Accelerated Learning of Predictive Runtime Monitors for Rare Failure

Predictive runtime verification estimates the probability of a future event by monitoring the executions of a system. In this paper we use Discrete-Time Markov Chains (DTMC) as predictive models that are trained from many execution samples demonstrating a rare event: an event that occurs with very low probability. More specifically, we propose a method of grammar inference by which a DTMC is learned with far fewer samples than normal sample distribution. We exploit the concept of importance sampling, and use a mixture of samples, generated from the original system distribution and distributions that are suitably modified to produce more failures. Using the likelihood ratios of the various samples, we ensure the final trained model is faithful to the original distribution. In this way we construct accurate predictive models with orders of magnitude fewer samples. We demonstrate the gains of our approach on a file transmission protocol case study from the literature, and highlight future directions.