{
  "schema_version": "0.6.0",
  "paper_id": "a-stateful-approach-to-generate-synthetic-events-from-kernel-traces",
  "page_url": "https://naser.github.io/research-publications/papers/a-stateful-approach-to-generate-synthetic-events-from-kernel-traces/",
  "title": "A Stateful Approach to Generate Synthetic Events from Kernel Traces",
  "title_variants": [],
  "authors": [
    "Naser Ezzati-Jivan",
    "Michel R. Dagenais"
  ],
  "author_details": [
    {
      "name": "Naser Ezzati-Jivan",
      "orcid": "https://orcid.org/0000-0003-1435-6297",
      "profile_url": "https://naser.github.io/"
    },
    {
      "name": "Michel R. Dagenais",
      "orcid": null,
      "profile_url": "https://dblp.org/pid/60/309.html"
    }
  ],
  "publication": {
    "year": 2012,
    "venue": "Advances in Software Engineering",
    "type": "journal article",
    "publication_date": "2012-08-15",
    "online_date": null,
    "print_date": "2012-08-15",
    "volume": "2012",
    "issue": null,
    "pages": "1-12",
    "article_number": null,
    "publisher": "Hindawi Limited",
    "issn": [
      "1687-8655",
      "1687-8663"
    ],
    "isbn": [],
    "crossref_type": "journal-article"
  },
  "publication_type": "journal article",
  "status": "published_with_public_full_text",
  "canonical_source_url": "https://doi.org/10.1155/2012/140368",
  "source_record_id": "a-stateful-approach-to-generate-synthetic-events-from-kernel-traces-59fef5e1ef",
  "identifiers": {
    "doi": "10.1155/2012/140368"
  },
  "abstract": "The paper presents a stateful approach that maps low-level LTTng events to semantic events and uses modeled resource state and finite-state patterns to generate synthetic events and alarms.",
  "abstract_source": "Public open-access article PDF reviewed; abstract paraphrased for this catalog.",
  "abstract_available": true,
  "scholar_eligibility": {
    "eligible": false,
    "basis": "not-eligible",
    "note": "The page is a discovery record; it does not claim Google Scholar article-host eligibility."
  },
  "description": "The paper presents a stateful approach that maps low-level LTTng events to semantic events and uses modeled resource state and finite-state patterns to generate synthetic events and alarms.",
  "evidence_level": "full-text-reviewed",
  "evidence": {
    "source_basis": "full-text-reviewed",
    "coverage": "material paper sections",
    "summary_origin": "AI-assisted catalog editorial summary",
    "review_status": "catalog-reviewed; paper-author approval pending",
    "verified_on": "2026-08-09",
    "sources": [
      {
        "note": "A Stateful Approach PDF: LTTng, semantic-event mapping, modeled state, finite-state patterns, and Java prototype"
      },
      {
        "note": "A Stateful Approach PDF: 25 MB-10,000 MB traces, 621,132,167/159,023,500/2,247,225 event counts, and reported analysis times"
      },
      {
        "note": "A Stateful Approach PDF: limitations, missing state changes, pattern-library boundary, and future work"
      },
      {
        "note": "Local PDF hash verified in pdf-evidence/extraction-manifest.json"
      }
    ]
  },
  "summary": {
    "core_contribution": "The paper introduces a stateful trace-abstraction method that converts low-level kernel events into semantic and synthetic events using modeled resource state and finite-state patterns.",
    "problem": "Low-level LTTng/kernel events are numerous, platform-specific, and difficult to interpret for multi-resource, temporal behavior; stateless pattern matching repeatedly reconstructs state (pp. 1-4).",
    "method": "A Java/Linux prototype maps raw tracer events to environment-independent semantic events, stores current and historical resource values in a tree/interval-backed modeled-state database, and applies XML finite-state patterns to events, state changes, or both. Patterns generate multi-level synthetic events and alarms, including file, socket, process, system-load, fork-bomb, SYN-flood, and port-scan patterns (pp. 3-8).",
    "findings": "With Linux kernel 2.6.38.6 and LTTng, traces from 25 MB to 10,000 MB are reduced across abstraction levels. The largest trace has 621,132,167 raw, 159,023,500 first-level, and 2,247,225 second-level events; first-level analysis time is 4,748 ms at 25 MB and 1,105,124 ms at 10,000 MB (pp. 8-12). A 3,622-event wget example yields fewer than 10 synthetic events (p. 8).",
    "limitations": "State transitions cannot express behavior not representable as transitions; cross-process/resource dependency and critical-path analysis are outside the pattern model. Missing tracer state changes can limit correctness, and the prototype has incomplete coverage and hardcoded XML transition actions (pp. 8, 10-12).",
    "future_work": "Extend memory and interprocess-communication patterns, complete the host-based intrusion-detection rule base, and develop a more declarative/programming-like language for mappings, state variables, transitions, conditions, and outputs (p. 12, conclusion)."
  },
  "tags": [
    "kernel-tracing",
    "system-tracing",
    "trace-abstraction",
    "trace-analysis",
    "performance-analysis"
  ],
  "keywords": [
    "stateful trace abstraction",
    "synthetic events",
    "semantic events",
    "modeled state",
    "finite-state machine",
    "LTTng",
    "Linux kernel 2.6.38.6",
    "XML pattern library",
    "partial trace abstraction",
    "fork bomb",
    "SYN flood",
    "port scanning"
  ],
  "versions": [
    {
      "id": "published-version",
      "label": "Published version",
      "relation": "version-of-record",
      "title": "A Stateful Approach to Generate Synthetic Events from Kernel Traces",
      "url": "https://doi.org/10.1155/2012/140368",
      "pdf_url": null,
      "status": "published",
      "canonical_for_citation": true
    },
    {
      "id": "public-full-text",
      "label": "Public full text",
      "relation": "source-record",
      "title": "A Stateful Approach to Generate Synthetic Events from Kernel Traces",
      "url": "https://publications.polymtl.ca/4861/1/2012_Ezzati-Jivan_Stateful_approach_generate_synthetic_events.pdf",
      "pdf_url": "https://publications.polymtl.ca/4861/1/2012_Ezzati-Jivan_Stateful_approach_generate_synthetic_events.pdf",
      "status": "public_full_text",
      "canonical_for_citation": false
    }
  ],
  "access": {
    "status": "published_with_public_full_text",
    "note": "The DOI is the canonical citation target; the public full-text link is external and the PDF is not redistributed here.",
    "license": null
  },
  "resources": {
    "code": null,
    "data": null,
    "slides": null,
    "demo": null
  },
  "citation_guidance": {
    "when_to_cite": "Cite this paper when your work uses or compares stateful raw-to-semantic trace abstraction that reuses modeled resource history rather than recomputing state in each pattern.",
    "points": [
      "Stateful raw-to-semantic trace abstraction that reuses modeled resource history rather than recomputing state in each pattern.",
      "XML finite-state pattern libraries for multi-level synthetic event generation from LTTng kernel events.",
      "The 25 MB-10 GB event-reduction and execution-time study, including the 621M->159M->2.25M largest-trace counts.",
      "Pattern-based examples for system-load, fork-bomb, SYN-flood, or port-scan detection."
    ],
    "canonical_version_id": "published-version"
  },
  "provenance": {
    "metadata_verified_on": "2026-08-09",
    "metadata_source": [
      "A Stateful Approach PDF: LTTng, semantic-event mapping, modeled state, finite-state patterns, and Java prototype",
      "A Stateful Approach PDF: 25 MB-10,000 MB traces, 621,132,167/159,023,500/2,247,225 event counts, and reported analysis times",
      "A Stateful Approach PDF: limitations, missing state changes, pattern-library boundary, and future work",
      "Local PDF hash verified in pdf-evidence/extraction-manifest.json"
    ],
    "summary_written_by": "AI-assisted",
    "summary_verified_by": "full-text-grounded catalog review; author approval pending",
    "linked_preprint_record": null,
    "author_order_note": null
  },
  "batch": {
    "phase": 2,
    "batch_label": "expanded forty-paper release",
    "status": "included_in_expanded_catalog",
    "selected_at": "2026-08-09"
  }
}