Cyclic debugging requires repeatable executions. As non-deterministic or real-time systems typically do not have the potential to provide this, special methods are required. One such method is replay, a process that requires monitoring of a running system and logging of the data produced by that monitoring. We shall discuss the process of preparing the replay, a part of the process that has not been very well described before.
Zambonelli and Netzer @cite_2 proposed a method that, by taking on-line decisions on whether to log or not to log a monitored event, deviates from the strict FIFO-solution. However, sometimes logging will debit the system with a jitter in the execution time, and so will also the algorithm it self. As larger jitter will force more extensive efforts for validation @cite_6 , an increase in jitter is counterproductive to the validation effort.
@cite_6 @cite_2
2143295017 2110140003
The enactment of business processes is generally supported by information systems that record data about each process execution (a.k.a. case). This data can be analyzed via a family of methods broadly known as process mining. Predictive process monitoring is a process mining technique concerned with predicting how running (uncompleted) cases will unfold up to their completion. In this paper, we propose a predictive process monitoring framework for estimating the probability that a given predicate will be fulfilled upon completion of a running case. The framework takes into account both the sequence of events observed in the current trace, as well as data attributes associated to these events. The prediction problem is approached in two phases. First, prefixes of previous (completed) cases are clustered according to control flow information. Secondly, a classifier is built for each cluster using event data attributes to discriminate between cases that lead to a fulfillment of the predicate under examination and cases that lead to a violation within the cluster. At runtime, a prediction is made on a running case by mapping it to a cluster and applying the corresponding classifier. The framework has been implemented in the ProM toolset and validated on a log pertaining to the treatment of cancer patients in a large hospital. This paper presents an analytical model to compute the average service time and jitter experienced by a packet when transmitted in a saturated IEEE 802.11 ad hoc network. In contrast to traditional work in the literature, in which a distribution is usually fitted or assumed, we use a bottom-up approach and build the first two moments of the service time based on the IEEE 802.11 binary exponential backoff algorithm and the events underneath its operation. Our model is general enough to be applied to any type of IEEE 802.11 wireless ad hoc network where the channel state probabilities driving a node's backoff operation are known. We apply our model to saturated single-hop ad hoc networks under ideal channel conditions. We validate our model through extensive simulations and conduct a performance evaluation of a node's average service time and jitter for both direct sequence and frequency-hopping spread spectrum physical layers. It has been almost thirty years since Shannon introduced the sampling theorem to communications theory. In this review paper we will attempt to present the various contributions made for the sampling theorems with the necessary mathematical details to make it self-contained. We will begin by a clear statement of Shannon's sampling theorem followed by its applied interpretation for time-invariant systems. Then we will review its origin as Whittaker's interpolation series. The extensions will include sampling for functions of more than one variable, random processes, nonuniform sampling, nonband-limited functions, implicit sampling, generalized functions (distributions), sampling with the function and its derivatives as suggested by Shannon in his original paper, and sampling for general integral transforms. Also the conditions on the functions to be sampled will be summarized. The error analysis of the various sampling expansions, including specific error bounds for the truncation, aliasing, jitter and parts of various other errors will be discussed and summarized. This paper will be concluded by searching the different recent applications of the sampling theorems in other fields, besides communications theory. These include optics, crystallography, time-varying systems, boundary value problems, spline approximation, special functions, and the Fourier and other discrete transforms. Anomaly detection is a critical step towards building a secure and trustworthy system. The primary purpose of a system log is to record system states and significant events at various critical points to help debug system failures and perform root cause analysis. Such log data is universally available in nearly all computer systems. Log data is an important and valuable resource for understanding system status and performance issues; therefore, the various system logs are naturally excellent source of information for online monitoring and anomaly detection. We propose DeepLog, a deep neural network model utilizing Long Short-Term Memory (LSTM), to model a system log as a natural language sequence. This allows DeepLog to automatically learn log patterns from normal execution, and detect anomalies when log patterns deviate from the model trained from log data under normal execution. In addition, we demonstrate how to incrementally update the DeepLog model in an online fashion so that it can adapt to new log patterns over time. Furthermore, DeepLog constructs workflows from the underlying system log so that once an anomaly is detected, users can diagnose the detected anomaly and perform root cause analysis effectively. Extensive experimental evaluations over large log data have shown that DeepLog has outperformed other existing log-based anomaly detection methods based on traditional data mining methodologies. We investigate the importance of space when solving problems based on graph distance in the streaming model. In this model, the input graph is presented as a stream of edges in an arbitrary order. The main computational restriction of the model is that we have limited space and therefore cannot store all the streamed data; we are forced to make space-efficient summaries of the data as we go along. For a graph of n vertices and m edges, we show that testing many graph properties, including connectivity (ergo any reasonable decision problem about distances) and bipartiteness, requires Ω(n) bits of space. Given this, we then investigate how the power of the model increases as we relax our space restriction. Our main result is an efficient randomized algorithm that constructs a (2t + 1)-spanner in one pass. With high probability, it uses O(t .n1+1 t log2n) bits of space and processes each edge in the stream in O(t2·n1 t log n) time. We find approximations to diameter and girth via the constructed spanner. For t = Ω(log n log log n), the space requirement of the algorithm is O(n .polylog n), and the per-edge processing time is O(polylog n). We also show a corresponding lower bound of t for the approximation ratio achievable when the space restriction is O(t.n1+1 t log2n).We then consider the scenario in which we are allowed multiple passes over the input stream. Here, we investigate whether allowing these extra passes will compensate for a given space restriction. We show that finding vertices at distance d from a particular vertex will always take d passes, for all d ∈ 1,...,t 2 , when the space restriction is o(n1+1 t). For girth, we show the existence of a direct trade-off between space and passes in the form of a lower bound on the product of the space requirement and number of passes. Finally, we conclude with two general techniques for speeding up the per-edge computation time of streaming algorithms while increasing the space by at most a log factor. Business processes are prone to subtle changes over time, as unwanted behavior manifests in the execution over time. This problem is related to anomaly detection, as these subtle changes start of as anomalies at first, and thus it is important to detect them early. However, the necessary process documentation is often outdated, and thus not usable. Moreover, the only way of analyzing a process in execution is the use of event logs coming from process-aware information systems, but these event logs already contain anomalous behavior and other sorts of noise. Classic process anomaly detection algorithms require a dataset that is free of anomalies; thus, they are unable to process the noisy event logs. Within this paper we propose a system, relying on neural network technology, that is able to deal with the noise in the event log and learn a representation of the underlying model, and thus detect anomalous behavior based on this representation. We evaluate our approach on five different event logs, coming from process models with different complexities, and demonstrate that our approach yields remarkable results of 97.2 F1-score in detecting anomalous traces in the event log, and 95.6 accuracy in detecting the respective anomalous activities within the traces. This paper discusses our research into algorithms for creating anefficient bidirectional debugger in which all traditional forward movement commands can be performed with equal ease in the reverse direction. We expect that adding these backwards movement capabilities to a debugger will greatly increase its efficacy as a programming tool. The efficiency of our methods arises from our use of event countersthat are embedded into the program being debugged. These counters areused to precisely identify the desired target event on the fly as thetarget program executes. This is in contrast to traditional debuggers that may trap back to the debugger many times for some movements. For reverse movements we re-execute the program (possibly using two passes) to identify and stop at the desired earlier point. Our counter based techniques are essential for these reverse movements because they allow us to efficiently execute through the millions of events encountered during re-execution. Two other important components of this debugger are its I O logging and checkpointing. We log and later replay the results of system callsto ensure deterministic re-execution, and we use checkpointing to bound theamount of re-execution used for reverse movements. Short movements generally appear instantaneous, and the time for longer movements is usually bounded within a small constant factor of the temporal distance moved back. Log-based PKI enhancements propose to improve the current TLS PKI by creating public logs to monitor CA operations, thus providing transparency and accountability. In this paper we take the first steps in studying the deployment process of log-based PKI enhancements in two ways. First, we model the influences that parties in the PKI have to incentivize one another to deploy a PKI enhancement, and determine that potential PKI enhancements should focus their initial efforts on convincing browser vendors to deploy. Second, as a promising vendor-based solution we propose deployment status filters, which use a Bloom filter to monitor deployment status and efficiently defend against downgrade attacks from the enhanced protocol to the current TLS PKI. Our results provide promising deployment strategies for log-based PKI enhancements and raise additional questions for further fruitful research. The new asynchronous transfer mode (ATM) will be used for the information transport in the future broadband network. An important function of the ATM network is bandwidth enforcement or policing. The so-called ‘leaky bucket’ algorithm can be used to monitor and enforce the bit rate of a constant bit rate (CBR) connection. The parameters of the ‘leaky bucket’ algorithm depend on the bit rate of the connection and on the cell delay jitter. Sugestions for setting the parameters of the ‘leaky bucket’ algorithm are provided in this paper. Furthermore, a ‘dual leaky bucket’ algorithm is proposed to police the traffic parameters of a variable bit rate (VBR) connection. The ‘dual leaky bucket’ approach could also be used to define a VBR bearer service in the future broadband network. Predictive business process monitoring aims at leveraging past process execution data to predict how ongoing (uncompleted) process executions will unfold up to their completion. Nevertheless, cases exist in which, together with past execution data, some additional knowledge (a-priori knowledge) about how a process execution will develop in the future is available. This knowledge about the future can be leveraged for improving the quality of the predictions of events that are currently unknown. In this paper, we present two techniques - based on Recurrent Neural Networks with Long Short-Term Memory (LSTM) cells - able to leverage knowledge about the structure of the process execution traces as well as a-priori knowledge about how they will unfold in the future for predicting the sequence of future activities of ongoing process executions. The results obtained by applying these techniques on six real-life logs show an improvement in terms of accuracy over a plain LSTM-based baseline. Nowadays, business processes are increasingly supported by IT services that produce massive amounts of event data during the execution of a process. This event data can be used to analyze the process using process mining techniques to discover the real process, measure conformance to a given process model, or to enhance existing models with performance information. While it is essential to map the produced events to activities of a given process model for conformance analysis and process model annotation, it is also an important step for the straightforward interpretation of process discovery results. In order to accomplish this mapping with minimal manual effort, we developed a semi-automatic approach that maps events to activities using the solution of a corresponding constraint satisfaction problem. The approach extracts behavioral profiles from both the log and the model to build constraints to efficiently reduce the number of possible mappings. The evaluation with an industry process model collection and simulated event logs demonstrates the effectiveness of the approach and its robustness towards non-conforming execution logs. In a document network such as a citation network of scientific documents, web-logs, etc., the content produced by authors exhibits their interest in certain topics. In addition some authors influence other authors' interests. In this work, we propose to model the influence of cited authors along with the interests of citing authors. Moreover, we hypothesize that apart from the citations present in documents, the context surrounding the citation mention provides extra topical information about the cited authors. However, associating terms in the context to the cited authors remains an open problem. We propose novel document generation schemes that incorporate the context while simultaneously modeling the interests of citing authors and influence of the cited authors. Our experiments show significant improvements over baseline models for various evaluation criteria such as link prediction between document and cited author, and quantitatively explaining unseen text. Consider a bipartite graph G = (O, D, E) where O and D are origin and destination node sets respectively (O = D = n), and E is a set of edges (i, j), i ∈ O and j ∈ D(E= m). Suppose we draw the origin nodes and the destination nodes arranged in two columns and the edges as straight line segments between origins and destinations. A noncrossing matching is a subset of edges M ⊑ E such that no two edges of M intersect (including intersections at nodes). The Maximum Non Crossing Matching (MNCM) is the problem of finding the noncrossing matching of maximum cardinality. Let p denote the cardinality of the MNCM. Problems arising in several fields can be modelled as MNCM: for example the 3-Side Switch Box in VLSI design has been presented in [2] where an O(n 2) time algorithm is proposed. The problem can be reduced to the one of finding the longest increasing subsequence in a permutation of size m [1]. An algorithm for this problem has been proposed by Fredman and slightly improved by Widmayer and Wong[7]; in our case the algorithm complexity is O(m + (m - p) log (p). In this paper some labeling algorithms for the MNCM, which work directly on the bipartite graph, will be proposed. The overall complexity is improved to O(m log log n) or to O(m + minnp, (m - p) log p). Finally the weighted case is considered. We study the optimal streaming of variable bit-rate (VBR) video over a random VBR channel. The goal of a streaming application is to enable the successful decoding of each video object before its displaying deadline is violated. Hence, we define the main performance metric of a streaming system as the probability of un-interrupted video presentation, or jitter-free probability. Previous literature has described solutions to estimate the jitter-free probability by assuming either independence in the encoded data process or simplistic channel models. In this work, we present a novel analytical framework, which requires only some basic statistical information of an arbitrary VBR channel, to bound the probability of jitter-free playout under the constraint of initial playout delay and receiver buffer size. Both the infinite and finite buffer cases are considered. This technique is then applied to investigate streaming over a wireless system modeled by an extended Gilbert channel with ARQ transmission control. Experimental results with MPEG-4 VBR encoded video demonstrates that the proposed analysis derives close bounds to the actual system performance. Finally, we show that the proposed analysis provides a theoretical foundation to quantify the tradeoffs between the initial playout delay, the receiver buffer size, and the jitter-free probability for a general class of VBR streaming over random VBR channels. In many real-world applications, sensitive information must be kept in log files on an untrusted machine. In the event that an attacker captures this machine, we would like to guarantee that he will gain little or no information from the log files and to limit his ability to corrupt the log files. We describe a computationally cheap method for making all log entries generated prior to the logging machine's compromise impossible for the attacker to read, and also impossible to undetectably modify or destroy. In many real-world applications, sensitive information must be kept it log files on an untrusted machine. In the event that an attacker captures this machine, we would like to guarantee that he will gain little or no information from the log files and to limit his ability to corrupt the log files. We describe a computationally cheap method for making all log entries generated prior to the logging machine's compromise impossible for the attacker to read, and also impossible to modify or destroy undetectably. For a connected, undirected and weighted graph G = (V, E), the problem of finding the k most vital edges of G with respect to minimum spanning tree is to find k edges in G whose removal will cause greatest weight increase in the minimum spanning tree of the remaining graph. This problem is known to be N P-hard for arbitrary k. In this paper, we first describe a simple exact algorithm for this problem, based on the approach of edge replacement in the minimum spanning tree of G. Next we present polynomial-time randomized algorithms that produce optimal and approximate solutions to this problem. For |V| = n and |E| = m, our algorithm producing optimal solution has a time complexity of O(mn) with probability of success at least e - √ k-2 k-2 , which is 0.90 fork > 200 and asymptotically 1 when k goes to infinity. The algorithm producing approximate solution runs in O(mn+nk 2 log k) time with probability of success at least 1- 1 4 (2 n ) k 2-2 , which is 0.998 for k > 10, and produces solution within factor 2 to the optimal one. Finally we show that both of our randomized algorithms can be easily parallelized. On a CREW PRAM, the first algorithm runs in O(n) time using n 2 processors, and the second algorithm runs in O(log 2 n) time using mn log n processors and hence is RNC. Abstract A very natural randomized algorithm for distributed vertex coloring of graphs is analyzed. Under the assumption that the random choices of processors are mutually independent, the execution time will be O(log n ) rounds almost always. A small modification of the algorithm is also proposed. Process Mining is a technology for extracting non-trivial and useful information from execution logs. For example, there are many process mining techniques to automatically discover a process model describing the causal dependencies between activities . Unfortunately, the quality of a discovered process model strongly depends on the quality and suitability of the input data. For example, the logs of many real-life systems do not refer to the activities an analyst would have in mind, but are on a much more detailed level of abstraction. Trace segmentation attempts to group low-level events into clusters, which represent the execution of a higher-level activity in the (available or imagined) process meta-model. As a result, the simplified log can be used to discover better process models. This paper presents a new activity mining approach based on global trace segmentation. We also present an implementation of the approach, and we validate it using a real-life event log from ASML’s test process. It is well known that head-of-line blocking limits the throughput of an input-queued switch with first-in-first-out (FIFO) queues. Under certain conditions, the throughput can be shown to be limited to approximately 58.6 . It is also known that if non-FIFO queueing policies are used, the throughput can be increased. However, it has not been previously shown that if a suitable queueing policy and scheduling algorithm are used, then it is possible to achieve 100 throughput for all independent arrival processes. In this paper we prove this to be the case using a simple linear programming argument and quadratic Lyapunov function. In particular, we assume that each input maintains a separate FIFO queue for each output and that the switch is scheduled using a maximum weight bipartite matching algorithm. We introduce two maximum weight matching algorithms: longest queue first (LQF) and oldest cell first (OCF). Both algorithms achieve 100 throughput for all independent arrival processes. LQF favors queues with larger occupancy, ensuring that larger queues will eventually be served. However, we find that LQF can lead to the permanent starvation of short queues. OCF overcomes this limitation by favoring cells with large waiting times.