Over the past decade, the microservice architectural style has gained immense popularity among software companies. Many adopt this architectural style to develop their web services due to its improved maintainability, reliability, and agility. These benefits enable companies to quickly develop and deploy their web services iteratively.

Despite its advantages, microservices are notoriously known to be difficult to debug when software failures occur. Developers often struggle to identify the underlying cause of a failure due to the distributed nature of microservices. In fact, certain software failures only emerge when complex interconnected interactions are triggered between microservices. Therefore, it is becoming increasingly important to develop monitoring tools to streamline the process of determining the underlying cause of problems detected within microservices.

The AssureMOSS project, part of the EU Horizon 2020 Research Program, focuses on
delivering various tools or approaches to enhance security at various phases of the microservice development life-cycle. This dissertation, conducted as part of the AssureMOSS project, primarily investigates runtime monitoring of microservices to detect anomalies such as cyber-attacks and discrepancies between observed behaviors and the intended behaviors specified in the source code.

A key project requirement is using lightweight interpretable machine learning models to aid the understanding of detected software failures. State machines, also known
as Finite State Automata, have proven to be practical models for modeling behaviors of various software systems. Furthermore, these models are considered to be inherently interpretable as one can visualize the behaviors exhibited by a system. For this reason, state machines are a suitable choice for monitoring microservice applications. This dissertation explores how state machines can be applied to address challenges across various phases of the microservices development life-cycle.

Part I explores how state machines can be utilized to monitor the runtime of microservices for anomalies. In particular, the studies conducted in Part I focus on detecting network anomalies, such as network attacks, within microservice applications. Part I first introduces ENCODE in Chapter 2, an encoding algorithm designed to preprocess NetFlow records, making them suitable for learning state machine models. Chapter 3 demonstrates how state machines can be learned from NetFlow data collected from microservices and evaluate their effectiveness in detecting various network attacks targeting microservices deployed in a Kubernetes cluster. Finally, Chapter 4 introduces SEQUENT, a novel anomaly detection approach that dynamically uses state visit frequencies to compute anomaly scores for behaviors observed at test time. SEQUENT addresses several limitations within the approach employed in Chapter 3, offering practical applications such as ranking and clustering alerts to understand detected anomalies better. Results suggest that SEQUENT achieved considerably better performance than the approach presented in Chapter 3.

Part II of this dissertation explores how state machines can detect discrepancies (non-
conformances) between the observed runtime behaviors of microservices and the intended behaviors specified in the source code. Chapter 5 introduces CATMA, a lightweight tool for conducting conformance analysis on microservices applications. CATMA uses state machines to capture observed behaviors and compares them against insights derived from Dataflow Diagrams, representing the intended behaviors specified in the source code. This comparison reveals any non-conformances, and CATMA provides human-readable explanations for these non-conformances to aid developers with identifying potential starting points to debug their microservices applications. CATMA’s pilot study shows promising performance results and provides valuable insights to developers. Additionally, CATMA made a small impact in the open-source software community by identifying and fixing a
non-conformance detected in an open-source project.

Finally, Part III of this dissertation explores how state machines can guide an Evolutionary Algorithm in the automated generation of test cases for the REST APIs of microservices. Chapter 6 introduces MISH, a search heuristic that continuously learns a state machine model from log statements from microservices. These models are then used to generate more effective system-level test cases. MISH extracts various insights from the state machine to compute the fitness of test cases, which the Evolutionary Algorithm uses to generate better test cases. MISH demonstrates promising results in using state machines to guide an evolutionary algorithm toward generating more effective test cases, even outperforming a state-of-the-art search algorithm, MOSA, in specific scenarios. Additionally, a preliminary study suggests that integrating MISH as a part of MOSA could enhance the quality of system-level tests, creating an interesting future research direction.

This dissertation demonstrates the effectiveness of state machines in modeling the behavioral patterns of microservices across various practical applications, including monitoring, validation, and testing. Consequently, multiple toolchains and algorithms were developed to evaluate the models’ efficacy and to facilitate the use of state machines in representing the behavioral patterns of software systems. ... Read more

The rising popularity of the microservice architectural style has led to a growing demand for automated testing approaches tailored to these systems. EvoMaster is a state-of-the-art tool that uses Evolutionary Algorithms (EAs) to automatically generate test cases for microservices’ REST APIs. One limitation of these EAs is the use of unit-level search heuristics, such as branch distances, which focus on fine-grained code coverage and may not effectively capture the complex, interconnected behaviors characteristic of system-level testing. To address this limitation, we propose a new search heuristic (MISH) that uses real-time automaton learning to guide the test case generation process. We capture the sequential call patterns exhibited by a test case by learning an automaton from the stream of log events outputted by different microservices within the same system. Therefore, MISH learns a representation of the systemwide behavior, allowing us to define the fitness of a test case based on the path it traverses within the inferred automaton. We empirically evaluate MISH’s effectiveness on six real-world benchmark microservice applications and compare it against a state-of-the-art technique, MOSA, for testing REST APIs. Our evaluation shows promising results for using MISH to guide the automated test case generation within EvoMaster. ... Read more

The microservice architecture allows developers to divide the core functionality of their software system into multiple smaller services. However, this architectural style also makes it harder for them to debug and assess whether the system's deployment conforms to its implementation. We present CATMA, an automated tool that detects non-conformances between the system's deployment and implementation. It automatically visualizes and generates potential interpretations for the detected discrepancies. Our evaluation of CATMA shows promising results in terms of performance and providing useful insights. CATMA is available at https://cyber-analytics.nl/catma.github.io/, and a demonstration video is available at https://youtu.be/WKP1hG-TDKc. ... Read more

Explainable Artificial Intelligence (XAI) aims to improve the transparency of machine learning (ML) pipelines. We systematize the increasingly growing (but fragmented) microcosm of studies that develop and utilize XAI methods for defensive and offensive cybersecurity tasks. We identify 3 cybersecurity stakeholders, i.e., model users, designers, and adversaries, who utilize XAI for 4 distinct objectives within an ML pipeline, namely 1) XAI-enabled user assistance, 2) XAI-enabled model verification, 3) explanation verification & robustness, and 4) offensive use of explanations. Our analysis of the literature indicates that many of the XAI applications are designed with little understanding of how they might be integrated into analyst workflows – user studies for explanation evaluation are conducted in only 14% of the cases. The security literature sometimes also fails to disentangle the role of the various stakeholders, e.g., by providing explanations to model users and designers while also exposing them to adversaries. Additionally, the role of model designers is particularly minimized in the security literature. To this end, we present an illustrative tutorial for model designers, demonstrating how XAI can help with model verification. We also discuss scenarios where interpretability by design may be a better alternative. The systematization and the tutorial enable us to challenge several assumptions, and present open problems that can help shape the future of XAI research within cybersecurity. ... Read more

These days more companies are shifting towards using cloud environments to provide their services to their client. While it is easy to set up a cloud environment, it is equally important to monitor the system's runtime behaviour and identify anomalous behaviours that occur during its operation. In recent years, the utilisation of Recurrent Neural Networks (RNNs) and Deep Neural Networks (DNNs) to detect anomalies that might occur during runtime has been a trending approach. However, it is unclear how to explain the decisions made by these networks and how these networks should be interpreted to understand the runtime behaviour that they model. On the contrary, state machine models provide an easier manner to interpret and understand the behaviour that they model. In this work, we propose an approach that learns state machine models to model the runtime behaviour of a cloud environment that runs multiple microservice applications. To the best of our knowledge, this is the first work that tries to apply state machine models to microservice architectures. The state machine model is used to detect the different types of attacks that we launch on the cloud environment. From our experiment results, our approach can detect the attacks very well, achieving a balanced accuracy of 99.2% and a F1 score of 0.982. ... Read more