COLLECTING AND ANALYZING INTERNAL EVIDENCES OF SOFTWARE SERVICES VIA MODEL CHECKING

Transcription

1 COLLECTING AND ANALYZING INTERNAL EVIDENCES OF SOFTWARE SERVICES VIA MODEL CHECKING Xia Ning, Rajeev R. Raje, Ryan Rybarczyk, and Nahida Chowdhury 1

2 Motivation Services, Services, and Services Web Services Mobile Apps Embedded Systems too many choices from each domain what to do??? 1. Web Services Architecture: 2. Mobile Service Architecture: 3. Embedded Services Architecture: 2

3 Motivation For an user, the challenges are: Out of the available options, which service(s) to select for a specific need? Functional and QoS requirements Out of the selected choices, which service(s) will be TRUSTWORTHY? Internal and External views TRUST = Earn trust, earn trust, earn trust, Then you can worry about the rest. Seth Godin 3

4 Long-term Objectives To investigate the fundamental issues (e.g., verification, trust, qualityawareness, and composition) that are critical to achieve a rank ordering of publically available software services. To predict services behaviors (functional and non-functional) while creating distributed systems out of them. This research proposes an internal evidence-based approach to investigate how services can be organized using trustworthiness about their functional and QoS behaviors. 4

5 Intermediate-term Objectives (IOs) [IO#1] To identify and select model checking tools for generating internal evidences for the analysis of software services and identify a specific set of publically available software services from different domains such as embedded, e-commerce, and android apps. [IO#2] To propose a model checking-based approach for extracting internal evidences and mapping them onto the <Belief, Disbelief, Uncertainty> tuples and fusing with already computed external evidences to allow a rank ordering of services. [IO#3] To perform experiments and case studies on selected services to empirically evaluate the proposed approach. 5

6 Related Works Model Checking used in different domains Distributed Systems Leungwattanakit et al. Web based Services Miao et al. Armando et al. Android Applications Rosario et al. Use of External Reviews and Ratings User Reviews Gallege et al. Subjective Logic <Belief, Disbelief, Uncertainty> tuples Jøsang Theory of Evidence Shafer 6

7 [IO#1] To identify and select a set of model checking tools and publically available software services. Target domains Web Services Mobile App Embedded System General-purpose Systems One of the challenges in the proposed project is the unavailability of the source code. Use of reverse engineering Use of black-box model checking techniques Use of byte-code model checking approaches 7

8 IO#1 Approach Source Code Analysis Bounded Model Checker (BMC) e.g., C-BMC (C-based BMC) Embedded Domain Response Time as a typical QoS parameter e.g., ESBMC (Embedded Systems BMC), TLC (Temporal Logic Checker), Bytecode-based analysis e.g., Java PathFinder, SPIN, Web Services e.g., Use of RESTful API 8

9 [IO#2] To propose an approach for extracting internal evidences and map them onto the <B, D, U> tuples and fuse with external evidences to allow a rank ordering of services. Rajeev R. Raje, Ryan Rybarczyk, Xia Ning and Nahida Chowdhury 9

10 IO#2 Approach Each service, will be verified by assessing its functional and QoS properties by using appropriate model checker tools. Pass or Failure (counter examples) Trust about the behavior of each service is quantified as a <B, D, U>. Types and Severity of counter examples Associated Service Scores Logistic Regression Values iteratively adjusted based on results from model checker Lack of ground truth concordance/discordance amongst model checkers Final <B, D, U> tuple to indicate the internal view of the trust associated with that service Combine internal tuples with external tuples to obtain final tuples Borda Method Similar services ranked based on their final <B, D, U> tuples 10

11 IO#3: To empirically evaluate the proposed approach. In this preliminary work, we used two different search engine systems: Approach0 deloschang Both of the systems are distributed in nature and the common services are: Indexer Query Searcher Applied model checker tool CBMC checker 11

12 IO#3 Initial Study Properties that we checked Mainly related to secure coding: boundary check (P 1 ) pointer check (P 2 ) memory leak check (P 3 ) division by zero check (P 4 ) signed overflow check (P 5 ) unsigned overflow check (P 6 ) float overflow check (P 7 ) user provided assertions (P 8 ) We did not check other QoS-related assertions/properties. 12

13 IO#3 Initial Results System P 1 P 2 P 3 P 4 P 5 P 6 P 7 P 8 deloschang Indexer P P P P P P P P Query searcher P P P P P P P P approach0 Indexer P F F P P F P P Query searcher P F F P P P P P Internal Evidences for Two Categories of Services (P Pass, F Fail) We will examine these evidences and map them to <b, d, u> tuples and apply this techniques to other selected services. 13

14 Research Plan Explore IO#1 by 9/30/17 Investigate IO#2 by 11/30/17 Present the results in the S 2 ERC Fall Showcase around 11/15/17 Develop preliminary techniques to achieve IO#2 by 2/1/18 Design a prototypical system that will incorporate the solutions for IO#1, and IO#2 by 3/30/18 Provide a progress report in the S 2 ERC Spring Showcase around 5/15/18 Empirically validate the proposed system through case studies (IO#3) by 6/30/18 Submit the final report by 6/30/18 (We will work closely with the Industrial Affiliates throughout the duration of the project.) 14

15 References (1) Lahiru S. Gallege, Dimuthu Gamage, James H. Hill, and Rajeev R. Raje, Trustworthy Service Selection using Long-term Monitoring of Trust Contracts, Proceedings of the 17th IEEE International EDOC Conference, Lahiru Gallege, and Rajeev R. Raje, Selecting and Recommending Online Software Services by Evaluating External Attributes, Proceedings of the 11thAnnual Cyber and Information Security Research Conference, Lahiru Gallege, and Rajeev R. Raje, Parallel Methods for Evidence and Trust based Selection and Recommendation of Software Apps from Online Marketplaces, Proceedings of the 12th Annual Cyber and Information Security Research Conference, Bo Pang, Lillian Lee, and Shivakumar Vaithyanathan, ThumbsUp? Sentiment Classification using Machine Learning Techniques, Proceedings of the Empirical Methods in Natural Language Processing (EMNLP), Glen Shafer, A Mathematical Theory of Evidence, Princeton University Press, Audun Jøsang, Artificial Reasoning with Subjective Logic, Proceedings of the 2nd Australian Workshop on Common-sense Reasoning, Lahiru Gallege, Trust-based Service Selection and Recommendation for Online Software Marketplaces (TruSStReMark), PhD Thesis, IUPUI, December Mordechai Ben-Ari, A Primer on Model Checking, ACM Inroads, Vol. 1, No. 1, Pages: 40-47, March Watcharin Leungwattanakit, Cyrille Artho, Masami Hagiya, Yoshinori Tanabe, Mitsuharu Yamamoto, and Koichi Takahashi, Modular Software Model Checking for Distributed Systems, IEEE Transactions on Software Engineering, Volume: 40, Issue: 5, Page(s): , May

16 References (2) Huaikou Miao, and Hongwei Zeng, Model Checking-based Verification of Web Application, Proceedings of the 12th IEEE International Conference on Engineering Complex Computer Systems (ICECCS), Alessandro Armando, Roberto Carbone, Luca Compagna, Keqin Li, and Giancarlo Pellegrino, Model-checking Driven Security Testing of Web-based Applications, Proceedings of 3rd International Conference on Software Testing, Verification, and Validation Workshops, Ana Rosario, Espada Mar ıa del Mar Gallardo, and Alberto Salmer on,, Pedro Merino, Using Model Checking to Generate Test Cases for Android Applications, Proceedings of the 10th Workshop on Model-Based Testing, Bastian Schlich and Stefan Kowalewski, Model checking C source code for embedded systems, Journal International Journal on Software Tools for Technology Transfer (STTT), Volume 11, Issue 3, Pages: , June Raimundo Barreto, Lucas Cordeiro, and Bernd Fischer, Verifying Embedded C Software with Timing Constraints using an Untimed Model Checker, Proceedings of the Brazilian Symposium on Computing System Engineering, Java PathFinder Home Page. The TLA Home Page. SPIN Home Page. 16

17 References (3) David Lee, and Mihalis Yannakakis, Testing Finite-State Machines: State Identification and Verification, IEEE Transactions of Computers, Vol. 43, No. 3, March David Basin, Stefan Friedrich, Marek Gawkowski, and Joachim Posegga, Bytecode Model Checking: An Experimental Analysis, Proceedings of the International SPIN Workshop on Model Checking of Software, SPIN Scott Menard, Applied Logistic Regression Analysis (Quantitative Applications in the Social Sciences), 2nd Edition, Sage Publications, Inc., Cynthia Dwork, Ravi Kumar, Moni Naor, and D. Sivakumar, Rank Aggregation Methods for the Web, Proceedings of the 10th international conference on World Wide Web, The approach0 Home Page: The deloschang Home Page: 17

18 Questions? Thank You {rraje, rrybarcz, 18