Monitoring Hyperproperties over Observed and Constructed Traces

2025-08-04

AI Summary

Runtime monitoring of hyperproperties—e.g., linearizability and noninterference—remains challenging, especially for asynchronous hyperproperties involving alternating trace quantification. Existing approaches are limited by finite-trace assumptions and lack support for real-time verification over infinite domains. Method: This paper proposes a dynamic verification framework that synergistically combines passive observation with active trace generation. It introduces *generating functions* to construct unobserved execution traces and extends HyperLTL logic with formal semantics over infinite domains. A decidable, interpretable monitoring algorithm is designed to overcome the finite-trace restriction. Results: The approach enables the first real-time monitoring of asynchronous, alternation-rich hyperproperties. Prototype implementations cover representative concurrency and security scenarios, demonstrating end-to-end verification of diverse hyperproperties. Experimental evaluation confirms both theoretical soundness and engineering practicality, significantly enhancing expressiveness and applicability of runtime hyperproperty verification.

Technology Category

• Knowledge Representation and Reasoning: Computational Complexity of Reasoning
• Constraint Satisfaction and Optimization: Satisfiability Modulo Theories
• Machine Learning: Calibration & Uncertainty Quantification

Application Category

• Graph Algorithms and Modeling for the Web: Efficient manipulation of static and dynamic Web-related graphs
• Systems and Infrastructure for Web, Mobile and WoT: Web performance, measurement, and characterization
• Security and Privacy: Large-scale security measurements

Abstract

We study the problem of monitoring at runtime whether a system fulfills a specification defined by a hyperproperty, such as linearizability or variants of non-interference. For this purpose, we introduce specifications with both passive and active quantification over traces. While passive trace quantifiers range over the traces that are observed, active trace quantifiers are instantiated with emph{generator functions}, which are part of the specification. Generator functions enable the monitor to construct traces that may never be observed at runtime, such as the linearizations of a concurrent trace. As specification language, we extend hypernode logic with trace quantifiers over generator functions and interpret these hypernode formulas over possibly infinite domains. We present a corresponding monitoring algorithm, which we implemented and evaluated on a range of hyperproperties for concurrency and security applications. Our method enables, for the first time, the monitoring of asynchronous hyperproperties that contain alternating trace quantifiers.

Problem

• Monitoring runtime system compliance with hyperproperty specifications
• Introducing passive and active trace quantification for monitoring
• Enabling monitoring of asynchronous hyperproperties with alternating quantifiers

Innovation

• Passive and active trace quantification
• Generator functions construct traces
• Extended hypernode logic monitoring