一句话：提出统计日志差分方法及 s2KDiff、snKDiff 算法，通过统计假设检验推断两个或多个执行日志间显著行为差异模型。
日志差分旨在给定两个或多个系统执行日志，输出其差异模型，可用于软件演化、测试与安全。本文提出统计日志差分，考虑日志中行为出现频率，并给出 s2KDiff（比较两个日志）与 snKDiff（一次比较多个日志）两种算法，二者都在单一推断模型上呈现结果。方法独特之处在于使用统计假设检验：工程师可设置概率目标距离与统计显著性阈值来控制分析敏感度，算法仅报告且完整报告统计显著差异。评估从可靠性、完整性与性能验证有效性，并通过用户研究对比先前工作，以及真实日志案例研究展示应用潜力。
Recent works have considered the problem of log differencing: given two or more system's execution logs, output a model of their differences. Log differencing has potential applications in software evolution, testing, and security. In this paper we present statistical log differencing, which accounts for frequencies of behaviors found in the logs. We present two algorithms, s2KDiff for differencing two logs, and snKDiff, for differencing of many logs at once, both presenting their results over a single inferred model. A unique aspect of our algorithms is their use of statistical hypothesis testing: we let the engineer control the sensitivity of the analysis by setting the target distance between probabilities and the statistical significance value, and report only (and all) the statistically significant differences. Our evaluation shows the effectiveness of our work in terms of soundness, completeness, and performance. It also demonstrates its effectiveness compared to previous work via a user-study and its potential applications via a case study using real-world logs.
DOI 原文 ·
@inproceedings{paperbot5257,
title = {Statistical Log Differencing},
author = {Lingfeng Bao and Nimrod Busany and David Lo and Shahar Maoz},
booktitle = {ASE},
year = {2019},
doi = {10.1109/ase.2019.00084}
}