Passive mid-stream monitoring of real-time properties

Abstract

Passive monitoring or testing of complex systems and networks running in the field can provide valuable insights into their behavior in actual environments of use. In certain contexts, such as network management and intrusion detection for security, passive monitoring is the most applicable methodology for assuring correctness of the system's behavior. More generally, it can serve to complement and extend functional testing and fault detection efforts that take place during the software/product development lifecycle. Two distinguishing aspects of passive monitoring are that: (a) the fault detection process cannot influence the execution of the system by providing particular inputs to the system, and (b) observations are obtained mid-stream, from an unknown state in the middle of the execution of the system. In this paper, we present results on passively testing for real-time behavioral properties that can be applied to a large class of systems including those that can be modeled as timed automata. Our results provide a natural extension of the passive testing study conducted in [17] for untimed properties. We have implemented our approach using the real-time model checker UPPAAL, and we report on its application to passively test fault tolerance software in a telecommunications switch developed at Lucent Technologies.