Execution Trace Reconstruction Using Diffusion-Based Generative Models

Problem and motivation

Ring-buffer overflow and resource constraints can discard contiguous system-call events, weakening trace-based diagnosis, anomaly detection, and performance analysis. Increasing buffers or blocking the application changes collection cost or system behavior.

Method and contribution

Nine Phoronix Test Suite datasets are collected from LTTng 2.8 traces on Debian with kernel 4.4.0-1-amd64. System calls are filtered from kernel events, sorted by training frequency, and encoded as integer IDs. DiffWave, SSSDS4, SSSDSA, and CSDIS4 diffusion/imputation models reconstruct artificial contiguous blackouts; accuracy, perfect rate, and ROUGE-L are compared with an LSTM next-event baseline.

Findings and evidence

The setup uses PTS 6.2.23, 32 runs per benchmark, 10,000 training and 500 test sequences per dataset, sequence lengths up to 200, and blackout sizes 5/10/20/30/40. For a ten-event blackout, SSSDS4 averages 81.62% accuracy, 74.27% perfect rate, and 90.84% ROUGE-L; SSSDSA reports 81.71%, 74.38%, and 90.90%. The LSTM reaches 29.61% average accuracy for five-event reconstruction. At blackout size 40, average SSSDS4 accuracy is 77.11%; the paper reports degradation once missingness exceeds about 20%.

Limitations and future directions

Limitations: Events are removed artificially rather than recovered from naturally lost traces. Exact-match metrics do not measure functional plausibility, and results are bounded by nine PTS workloads, one Debian/kernel environment, model parameter choices, and system-call-only representations. Timing, arguments, and authentic loss are not evaluated.

Future work: Add event timing, arguments, and duration; test authentic loss; explore other state-space/diffusion/transformer models; use expert or LLM-based functional evaluation; and assess usefulness in diagnosis, anomaly detection, and optimization.

Resources

• Code

Sources and identifiers

• Published version published
• Public full text · PDF public_full_text

When to cite this paper

Cite this paper when your work uses or compares diffusion-based imputation of contiguous missing system-call events in execution traces.

• diffusion-based imputation of contiguous missing system-call events in execution traces.
• the SSSDS4 comparison across nine PTS workloads using exact accuracy, perfect rate, and ROUGE-L.
• the finding that structured state-space diffusion models outperform the LSTM baseline on multi-event reconstruction, with the artificial-blackout caveat.
• the need to add timing/arguments and functional-plausibility metrics to trace reconstruction.

Citation

@inproceedings{ezzatiJivan2025executiontrace,
  author = {Madeline Janecek and Naser Ezzati-Jivan and Abdelwahab Hamou-Lhadj},
  title = {Execution Trace Reconstruction Using Diffusion-Based Generative Models},
  year = {2025},
  booktitle = {IEEE/ACM International Conference on Software Engineering (ICSE)},
  pages = {1077-1088},
  publisher = {IEEE},
  doi = {10.1109/ICSE55347.2025.00063},
  url = {https://doi.org/10.1109/ICSE55347.2025.00063}
}

Janecek, M., Ezzati-Jivan, N., & Hamou-Lhadj, A. (2025). Execution Trace Reconstruction Using Diffusion-Based Generative Models. In IEEE/ACM International Conference on Software Engineering (ICSE) (pp. 1077-1088). https://doi.org/10.1109/ICSE55347.2025.00063

M. Janecek, N. Ezzati-Jivan, and A. Hamou-Lhadj, "Execution Trace Reconstruction Using Diffusion-Based Generative Models," in IEEE/ACM International Conference on Software Engineering (ICSE), pp. 1077-1088, 2025, doi: 10.1109/ICSE55347.2025.00063