Mining constraints for monitoring systems of systems

Complex software-intensive systems are often systems of systems whose full behavior emerges during operation only, when the involved systems interact with each other and the environment. Runtime monitoring approaches are thus used to detect deviations from the expected behavior. Most approaches assume that engineers define the expected behavior as constraints, however, the deep domain knowledge required to specify constraints is often not available. We describe an approach that automatically mines constraint candidates for runtime monitoring from event logs recorded from systems of systems. Our approach extracts different types of constraints on event occurrence, timing, and data and offers users filtering and ranking strategies for the mined candidates.