Active Inference of Extended Finite State Machine Models with Registers and Guards

TL;DR

This paper introduces a black-box active learning algorithm that infers extended finite state machine models with data variables, guards, and registers, even without system resets or simple data-dependent control assumptions.

Contribution

It presents a novel active inference method for EFSMs with guards and registers that relaxes previous system assumptions and enhances reverse-engineering capabilities.

Findings

Successfully infers EFSMs with data variables, guards, and registers.

Operates without requiring system resets during inference.

Handles complex data-dependent control flows.

Abstract

Extended finite state machines (EFSMs) model stateful systems with internal data variables and have numerous applications in software engineering. A major advantage of this type of model lies in its ability to model both the data flow and the data-dependent control behaviour. In the absence of such models, it is desirable to reverse-engineer them by observing the system's behaviour. However, existing approaches generally require the ability to reset the system during inference, or can only handle situations where the control flow depends exclusively on the input parameters, and not on the values of the stored data. In this work, we present a black-box active learning algorithm that infers EFSMs with guards and registers, and which significantly relaxes the assumptions that have to be made about the system in comparison to previous attempts.