Open this publication in new window or tab >>2026 (English)In: Information and Software Technology, ISSN 0950-5849, E-ISSN 1873-6025, Vol. 195, article id 108133Article in journal (Refereed) Published
Abstract [en]
Context: Ensuring high levels of dependability in modern computer-based systems has become increasingly challenging due to their complexity. Although systems are validated at design time, their behavior can be different at runtime, possibly showing control-flow anomalies due to "unknown unknowns".
Objective: We aim to detect control-flow anomalies through software monitoring, which verifies runtime behavior by logging software execution and detecting deviations from expected control flow.
Methods: We propose a methodology to develop software monitors for control-flow anomaly detection through Large Language Models (LLMs) and conformance checking. The methodology builds on existing software development practices to maintain traditional V&V while providing an additional level of robustness and trustworthiness. It leverages LLMs to link design-time models and implementation code, automating source-code instrumentation. The resulting event logs are analyzed via conformance checking, an explainable and effective technique for control-flow anomaly detection.
Results: We test the methodology on a case-study scenario from the European Railway Traffic Management System/European Train Control System (ERTMS/ETCS), which is a railway standard for modern interoperable railways. The results obtained from the ERTMS/ETCS case study demonstrate that LLM-based source-code instrumentation can achieve up to 82.849% control-flow coverage of the reference design-time process model, while the subsequent conformance checking-based anomaly detection reaches a peak performance of 95.957% F1-score and 93.669% AUC.
Conclusion: Incorporating domain-specific knowledge to guide LLMs in source-code instrumentation significantly allowed obtaining reliable and quality software logs and enabled effective control-flow anomaly detection through conformance checking.
Place, publisher, year, edition, pages
Elsevier, 2026
Keywords
conformance checking, software monitoring, fuzzy runtime verification, cyber-physical systems, resilience, railways
National Category
Computer Sciences
Research subject
Computer and Information Sciences Computer Science, Computer Science
Identifiers
urn:nbn:se:lnu:diva-145796 (URN)10.1016/j.infsof.2026.108133 (DOI)001729790000001 ()2-s2.0-105034581936 (Scopus ID)
2026-04-072026-04-072026-05-07Bibliographically approved