Temporal Specification Mining for Anomaly Analysis

We investigate how to use specification mining techniques for program anomaly analysis. We assume the input of positive traces (without execution anomalies) and negative traces (with execution anomalies). We then partition the traces into the following clusters: a positive cluster that contains all positive traces and some negative clusters according to the characteristics of trace anomalies. We present techniques for learning temporal properties in Linear Temporal Logic with finite trace semantics (FLTL). We propose to mine FLTL properties that distinguish the negative clusters from the positive cluster. We experiment with 5 Android applications from Google Code and Google Play with traces of GUI events and crashes as the target anomaly. The report of FLTL properties with high support or confidence reveal the temporal patterns in GUI traces that cause the crashes. The performance data also shows that the clustering of negative traces indeed enhances the accuracy in mining meaningful temporal properties for test verdict prediction.