FlexFringe: Modeling Software Behavior by Learning Probabilistic Automata

TL;DR

The paper tackles automated learning of probabilistic automata from software traces by extending FlexFringe with efficient state-merging (red-blue framework) and multiple evaluation functions. It introduces speedups (sinks, pooling, counting, merge constraints, searching) and implements several evaluation strategies (Alergia, Likelihood-ratio, MDI, AIC) to balance accuracy and model complexity. Empirical results on PAutomaC show competitive performance, while HDFS experiments demonstrate interpretable models and strong anomaly-detection capabilities, even rivaling neural nets in some settings. Overall, the work advances practical, interpretable PDFA learning for software systems and provides a flexible toolkit for exploring different learning strategies and their trade-offs.

Abstract

We present the efficient implementations of probabilistic deterministic finite automaton learning methods available in FlexFringe. These implement well-known strategies for state-merging including several modifications to improve their performance in practice. We show experimentally that these algorithms obtain competitive results and significant improvements over a default implementation. We also demonstrate how to use FlexFringe to learn interpretable models from software logs and use these for anomaly detection. Although less interpretable, we show that learning smaller more convoluted models improves the performance of FlexFringe on anomaly detection, outperforming an existing solution based on neural nets.

Figures (9)

• Figure 1: A prefix tree printed by FlexFringe and displayed using Graphviz dot. Each state contains a state number, occurrence counters for the total number of traces (#), as well as how many of them end (fin counts in format type:count) or pass through (path counts in format type:count) for each trace type (in this case positive - type 1). The last two numbers in each state are the sums of path and fin counts over all types. One can use these to infer what traces occurred in the training data, e.g., a-a-a-b-b occurred 3 times, following transitions from state 0-1-2-4-9 and ending in state 17. Transitions are labeled by symbols and occurrence counts. The initial state has a solid edge, indicating it has already been learned as an automaton state. The dotted states can still be merged with both solid and dotted states. Note that this is the default print setting. One can modify what is printed using command-line parameters or by defining a new printing function.
• Figure 2: An automaton model printed after running FlexFringe (top). It contains the same type of counts as the prefix tree. To obtain a PDFA from these counts, one needs to normalize them to obtain transition and final probabilities (bottom). Traces only end in the third state, making it the only possible ending state. The learned PDFA, therefore, correctly represents the set of traces starting with "a" and ending in "b", i.e., $a(a|b)^*b$. A learned PDFA can assign probabilities to new sequences by following transitions and multiplying their probabilities. It can also be used for anomaly detection, for instance, by checking whether a new trace ends in a state with a final probability of 0.
• Figure 3: The union/find data structure in FlexFringe after performing the first merge operation (state 2, reached by a-a, is merged with state 1, creating a self-loop). For clarity, we removed the fin and path counts. The unmerged part of the PDFA is solid, and the merged parts are dotted. The arcs labeled "rep" are the representative pointers for the union/find structure. Whenever the algorithm queries a state with a representative, the structure follows the "rep" pointers until it finds a state without a representative and returns this one instead. Thus, when looking for the target of the transition with label "a" from state 1, it will return state 1 (the representative of state 2). States with representatives cannot be merged, but it is possible to merge states that are the representative of others, such as state 3.
• Figure 4: The red-blue framework corresponding to the union/find sets from Figure \ref{['fig:union/find']}. The red states are the identified parts of the automaton. The blue states are the current candidates for merging. The uncolored states are pieces of the prefix tree that can, at this stage, only be merged during determinization. Currently, only state 3 is a merge candidate. FlexFringe will test the merges of state 3 with 0 and state 3 with 1. If consistent, the highest-scoring merge will be performed. If both are inconsistent, state 3 will be colored red, and states 6 and 7 will be colored blue.
• Figure 5: The first six lines of the HDFS training data provided to FlexFringe in Abbadingo format lang1998results. The first line gives the number of sequences and the alphabet size. Then, each line presents a sequence by specifying the sequence type, length, and the sequence itself as a list of symbols. All traces have type 1, meaning they are all valid system occurrences. When multiple classes or sequence types are available, one can specify the type here in order to learn a classifier. In this use case, we learn a probabilistic model and do not care about sequence types. From these few sequences, we already see several subprocesses with symbols: 5s-22s at the start, 11s-9s in the middle, and 23s-21s at the end. Optionally, 2s-3s-4s appears before the 23s-21s. FlexFringe will capture such structures and more hidden ones.

Theorems & Definitions (3)

• Definition 2.1
• Definition 2.2
• Definition 2.3