arXiv subjects

Cong Tian

Publications and source records attributed to Cong Tian.

29 records · Page 2Linked to original sources

arXiv2024

Towards Practical Requirement Analysis and Verification: A Case Study on Software IP Components in Aerospace Embedded Systems

IP-based software design is a crucial research field that aims to improve efficiency and reliability by reusing complex software components known as intellectual property (IP) components. To ensure the reusability of these components, particularly in security-sensitive software systems, it is necessary to analyze the requirements and perform formal verification for each IP component. However, converting the requirements of IP components from natural language descriptions to temporal logic and subsequently conducting formal verification demands domain expertise and non-trivial manpower. This paper presents a case study on software IP components derived from aerospace embedded systems, with the objective of automating the requirement analysis and verification process. The study begins by employing Large Language Models to convert unstructured natural language into formal specifications. Subsequently, three distinct verification techniques are employed to ascertain whether the source code meets the extracted temporal logic properties. By doing so, five real-world IP components from the China Academy of Space Technology (CAST) have been successfully verified.

cs.SE↗

arXiv2023

Using Experience Classification for Training Non-Markovian Tasks

Unlike the standard Reinforcement Learning (RL) model, many real-world tasks are non-Markovian, whose rewards are predicated on state history rather than solely on the current state. Solving a non-Markovian task, frequently applied in practical applications such as autonomous driving, financial trading, and medical diagnosis, can be quite challenging. We propose a novel RL approach to achieve non-Markovian rewards expressed in temporal logic LTL$_f$ (Linear Temporal Logic over Finite Traces). To this end, an encoding of linear complexity from LTL$_f$ into MDPs (Markov Decision Processes) is introduced to take advantage of advanced RL algorithms. Then, a prioritized experience replay technique based on the automata structure (semantics equivalent to LTL$_f$ specification) is utilized to improve the training process. We empirically evaluate several benchmark problems augmented with non-Markovian tasks to demonstrate the feasibility and effectiveness of our approach.

cs.LG↗

arXiv2021

A Novel Load Balancing Scheme for Mobile Edge Computing

To overcome long propagation delays for data exchange between the remote cloud data center and end devices in Mobile Cloud Computing (MCC), Mobile Edge Computing (MEC) is merging to push mobile computing, network control and storage to the network edges. A cloudlet in MEC is a mobility-enhanced small-scale cloud, which contains several MEC servers located in close proximity to mobile devices. The main purpose of a cloudlet is to stably provide services to mobile devices with low latency. When a cloudlet offers hundreds kinds of services to millions of mobile devices, it is critical to balance the loads so as to improve performance. In this paper, we propose a three-layer mobile hybrid hierarchical P2P (MHP2P) model as a cloudlet. MHP2P performs satisfactory service lookup efficiency and system scalability as well as high stability. More importantly, a load balance scheme is provided so that the loads of MHP2P can be well balanced with the increasing of MEC servers and query load. A large number of simulation experiments indicate that the proposed scheme is efficient for enhancing the load balancing performance in MHP2P based MEC systems.

cs.DC↗

arXiv2020

Generating Adversarial Examples with Controllable Non-transferability

Adversarial attacks against Deep Neural Networks have been widely studied. One significant feature that makes such attacks particularly powerful is transferability, where the adversarial examples generated from one model can be effective against other similar models as well. A large number of works have been done to increase the transferability. However, how to decrease the transferability and craft malicious samples only for specific target models are not explored yet. In this paper, we design novel attack methodologies to generate adversarial examples with controllable non-transferability. With these methods, an adversary can efficiently produce precise adversarial examples to attack a set of target models he desires, while keeping benign to other models. The first method is Reversed Loss Function Ensemble, where the adversary can craft qualified examples from the gradients of a reversed loss function. This approach is effective for the white-box and gray-box settings. The second method is Transferability Classification: the adversary trains a transferability-aware classifier from the perturbations of adversarial examples. This classifier further provides the guidance for the generation of non-transferable adversarial examples. This approach can be applied to the black-box scenario. Evaluation results demonstrate the effectiveness and efficiency of our proposed methods. This work opens up a new route for generating adversarial examples with new features and applications.

cs.CR↗

arXiv2020

Making Streett Determinization Tight

Optimal determinization construction of Streett automata is an important research problem because it is indispensable in numerous applications such as decision problems for tree temporal logics, logic games and system synthesis. This paper presents a transformation from nondeterministic Streett automata (NSA) with $n$ states and $k$ Streett pairs to equivalent deterministic Rabin transition automata (DRTA) with $n^{5n}(n!)^{n}$ states, $O(n^{n^2})$ Rabin pairs for $k=ω(n)$ and $n^{5n}k^{nk}$ states, $O(k^{nk})$ Rabin pairs for $k=O(n)$. This improves the state of the art Streett determinization construction with $n^{5n}(n!)^{n+1}$ states, $O(n^2)$ Rabin pairs and $n^{5n}k^{nk}n!$ states, $O(nk)$ Rabin pairs, respectively. Moreover, deterministic parity transition automata (DPTA) are obtained with $3(n(n+1)-1)!(n!)^{n+1}$ states, $2n(n+1)$ priorities for $k=ω(n)$ and $3(n(k+1)-1)!n!k^{nk}$ states, $2n(k+1)$ priorities for $k=O(n)$, which improves the best construction with $n^{n}(k+1)^{n(k+1)}(n(k+1)-1)!$ states, $2n(k+1)$ priorities. Further, we prove a lower bound state complexity for determinization construction from NSA to deterministic Rabin (transition) automata i.e. $n^{5n}(n!)^{n}$ for $k=ω(n)$ and $n^{5n}k^{nk}$ for $k=O(n)$, which matches the state complexity of the proposed determinization construction. Besides, we put forward a lower bound state complexity for determinization construction from NSA to deterministic parity (transition) automata i.e. $2^{Ω(n^2 \log n)}$ for $k=ω(n)$ and $2^{Ω(nk \log nk)}$ for $k=O(n)$, which is the same as the state complexity of the proposed determinization construction in the exponent.

cs.FL↗

arXiv2019

Translating Xd-C programs to MSVL programs

C language is one of the most popular languages for software systems. In order to verify safety, reliability and security properties of such systems written in C, a tool UMC4M for runtime verification at code level based on Modeling, Simulation and Verification Language (MSVL) and its compiler MC is employed. To do so, a C program $P$ has to be translated to an MSVL program M and the negation of a desired property $Q$ is also translated to an MSVL program M', then "M and M" is compiled and executed armed with MC. Whether $P$ violates $Q$ is checked by evaluating whether there exists an acceptable execution of new MSVL program M and M". Therefore, how to translate a C program to an MSVL program is a critical issue. However, in general, C is of complicated structures with goto statement. In this paper, we confine the syntax of C in a suitable subset called Xd-C without loss of expressiveness. Further, we present a translation algorithm from an Xd-C program to an MSVL program based on translation algorithms for expressions and statements. Moreover, the equivalences between expressions and statements involved in Xd-C and MSVL programs are inductively proved. Subsequently, the equivalence between the original Xd-C program and the translated MSVL program is also proved. In addition, the proposed approach has been implemented by a tool called $C2M$. A benchmark of experiments including 13 real-world Xd-C programs is conducted. The results show that $C2M$ works effectively.

cs.PL↗

arXiv2015

Extending PPTL for Verifying Heap Evolution Properties

In this paper, we integrate separation logic with Propositional Projection Temporal Logic (PPTL) to obtain a two-dimensional logic, namely PPTL$^{\tiny\mbox{SL}}$. The spatial dimension is realized by a decidable fragment of separation logic which can be used to describe linked lists, and the temporal dimension is expressed by PPTL. We show that PPTL and PPTL$^{\tiny\mbox{SL}}$ are closely related in their syntax structures. That is, for any PPTL$^{\tiny\mbox{SL}}$ formula in a restricted form, there exists an "isomorphic" PPTL formula. The "isomorphic" PPTL formulas can be obtained by first an equisatisfiable translation and then an isomorphic mapping. As a result, existing theory of PPTL, such as decision procedure for satisfiability and model checking algorithm, can be reused for PPTL$^{\tiny\mbox{SL}}$.

cs.LO↗

arXiv2015

An Improved Decision Procedure for Linear Time Mu-Calculus

An improved Present Future form (PF form) for linear time $μ$-calculus ($ν$TL) is presented in this paper. In particular, the future part of the new version turns into the conjunction of elements in the closure of a formula. We show that every closed $ν$TL formula can be transformed into the new PF form. Additionally, based on the PF form, an algorithm for constructing Present Future form Graph (PFG), which can be utilized to describe models of a formula, is given. Further, an intuitive and efficient decision procedure for checking satisfiability of the guarded fragment of $ν$TL formulas based on PFG is proposed and implemented in C++. The new decision procedure has the best time complexity over the existing ones despite the cost of exponential space. Finally, a PFG-based model checking approach for $ν$TL is discussed where a counterexample can be obtained visually when a model violates a property.

cs.LO↗

arXiv2014

Buchi Determinization Made Tighter

By separating the principal acceptance mechanism from the concrete acceptance condition of a given Büchi automaton with $n$ states,Schewe presented the construction of an equivalent deterministic Rabin transition automaton with $o((1.65n)^n)$ states via \emph{history trees}, which can be simply translated to a standard Rabin automaton with $o((2.26n)^n)$ states. Apart from the inherent simplicity, Schewe's construction improved Safra's construction (which requires $12^nn^{2n}$ states). However, the price that is paid is the use of $2^{n-1}$ Rabin pairs (instead of $n$ in Safra's construction). Further, by introducing the \emph{later introduction record} as a record tailored for ordered trees, deterministic automata with Parity acceptance condition is constructed which exactly resembles Piterman's determinization with Parity acceptance condition where the state complexity is $O((n!)^2)$ and the index complexity is $2n$.In this paper, we improve Schewe's construction to $2^{\lceil (n-1)/2\rceil}$ Rabin pairs with the same state complexity. Meanwhile, we give a new determinization construction of Parity automata with the state complexity being $o(n^2(0.69n\sqrt{n})^n)$ and index complexity being $n$.

cs.FL↗

arXiv2011

Detecting Spurious Counterexamples Efficiently in Abstract Model Checking

Abstraction is one of the most important strategies for dealing with the state space explosion problem in model checking. In the abstract model, the state space is largely reduced, however, a counterexample found in such a model may not be a real counterexample in the concrete model. Accordingly, the abstract model needs to be further refined. How to check whether or not a reported counterexample is spurious is a key problem in the abstraction-refinement loop. In this paper, a formal definition for spurious path is given. Based on it, efficient algorithms for detecting spurious counterexamples are proposed.

cs.LO↗

arXiv2010

Making Abstraction Refinement Efficient in Model Checking

Abstraction is one of the most important strategies for dealing with the state space explosion problem in model checking. In the abstract model, although the state space is largely reduced, however, a counterexample found in such a model may not be a real counterexample. And the abstract model needs to be further refined where an NP-hard state separation problem is often involved. In this paper, a novel method is presented by adding extra variables to the abstract model for the refinement. With this method, not only the NP-hard state separation problem is avoided, but also a smaller refined abstract model is obtained.

cs.LO↗