Behavioral log analysis with statistical guarantees

Nimrod Busany, Shahar Maoz

Research output: Chapter in Book/Report/Conference proceedingConference contributionpeer-review


Scalability is a major challenge for existing behavioral log analysis algorithms, which extract finite-state automaton models or temporal properties from logs generated by run-ning systems. In this paper we present statistical log anal-ysis, which addresses scalability using statistical tools. The key to our approach is to consider behavioral log analysis as a statistical experiment. Rather than analyzing the entire log, we suggest to analyze only a sample of traces from the log and, most importantly, provide means to compute sta-tistical guarantees for the correctness of the analysis result. We present the theoretical foundations of our approach and describe two example applications, to the classic k-Tails algorithm and to the recently presented BEAR algorithm. Finally, based on experiments with logs generated from real-world models and with real-world logs provided to us by our industrial partners, we present extensive evidence for the need for scalable log analysis and for the effectiveness of statistical log analysis.

Original languageEnglish
Title of host publicationProceedings - 2016 IEEE/ACM 38th IEEE International Conference on Software Engineering Companion, ICSE 2016
PublisherIEEE Computer Society
Number of pages11
ISBN (Electronic)9781450339001, 9781450342056
StatePublished - 14 May 2016
Event2016 IEEE/ACM 38th IEEE International Conference on Software Engineering, ICSE 2016 - Austin, United States
Duration: 14 May 201622 May 2016

Publication series

NameProceedings - International Conference on Software Engineering


Conference2016 IEEE/ACM 38th IEEE International Conference on Software Engineering, ICSE 2016
Country/TerritoryUnited States


  • Log analysis
  • Specification mining

All Science Journal Classification (ASJC) codes

  • Software


Dive into the research topics of 'Behavioral log analysis with statistical guarantees'. Together they form a unique fingerprint.

Cite this