Quantitative static analysis of communication protocols using abstract Markov chains

Abstract

In this paper we present a static analysis of probabilistic programs to quantify their performance properties by taking into account both the stochastic aspects of the language and those related to the execution environment. More particularly, we are interested in the analysis of communication protocols in lossy networks and we aim at inferring statically parametric bounds of some important metrics such as the expectation of the throughput or the energy consumption. Our analysis is formalized within the theory of abstract interpretation and soundly takes all possible executions into account. We model the concrete executions as a set of Markov chains and we introduce a novel notion of abstract Markov chains that provides a finite and symbolic representation to over-approximate the (possibly unbounded) set of concrete behaviors. We show that our proposed formalism is expressive enough to handle both probabilistic and pure non-deterministic choices within the same semantics. Our analysis operates in two steps. The first step is a classic abstract interpretation of the source code, using stock numerical abstract domains and a specific automata domain, in order to extract the abstract Markov chain of the program. The second step extracts from this chain particular invariants about the stationary distribution and computes its symbolic bounds using a parametric Fourier–Motzkin elimination algorithm. We present a prototype implementation of the analysis and we discuss some preliminary experiments on a number of communication protocols. We compare our prototype to the state-of-the-art probabilistic model checker Prism and we highlight the advantages and shortcomings of both approaches.

Appendices

A Proof of Theorem 2

Let $\rho \in \{\,\rho \;|\;(-,\rho ,-) \in \gamma (I^\sharp )\,\}$ be a concrete initial environment. We divide the proof into two parts.

1.1 A.1 Proof of the weak Markov property

First, we want to prove that:

Let $s^\sharp _i \in \varSigma ^\sharp$ be an abstract state of the final abstract Markov chain . We start by linking the evaluation of the abstract distribution to the value of the concrete one :

where $\nu _i$ and $\nu _j$ are the sojourn times at states $s_i$ and $s_j$ respectively.

By exploiting the over-approximation of these sojourn times provided by the abstract numeric domain, we can infer the following:

Using the soundness condition guaranteed by Theorem 1 we can derive:

(4)

For the next step, we need to over-approximate the concrete transition probabilities , which is done using the following lemma:

Lemma 1

Let $s_j \in \varSigma$ a concrete state and $\omega ^\sharp \in \varOmega ^\sharp$ an abstract scenario. We have:

Proof

We proceed by induction on the structure of $\omega ^\sharp$ using Definition 12 of abstract scenarios probabilities. An important notice that allows building this proof is that, starting from a concrete state $s_j$, outgoing transitions could be labeled only by outcomes of the same distribution. Indeed, because we are dealing with transitions from only one discrete time Markov chain , we can have only a pure probabilistic behavior with no non-determinism and with a single distribution at each state. So, we have the following cases:

• Case $\omega ^\sharp = \varepsilon ^\sharp$:

  

• Case $\omega ^\sharp = \mathbf {b}_{l}$:

  

• Case $\omega ^\sharp = \overline{\mathbf {b}}_{l}$:

  

• Case $\omega ^\sharp = \mathbf {u}^{i}_{l}$:

  

• Case :

  

• Case $\omega ^\sharp = \omega ^\sharp _0 \xi ^\sharp$:

  

• Case $\omega ^\sharp = {\omega ^\sharp }_1 + {\omega ^\sharp }_2$:

  

$\square$

Finally, using this lemma as an over-approximation of concrete scenario probabilities, we can derive from (4) the following:

$\square$

1.2 A.2 Normalization constraint

The second part of the theorem is the normalization constraint:

We have:

$\square$

B Benchmarks programs

See Fig. 17.

Fig. 17

Programs of the analyzed backoff mechanisms