A Study on the Acceleration of Arrival Curve Construction and Regular Specification Mining using GPUs

Data analytics is a process of examining datasets using various analytical and statistical techniques. Several tools have been proposed in the literature to extract hidden patterns, gather insights and build mathematical models from large datasets. However, these tools have been known to be computationally demanding as the datasets become larger over time. Two such recently proposed tools are the construction of arrival curves from execution traces and mining specifications in the form of regular expressions from execution traces. Though the architectures in CPUs have extensively improved over the years to execute such computationally intensive tasks, further enhancements have been impeded due to increased heat dissipation. This has resulted in enabling parallel computing through GPUs as a vastly favorable alternative to overcome the computational challenges. In this thesis, we present an exploratory work on applying GPU computing to the construction of arrival curves and mining specifications in the form of regular expressions as case studies. The novel approaches taken for each of the case studies are first presented followed by the algorithmic breakdown to expose the parallelism involved. Lastly, experiments using commodity GPUs are presented to showcase the significant speedups obtained in comparison to the equivalent non-parallel implementations

Mining Event Traces from Real-time Systems for Anomaly Detection

Real-time systems are a significant class of applications, poised to grow even further as autonomous vehicles and the Internet of Things (IoT) become a reality. The computation and communication tasks of the underlying embedded systems must comply with strict timing and safety requirements as undetected defects in these systems may lead to catastrophic failures. The runtime behavior of these systems is prone to uncertainties arising from dynamic workloads and extra-functional conditions that affect both the software and hardware over the course of their deployment, e.g., unscheduled firmware updates, communication channel saturation, power-saving mode switches, or external malicious attacks. The operation in such unpredictable environments prevents the detection of anomalous behavior using traditional formal modeling and analysis techniques as they generally consider worst-case analysis and tend to be overly conservative. To overcome these limitations, and primarily motivated by the increasing availability of generated traces from real-time embedded systems, this thesis presents TRACMIN - Trace Mining using Arrival Curves - which is an anomaly detection approach that empirically constructs arrival curves from event traces to capture the recurrent behavior and intrinsic features of a given real-time system. The thesis uses TRACMIN to fill the gap between formal analysis techniques of real-time systems and trace mining approaches that lack expressive, human-readable, and scalable methods. The thesis presents definitions, metrics, and tools to employ statistical learning techniques to cluster and classify traces generated from different modes of normal operation versus anomalous traces. Experimenting with multiple datasets from deployed real-time embedded systems facing performance degradation and hardware misconfiguration anomalies demonstrates the feasibility and viability of our approaches on timestamped event traces generated from an industrial real-time operating system. Acknowledging the high computation expense for constructing empirical arrival curves, the thesis provides a rapid algorithm to achieve desirable scalability on lengthy traces paving the way for adoption in research and industry. Finally, the thesis presents a robustness analysis for the arrival curves models by employing theories of demand-bound functions from the scheduling domain. The analysis provides bounds on how much disruption a real-time system modeled using our approach can tolerate before being declared anomalous, which is crucial for specification and certification purposes. In conclusion, TRACMIN combines empirical and theoretical methods to provide a concrete anomaly detection framework that uses robust models of arrival curves scalably constructed from event traces to detect anomalies that affect the recurrent behavior of a real-time system