Knowledge-driven Stream Monitor Synthesis

Abstract

Runtime monitoring analyzes system traces based on a given specification to provide insights into complex system behavior. However, these specifications are typically defined at a low-level of abstraction and require expertise with the monitoring tool. Translating high-level system properties to correct combinations of monitor specifications, is error-prone and may require manual effort from both domain and run- time monitoring experts. This hampers the use of runtime monitoring for settings that depend on agility in specifications, e.g., in settings where users ask about system properties. To overcome this problem, we pro- pose DynaMo, a synthesis method for stream monitors that bridges the gap between system-level properties and monitor specifications by leveraging formalized knowledge. DynaMo synthesizes and instruments a monitor specification given a knowledge base. We show how to guar- antee soundness of all monitors derived this way, provide a prototype implementation of DynaMo for TeSSLa, and demonstrate its applica- bility on a case study in which users of a digital twin investigate marine ecosystems in the Oslo Fjord.