Enforcer Receiver Predictive enforcer for ϕ operating at runtime Given property ϕ (to enforce) and input property ψ defined as automaton. Automatically synthesize an enforcer. Input ( σ ∈ ψ ): Event emitter is not a black-box. Output ( o ∈ Σ ∗ ): a sequence of events o | = ϕ . Pinisetty , Preoteasa, Tripakis, J´ eron, Falcone, Marchand Predictive Runtime Enforcement Computational Logic Day 2016 4 / 23
Introduction Formal Problem Definition Automatic Enforcer Synthesis Conclusion Predictive runtime enforcement problem (this work) ψ, ϕ σ ∈ ψ o ∈ ϕ Event Predictive Event Emitter Enforcer Receiver Predictive enforcer for ϕ operating at runtime Given property ϕ (to enforce) and input property ψ defined as automaton. Automatically synthesize an enforcer. Input ( σ ∈ ψ ): Event emitter is not a black-box. Output ( o ∈ Σ ∗ ): a sequence of events o | = ϕ . Predictive enforcer should satisfy soundness, transparency, monotonicity, and urgency constraints. Urgency related to using ψ and release input events earlier whenever possible. Pinisetty , Preoteasa, Tripakis, J´ eron, Falcone, Marchand Predictive Runtime Enforcement Computational Logic Day 2016 4 / 23
Introduction Formal Problem Definition Automatic Enforcer Synthesis Conclusion Predictive runtime enforcement (motivations) Motivations Consider a-priori knowledge of the system (event emitter) is available. Model, information extracted using static-analysis etc. Provide a-priori knowledge of the system (event emitter) to the enforcer. Event emitter is not a black-box. How enforcer can benefit from model/knowledge of the system? Does it help to provide better QoS (eg: output some events earlier)? Example Non-safety properties (release events earlier instead of delaying). Pinisetty , Preoteasa, Tripakis, J´ eron, Falcone, Marchand Predictive Runtime Enforcement Computational Logic Day 2016 5 / 23
Introduction Formal Problem Definition Automatic Enforcer Synthesis Conclusion Related works Runtime Enforcement: non-predictive Enforceable security policies – F. B. Schneider et al-2000. Runtime enforcement of non-safety policies – J. Ligatti et al-2009. Enforcement monitoring wrt. the safety-progress classification of properties – Y. Falcone et al-2010. Runtime enforcement of timed properties – S. Pinisetty et al-2012. Runtime enforcement for reactive systems – R. Bloem et al-2015. Pinisetty , Preoteasa, Tripakis, J´ eron, Falcone, Marchand Predictive Runtime Enforcement Computational Logic Day 2016 6 / 23
Introduction Formal Problem Definition Automatic Enforcer Synthesis Conclusion Outline Introduction 1 Formal Problem Definition 2 Automatic Enforcer Synthesis 3 Functional Definition Algorithm Conclusion 4 Pinisetty , Preoteasa, Tripakis, J´ eron, Falcone, Marchand Predictive Runtime Enforcement Computational Logic Day 2016 7 / 23
Introduction Formal Problem Definition Automatic Enforcer Synthesis Conclusion Outline Introduction 1 Formal Problem Definition 2 Automatic Enforcer Synthesis 3 Functional Definition Algorithm Conclusion 4 Pinisetty , Preoteasa, Tripakis, J´ eron, Falcone, Marchand Predictive Runtime Enforcement Computational Logic Day 2016 8 / 23
Introduction Formal Problem Definition Automatic Enforcer Synthesis Conclusion Predictive enforcer Given properties ψ (input property) and ϕ (to enforce): ψ, ϕ σ ∈ ψ o ∈ ϕ Predictive Enforcer What can an enforcer do? Enforcer augmented with a memorization mechanism . CAN delay events. CANNOT insert nor delete events. CANNOT change the order of events. Pinisetty , Preoteasa, Tripakis, J´ eron, Falcone, Marchand Predictive Runtime Enforcement Computational Logic Day 2016 9 / 23
Introduction Formal Problem Definition Automatic Enforcer Synthesis Conclusion Formal problem definition Properties ψ (input property) and ϕ (to enforce). ψ, ϕ σ ∈ ψ o ∈ ϕ Predictive Enforcer Predictive enforcer for ψ, ϕ Given properties ψ, ϕ ⊆ Σ ∗ , a predictive enforcer is a function E ψ,ϕ : Σ ∗ → Σ ∗ satisfying the following constraints: Soundness 1 Transparency 2 Monotonicity 3 Urgency 4 Pinisetty , Preoteasa, Tripakis, J´ eron, Falcone, Marchand Predictive Runtime Enforcement Computational Logic Day 2016 10 / 23
Introduction Formal Problem Definition Automatic Enforcer Synthesis Conclusion Soundness Output is correct (satisfies ϕ ) ∀ σ ∈ ψ : E ψ,ϕ ( σ ) � = ǫ = ⇒ E ψ,ϕ ( σ ) ∈ ϕ . Pinisetty , Preoteasa, Tripakis, J´ eron, Falcone, Marchand Predictive Runtime Enforcement Computational Logic Day 2016 11 / 23
Introduction Formal Problem Definition Automatic Enforcer Synthesis Conclusion Transparency TR1: events can be delayed ∀ σ ∈ Σ ∗ : E ψ,ϕ ( σ ) � σ . Pinisetty , Preoteasa, Tripakis, J´ eron, Falcone, Marchand Predictive Runtime Enforcement Computational Logic Day 2016 12 / 23
Introduction Formal Problem Definition Automatic Enforcer Synthesis Conclusion Transparency TR1: events can be delayed ∀ σ ∈ Σ ∗ : E ψ,ϕ ( σ ) � σ . TR2: observed input satisfies ϕ ∀ σ ∈ Σ ∗ : σ ∈ ϕ = ⇒ E ψ,ϕ ( σ ) = σ Pinisetty , Preoteasa, Tripakis, J´ eron, Falcone, Marchand Predictive Runtime Enforcement Computational Logic Day 2016 12 / 23
Introduction Formal Problem Definition Automatic Enforcer Synthesis Conclusion Monotonicity Modify output only by appending new events ∀ σ, σ ′ ∈ Σ ∗ : σ � σ ′ = ⇒ E ψ,ϕ ( σ ) � E ψ,ϕ ( σ ′ ) Pinisetty , Preoteasa, Tripakis, J´ eron, Falcone, Marchand Predictive Runtime Enforcement Computational Logic Day 2016 13 / 23
Recommend
More recommend
