Network Monitoring with Real-Time Properties: A Step Forward

In passive monitoring, faults are detected while the System Under Test (SUT) is observed during its normal operation. Usually traces produced by SUT are recorded and compared with those of the specification. In certain contexts, such as network management and intrusion detection for security, passive monitoring is the most applicable methodology for assuring correctness of the systems behavior. This approach can provide valuable insights into systems behavior in actual environments of use. Key challenges of passive monitoring are: (a) the fault detection process cannot influence the execution of the system by providing particular inputs to the system; (b) observations are obtained mid-stream, from an unknown state in the middle of the execution of the system; (c) real-time behavioral properties should be considered during the process; (d) the monitoring is carrying out on the fly. In this paper, we present an approach to passively monitoring a network system with real-time properties. We represent timing information in the form of time-intervals between successive occurrence of events (i.e., packets/messages exchanged among peers).