FORMAL FAILURE MODELS

In this paper we revisit the topic of dialogue grammars at the illocutionary force level and present a new approach to the formal modelling, evaluation and comparison of these models based on recursive transition networks. Through the use of appropriate tools such finite-state grammars can be formally analysed and validated against empirically collected corpora. To illustrate our approach we show: (a) the construction of human-human dialogue grammars on the basis of recently collected natural language dialogues in joint-task situations; and (b) the evaluation and comparison of these dialogue grammars using formal methods. This work provides a novel basis for developing and evaluating dialogue grammars as well as for engineering corpus-tailored dialogue managers which can be verified for adequacy.KeywordsDialogue SystemDialogue ModelDialogue ManagementDialogue StructureDialogue ParticipantThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

To cope with large data sets, distributed data stores partition their data across servers. However, real-world systems usually do not provide useful transactional semantics for operations accessing multiple partitions due to the delays involved in achieving multi-partition consistency. Read Atomic Multi-Partition (RAMP) transactions have recently been proposed as efficient light-weight multi-partition transactions that guarantee read atomicity: either all updates or no updates of a transaction are visible to other transactions. In this paper we formalize RAMP transactions in rewriting logic and perform model checking verification of key properties using the Maude tool. In particular, we develop detailed formal models---and formally analyze---a number of extensions and optimizations of RAMP that are only briefly mentioned by the RAMP developers.

This paper describes the application of Real-Time Maude to the formal modeling, simulation, and model checking analysis of the NORM multicast protocol standard being developed by the Internet Engineering Task Force. Because of its size and sophistication, real-time features, and the need to model and analyze subcomponents of NORM both in isolation and in combination, NORM poses a set of challenging problems for its formal specification and analysis. Our formal modeling and analysis efforts made us aware of ambiguities, inconsistencies, and cases of under-specification in the informal specification of NORM. Our work indicates that formal methods can successfully be applied by non-experts during the development of advanced Internet protocol standards.

The Internet of Vehicles (IoV) is becoming an interesting topic among researchers and it has emerged as a rapidly advancing field within Vehicular Ad-hoc Networks, facilitating intelligent communication between vehicles and the cloud through the integration of Internet of Things (IoT) technologies. The IoV surroundings face serious challenges due to the highly interrelated nature of vehicles and infrastructure in certifying privacy and security. Traditional approaches to authentication lack the strength required to protect against developing fears, leaving systems vulnerable to attacks. This survey addresses the gap by employing formal analysis approaches to prove authentication protocols, targeting to reinforce safety and confidentiality in IoV systems. The IoV communication model consists of Vehicle-to-Vehicle, Vehicle-to-Infrastructure, Vehicle-to-Personal Devices, and Vehicle-to-Cloud. Smart automobiles are equipped with cameras, radars, on-board units, and sensors to help reduce the number of accidents by giving drivers or autonomous vehicles up-to-date information on roads, traffic signals, and other pertinent entities. As human lives are at risk, security and privacy in the IoV communication paradigm are critical and cannot neglected. Security and privacy breaches may cause accidents because the attacker can inject false information into the system as the communication channel is open and unsecured. The researchers proposed many authentication protocols to provide secure communication between IoV entities. Although surveys on IoV security and privacy issues deal with communication and computation costs, they lack formal analysis of the authentication protocols. This survey reviews the informal analysis and formal analysis methods used by various authentication protocols. Furthermore, the challenges and future work are also included in this survey.

There is so much agreement between my views on this subject and those expressed by Charles Tilly that what I will say can hardly be construed as con stituting a controversy. Let me agree at outset: Formal analysis and quantitative methods it makes possible have become standard, indispensable adjuncts to research in labor history, as in social history as a whole. As Tilly puts it, the periphery constrains core. The central, most difficult ques tions in social history (most of which attempt to link political behavior with social background and identity) cannot be answered by quantitative methods alone, because they require one to make inferences about motives and percep tions that are not amenable to formal analysis. That historical actors them selves cannot observe each others' perceptions or motives is responsible for a great deal of violence and injustice that history has recorded. How actors manage to overcome this difficulty and to act in unison, confident of each oth ers' mutual accord, cannot be explained or even described by means of formal models. An almost preverbal negotiation constantly going forward in human social life conditions everything else. Certain kinds of actions and conditions can be counted but only because societies themselves standardize and classify these actions and conditions. That is, formal models themselves often play a role in solutions that his torical actors seize upon to coordinate life in communities. A wedding cere mony, a voting procedure, or a picket line are enactments of highly structured, formalized scenarios which, so to speak, prescribe motives for partici pants. Bride and groom by conventional expectation wish to cohabit, voters to choose representatives, pickets to restrict access to workplace. The formal scenario for action is often arranged to allow for policing of actors' motives to make sure that they indeed conform to prescribed ones. In other words, uncertainty about motives is allowed for in system. Bride and groom are separately asked if they wish to marry, and witnesses attest to their responses in writing. Voters are put in booths to ensure that they consult only their own preference in voting. Forces of order nervously observe pickets to ensure they do no more than picket, just as pickets observe entrance to workplace to ensure that all their fellow workers really continue to want to strike. Formalized public action is one of principal means by which human

In the ForMoSA project [18] an integrated approach for safety analysis of critical, embedded systems has been developed. The approach brings together the best of engineering practice, formal methods and mathematics: traditional safety analysis, temporal logics and verification, and statistics and optimization.These three orthogonal techniques cover three different aspects of safety: fault tolerance, functional correctness and quantitative analysis. The ForMoSA approach combines these techniques to answer the safety relevant questions in a structured and formal way. Furthermore, the tight combination of methods from different analysis domains yields results which can not be produced by any single technique.The methodology was applied in form of case studies to different industrial domains. One of them is the height control of the Elbtunnel in Hamburg [17] from the domain of electronic traffic control, which we present as an illustrating example.

Formal security analysis of LoRaWAN

Cognitive network is a new approach to solve self-management of complex heterogeneous network, and its model and analysis method are key problems to be solved. a formal modeling and analysis method for cognitive network is proposed based on stochastic process algebra. Firstly, basic concept of PEPA is introduced. then system behaviors are abstracted combining with cognitive essence, and formal models for cognitive network are constructed from the angles of macroscopic operating states and internal services with PEPA respectively. on the basis, quantitative analysis method is discussed. the proposed modeling and analysis method has the features logical accuracy, which can apply in any phases and direct the designation of cognitive network.

Formal analyses using human mental models have been effective in identifying how automation behavior can cause mode confusion and associated human error. However, state-machine-based mental model formalisms are unrealistically precise. To address this, we introduce Fuzzy Mental Models (FMMs). FMMs combine state machines with fuzzy logic to precisely represent vagueness in mental models. We define how FMMs integrate into larger formal system models, where the state of the automation and FMM co-evolve. We identify patterns within a system model that indicate mode confusion. These include new conditions that emerge only through the vagueness captured by FMMs. We also present a model-based analysis capable of discovering the mode confusion patterns in system models containing FMMs. Our approach is demonstrated with two realistic case studies: a modern automobile gear shifter and a cloud storage file system. We conclude by discussing the implications of our contributions and directions for future research.

The IPsec standard aims to provide application-transparent end-to-end security for the Internet Protocol. The security properties of IPsec critically depend on the underlying key exchange protocols, known as IKE (Internet Key Exchange). We provide the most extensive formal analysis so far of the current IKE versions, IKEv1 and IKEv2. We combine recently introduced formal analysis methods for security protocols with massive parallelization, allowing the scope of our analysis to go far beyond previous formal analysis. While we do not find any significant weaknesses on the secrecy of the session keys established by IKE, we find several previously unreported weaknesses on the authentication properties of IKE.

We describe our experiences successfully applying lightweight formal methods to substantially improve and reformulate an important part of Standard Portable Intermediate Representation SPIRV, an industry-standard language for GPU computing. The formal model that we present has allowed us to (1) identify several ambiguities and needless complexities in the way that structured control flow was defined in the SPIRV specification; (2) interact with the authors of the SPIRV specification to rectify these problems; (3) validate the developer tools and conformance test suites that support the SPIRV language by cross-checking them against our formal model, improving the tools, test suites, and our models in the process; and (4) develop a novel method for fuzzing SPIRV compilers to detect miscompilation bugs that leverages our formal model. The latest release of the SPIRV specification incorporates the revised set of control-flow definitions that have arisen from our work. Furthermore, our novel compiler-fuzzing technique has led to the discovery of twenty distinct, previously unknown bugs in SPIRV compilers from Google, the Khronos Group, Intel, and Mozilla. Our work showcases the practical impact that formal modelling and analysis techniques can have on the design and implementation of industry-standard programming languages.

BackgroundBrain, heart and skeletal muscle share similar properties of excitable tissue, featuring both discrete behavior (all-or-nothing response to electrical activation) and continuous behavior (recovery to rest follows a temporal path, determined by multiple competing ion flows). Classical mathematical models of excitable cells involve complex systems of nonlinear differential equations. Such models not only impair formal analysis but also impose high computational demands on simulations, especially in large-scale 2-D and 3-D cell networks. In this paper, we show that by choosing Hybrid Automata as the modeling formalism, it is possible to construct a more abstract model of excitable cells that preserves the properties of interest while reducing the computational effort, thereby admitting the possibility of formal analysis and efficient simulation.ResultsWe have developed CellExcite, a sophisticated simulation environment for excitable-cell networks. CellExcite allows the user to sketch a tissue of excitable cells, plan the stimuli to be applied during simulation, and customize the diffusion model. CellExcite adopts Hybrid Automata (HA) as the computational model in order to efficiently capture both discrete and continuous excitable-cell behavior.ConclusionsThe CellExcite simulation framework for multicellular HA arrays exhibits significantly improved computational efficiency in large-scale simulations, thus opening the possibility for formal analysis based on HA theory. A demo of CellExcite is available at .

The situation of telecommunications systems is rapidly evolving towards a state characterized by the presence of a multitude of services integrated in a single network structure. In order to ease their integration, it is important to provide an unambiguous description of the organization, of the functionality, and of the relationships existing among services. Since it is not possible to completely foresee the situation of services in the future, the description should be modular, so that the task of adding new services to an existing environment is simplified. Formal description techniques are languages designed to handle such descriptions. Their goal is to produce correct and unambiguous specifications, understanding and modeling the system and the domain within which it operates. Their input is a set of required statements and a conceptual overview of the system. Their output is a formal representation that captures the functional behavior. On the other hand, the throughput of physical networks is constantly growing, reaching the order of Gbit/s. In the meantime, services needing high throughput, like multimedia conferencing systems are being designed, creating a need for flexible, high performance communication systems. An important feature of new high speed services is their increased need for guarantees. Therefore, the use of powerful performance modeling techniques becomes of prime importance. Their goal is to obtain some notion of how the system will perform under a given set of conditions. Performance evaluation theorists have long been using system specifications to make a heuristic model of the system and then an analysis of the model. When system specifications exist, the question arises whether a more direct path to performance analysis can be found. Our scope is to provide a methodology that fully and consistently integrates formal specification and performance evaluation. A problem is that many of the bottlenecks and impediments to smooth data flow have to do with implementation issues not directly dealt within the system specification itself. Therefore, prior to generating a performance model, the formal specification should be enhanced with the relevant non-functional information. It is essential to assure a smooth specification of the non-functional information. Thus, it is necessary to consistently add this information to the formal specification. Besides, the extended formal method should focus on conserving the semantics of the original one, and on providing a coherent extension of the semantics and syntax for the new concepts. Since all relevant required information is integrated within the formal extended representation, we provide a mapping technique that translates the extended formal representation into a performance modeling conserving the properties of the formal model. In parallel to the development of a performance model, the formal model can be validated and verified, and their implementation can be tested for conformance towards the original formal model. Finally, the performance modelling is implemented in a programming language, and then simulated. The results from simulation can be reused as inputs for the optimization of the formal specification (functional optimization) or the extended formal model (design optimization). To sum up, the goal of this work is to: Define extensions to current formal methods that allow to enhance the formal specification with performance modeling related information. Develop a method to translate the extended formal specification into a performance modeling. Develop rules and guidelines to automatically implement the performance modeling for the purpose of a performance evaluation (we use the commercial tool Opnet). Develop a consistent and coherent methodology for the integration of performance modeling and formal specification.

With the widespread adoption of web applications and cloud services, the OAuth 2.0-based OpenID Connect (OIDC) Single Sign-on (SSO) protocol has become the core of modern digital identity authentication. Although the OIDC protocol itself has strict security specifications, its implementation in real-world web frameworks can introduce critical vulnerabilities, particularly the improper omission of the state parameter, which leads to severe authentication forgery risks. Existing research often overlooks these implementation-level flaws, especially from a formal analysis perspective. This paper addresses this gap by formally analyzing the authentication forgery attack resulting from the missing state parameter. We construct a high-fidelity web framework model and, using the Tamarin formal analysis tool, systematically analyze the flawed OIDC implementation. Specifically, we demonstrate an attack path where cross-site request forgery is leveraged as a vector to deceive the relying party, ultimately achieving identity binding forgery—linking the attacker’s identity to the victim’s session. In response to this forgery vulnerability, this article proposes and formally verifies corresponding patches to successfully defend against such attacks. Finally, this paper provides concrete guidance for developers. This research, through formal methods, characterizes a replicable authentication forgery pattern within modern web architectures, providing a robust theoretical and practical foundation for hardening SSO systems against such advanced forgery threats.

This volume contains the proceedings of the 4th International Conference on Formal Modelling and Analysis of Timed Systems (FORMATS 2006), held in Paris (France) on September 25-27, 2006. The aim of FORMATS is to promote the study of fundamental and practical aspects of timed systems, and to bring together researchers from different disciplines that share interests in modelling and analysis of timed systems.