Statistics and Runtime Verification

The importance of correctness of systems is be-coming more crucial as computers control more of our everyday activities. Various approaches have been advocated and used for the verification of such cor-rectness, with one of the more promising ones being runtime verification. One important issue in runtime verification is the logic used to specify properties, since this influences both the overheads induced by the monitors, and the applicability of the approach to a particular domain. In this paper we propose techniques for the expression and runtime monitoring of statistical properties, enabling easier manipulation and expression of non-functional requirements. The logic is developed as an extension of the existing runtime verification tool LARVA, and has been applied to an ftp server implementation, adding a new layer of probabilistic intrusion detection and system profiling. Index Terms runtime verification, computational statistics, secu-rity, intrusion detection, anomaly-based detection 1