Probabilistic Obstruction Temporal Logic:
a Probabilistic Logic to Reason about Dynamic Models

Abstract

In this paper, we propose a novel formalism called Probabilistic Obstruction Temporal Logic (POTL), which extends Obstruction Logic (OL) by incorporating probabilistic elements. POTL provides a robust framework for reasoning about the probabilistic behaviors and strategic interactions between attackers and defenders in environments where probabilistic events influence outcomes. We explore the model checking complexity of POTL and demonstrate that it is not higher than that of Probabilistic Computation Tree Logic (PCTL), making it both expressive and computationally feasible for cybersecurity and privacy applications.

1 Introduction

Understanding and quantifying uncertainty is essential in cybersecurity, and probability theory offers a robust framework for this purpose, making it particularly valuable for risk analysis. As digital systems grow increasingly complex and dynamic, effectively assessing and managing risks becomes more challenging. Probability theory allows organizations to model the likelihood of various cyber threats, such as hacking attempts, data breaches, and software vulnerabilities, which are inherently uncertain and variable. Cybersecurity professionals can estimate the likelihood of these threats materializing and assess their potential impact on systems by applying probabilistic and non-probabilistic formalisms.

Researchers have developed various solutions over the past fifty years, with formal methods emerging as a notable success. These techniques allow for the verification of system correctness by checking if a mathematical model meets the formalized desired behavior. Notably, traditional formal approaches like model checking (Baier and Katoen 2008), initially designed for monolithic systems, have been effectively adapted to manage open and Multi-Agent Systems (MAS). In recent years, the study of MAS has garnered significant attention due to its wide-ranging applications in fields such as cybersecurity, robotics, and distributed computing. MAS consists of two or more interacting agents, each capable of making autonomous decisions. These systems often operate in dynamic and uncertain environments, necessitating robust formal verification techniques to ensure their reliability and correctness.

An important logic in the context of MAS is Alternating-time Temporal Logic (ATL) (Alur, Henzinger, and Kupferman 2002). The latter extends CTL (Clarke and Emerson 1981) by introducing strategic modalities, enabling the specification of properties that involve the strategic abilities of agents. ATL can express whether a group of agents can achieve a certain goal regardless of the actions of other agents, making it a powerful tool for reasoning about cooperation and competition in MAS.

Another relevant formalism in this area is Obstruction Logic (OL) (Catta, Leneutre, and Malvone 2023b), which focuses on obstructions in two-player games. In OL, one player, called the Demon, can temporarily disable edges in the graph as long as their total weight remains below a specified natural number, thereby preventing the other agent from achieving its temporal goal. As illustrated in their paper, OL can be well-suited for representing cybersecurity problems, where a defender can activate defense mechanisms (by disabling edges) and an attacker aims to access private resources through a sequence of atomic attacks.

In this context, a key aspect when performing cybersecurity risk analysis is to assess the likelihood (or probability) of success of the attack scenarios. However, OL did not address this aspect, where no probabilistic concepts were introduced. For the above reasons, in this paper, we present Probabilistic Obstruction Temporal Logic (POTL), a logic that extends OL into a probabilistic context. POTL offers a comprehensive framework for analyzing the probabilistic behaviors and strategic interactions between attackers and defenders in scenarios where probabilistic events influence outcomes. We investigate the model checking complexity of POTL and show that it is comparable to that of Probabilistic Computation Tree Logic, ensuring that POTL remains both expressive and computationally practical for cybersecurity and privacy applications.

Structure of the work.

The contribution is structured as follows. Theoretical background is presented in Section 2. In Section 3, we present the syntax and the semantics of our new logic, called Probabilistic Obstruction Temporal Logic (POTL). In Section 4, we show our model checking algorithm and prove that the model checking problem for POTL is decidable in polyonimal-time. In section 5, we present an illustrative example related to the cybersecurity analysis. In Section 6, we compare our approach to related work. Finally, Section 7 concludes and presents possible future directions.

2 Background

In this section, we discuss the basic notions that are used in the technical part of this paper.

General Concepts.

Let $\mathbb{N}$ be the set of natural numbers, we refer to the set of natural numbers containing $0$ as $\mathbb{N}_{\geq 0}$, $\mathbb{R}_{\geq 0}$ the set of non-negative reals and $\mathbb{Z}$ the set of integers. Let $X$ and $Y$ be two sets and $|X|$ denotes its cardinality. The set operations of intersection, union, complementation, set difference, and Cartesian product are denoted $X$ $\cap$ $Y$, $X$ $\cup$ $Y$, $\overline{X}$, $X$ $\setminus$ $Y$, and $X$ $\times$ $Y$, respectively. Inclusion and strict inclusion are denoted $X$ $\subseteq$ $Y$ and $X$ $\subset$ $Y$, respectively. The empty set is denoted $\emptyset$. Let $\pi=x_{1},\ldots,x_{n}$ be a finite sequence, $last(\pi)$ denotes the last element $x_{n}$ of $\pi$.

Probability Distribution and Space.

Let $Q$ be a finite set and $\mu:Q\to[0,1]$ be a probability distribution function over $Q$ such that $\sum_{q\in Q}$ $\mu(q)=1$. We denote by $\mathcal{D}(Q)$ the set of all such distributions over $Q$. For a given $\mu$ $\in$ $\mathcal{D}(Q)$, $supp(\mu)$ = $\{q\in Q\mid\mu(q)>0\}$ is called the support of $\mu$. The standard notation of a probability space is a triple $(\Omega,\mathcal{F},\textsf{Pr})$, where $\Omega$ is a sample space that represents all possible outcomes, $\mathcal{F}\subseteq\mathcal{P}(\Omega)=2^{\Omega}$ is a $\sigma$-algebra over $\Omega$, i.e., it includes the empty subset, and it is closed under countable unions and complement, and Pr: $\mathcal{F}\to[0,1]$ is a probability measure over $(\Omega,\mathcal{F})$. We denote the set of all finite and infinite sequences of elements of $Q$ by $Q^{+}$ and $Q^{*}$, respectively.

Attack Graphs and Moving Target Defense Mechanisms.

A malicious attack is defined as an attempt by an attacker to gain unauthorized access to resources or compromise the integrity of the system. In this context, the Attack Graph (AG) (Kaynar 2016) is a widely recognized and increasingly popular attack model. By leveraging an AG, it is possible to model interactions between an attacker and a defender who dynamically deploys Moving Target Defense (MTD) mechanisms (Cho et al. 2020). MTD mechanisms, such as Address Space Layout Randomization (ASLR) (Marco-Gisbert and Ripoll Ripoll 2019), are active defenses that use partial system reconfiguration to alter the attack surface and reduce the chances of success of the attack. However, activating an MTD countermeasure impacts system performance: during reconfiguration, system services may be partially or completely unavailable. Thus, it is crucial to select MTD deployment strategies that minimize both residual cybersecurity risks and the negative impact on system performance. However, despite the progress made in the field of AG (Kaynar 2016; Catta, Leneutre, and Malvone 2023a) none of them takes into account some of the uncertainties in the network. Probabilistic Attack Graphs (PAG) are AG enriched with probabilities that model the likelihood of compromise of each node in the graph based on their specific characteristics (Li et al. 2022; Milani et al. 2020).

Kripke Structure and Markov Chain.

A PAG can be viewed as a Probabilistic Kripke Structure (PKS). Now, we will formally define PKS, the Kripke structure that is used to represent all the possible attacks on a networked system.

Definition 1 (Kripke Structure).

A Kripke Structure (KS) over a set $\mathsf{Ap}$ of atomic propositions is a tuple $\mathcal{K}$ = $\langle Q,q_{0},R,\mathcal{L}\rangle$ where $Q$ is a finite, non-empty set of states, $q_{0}$ $\in$ $Q$ is the initial state, $R\subseteq Q\times Q$ is a binary serial relation over $Q$ (i.e., for any $q\in Q$ there is a $q^{\prime}\in Q$ such that $\langle q,q^{\prime}\rangle\in R$) and $\mathcal{L}:Q\to 2^{\mathsf{Ap}}$ is a labeling function assigning a set of atomic propositions to any state $q\in Q$.

Definition 2 (Markov Chain).

A Markov Chain (MC) is a pair $\mathcal{H}$ = $(Q,\mathbf{P})$ where $Q$ is a (countable) set of states and $\mathbf{P}$: $Q\times Q$ $\to$ $[0,1]$ is a transition probability function such that for all state $q\in Q$, $\Sigma_{q^{\prime}\in Q}\mathbf{P}(q,q^{\prime})=1$. If $Q$ is finite, we can consider $\mathbf{P}$ to be a transition matrix.

A KS can be extended via MC (Kleinberg 2012) to define Probabilistic Kripke Structure (PKS) as follows.

Definition 3 (Probabilistic Kripke Structure).

A PKS over a set $\mathsf{Ap}$ of atomic propositions is a tuple $\mathcal{G}$ = $\langle Q,q_{0},\mathbf{P},\mathcal{L}\rangle$ where $(Q,\mathbf{P})$ is a MC, $q_{0}$ is the initial state and $\mathcal{L}:S\to 2^{\mathsf{Ap}}$ is a labeling function assigning a set of atomic propositions to any state $q\in Q$.

Path.

A path $\pi$ over $\mathcal{G}$ is a finite or infinite sequence of states $\pi$ = $q_{0},q_{1},q_{2},\ldots$ starting in the initial state $q_{0}$ that are built by consecutive steps, i.e., $\mathbf{P}(q_{i},q_{i+1})>0$ for all $i\in\mathbb{N}$. We write $\pi_{i}$ to denote the $i$-th element $q_{i}$ of $\pi$, $\pi_{\leq i}$ to denote the prefix $q_{0},\ldots,q_{i}$ of $\pi$, and $\pi_{\geq i}$ to denote the suffix $q_{i},q_{i+1}\ldots$ of $\pi$. The set of all finite paths starting from $q\in Q$ in the model $\mathcal{G}$ is denoted by $\textsf{Paths}_{\mathcal{G},q}^{+}$, and the set of all infinite paths starting from $q$ is denoted by $\textsf{Paths}_{\mathcal{G},q}^{*}$. A history $h$ is any finite prefix of some path. We use $H$ to denote the set of histories. Write $last(h)$ for the last state of a history $h$.

Cylinder.

We need to measure the probability of certain sets of paths. Formally, to every $q$ $\in$ $Q$ we associate the probability space $(\Omega,\mathcal{F},\textsf{Pr})$ where $\mathcal{F}$ is the $\sigma$-algebra generated by all basic cylinders sets of paths called cylinder sets, which gather all paths sharing a given finite prefix (i.e., $\textsf{Prefix}(\pi)$). Given a finite path $\hat{\pi}$ = $q_{0},q_{1},\ldots,q_{n}$ of states, the cylinder set of $\hat{\pi}$, denoted $\textsf{Cyl}(\hat{\pi}$) = $\{\pi\in\textsf{Paths}_{\mathcal{G},q_{0}}^{*}\mid\hat{\pi}\in\textsf{Prefix}(\pi)\}$, is the set of infinite paths $\pi=q_{0},q_{1},\cdots,q_{n},\cdots$, where $\hat{\pi}$ is a prefix of $\pi$. The set of infinite paths is supposed to be equipped with the $\sigma$-algebra generated by the cylinder sets of the finite paths and the probability measure given by $\textsf{Pr}_{\mathcal{G}}^{q_{0}}$$(\textsf{Cyl}(\hat{\pi}))$ = $\prod_{i=0}^{n-1}\mathbf{P}(q_{i},q_{i+1})$. The extension of $\textsf{Pr}_{\mathcal{G}}^{q}$ from cylinders to the $\sigma$-algebra they generate is unique, and we still denote it $\textsf{Pr}_{\mathcal{G}}^{q}$. Note that not all sets of paths are measurable with respect to $\textsf{Pr}_{\mathcal{G}}^{q}$, but the sets we will consider in this paper are simple enough to avoid such difficulties. For the mathematical details of the underlying $\sigma$-algebra and probability measure refer to (Baier and Katoen 2008).

Predecessors and Successors.

Let $\mathcal{G}$ be a PKS and $q$ $\in$ $Q$ be one of its states, $\textsf{pre}(q)$ denotes the set of predecessors of $q$, i.e., $\textsf{pre}(q)=\{q^{\prime}\in Q\mid\mathbf{P}(q^{\prime},q)>0\}$. Similarly, $\textsf{post}(q)$ denotes the set of successors of $q$, i.e., $\textsf{post}(q)=\{q^{\prime}\in Q\mid\mathbf{P}(q,q^{\prime})>0\}$, and $\textsf{E}(q)$ denotes its outgoing edges $\textsf{E}(q)=\{e\in Q\times Q\mid e=(q,q^{\prime})\text{ for some $q^{\prime}\in Q$ and }\mathbf{P}(q,q^{\prime})>0\}$.

3 Model and Logic

In this section, we define the syntax and semantics of our Probabilistic Obstruction Temporal Logic (POTL). To do this, first, we introduce the Probabilistic Obstruction Temporal Structure (POTS), the type of model that we use to verify POTL properties.

Definition 4 (Probabilistic Obstruction Temporal Structure).

A POTS (model for short) is given by a tuple $\mathcal{M}$ = $(Q,q_{0},\mathbf{P},\mathcal{L},\mathsf{C})$ where $\mathcal{G}$ = $(Q,q_{0},\mathbf{P},\mathcal{L})$ is a PKS and $\mathsf{C}:Q\times Q\to\mathbb{N}$ is a function assigning to any pairs $(q,q^{\prime})$ a natural number $n\in\mathbb{N}$.

Strategy and Outcomes.

Let $\mathcal{M}$ be a model, $Q$ be states in $\mathcal{M}$, $\mathsf{C}$ is the function cost and $n$ be a natural number, a $n$-strategy is a function $\mathfrak{S}:H\to 2^{Q\times Q}$ that, given a history $h$, returns a subset $T\in Q\times Q$, such that: (i) $T\subset\textsf{E}(last(h))$, (ii) $(\sum_{e\in T}\mathsf{C}(e))\leq n$. A memoryless n-strategy is a n-strategy $\mathfrak{S}$ such that for all histories $h$ and $h^{\prime}$ if $last(h)=last(h^{\prime})$ then $\mathfrak{S}(h)=\mathfrak{S}(h^{\prime})$. A memoryless n-strategy can be seen as a function whose domain is the set $Q$ of states of a model $\mathcal{M}$. As in ATL logic, the notion of a path that is compatible with a strategy is central to the semantics of Probabilistic Obstruction Logic (POTL) formulas. We define this notion by saying that a path $\pi$ is compatible with an n-strategy $\mathfrak{S}$ if for all $i\geq 1$ we have that $(\pi_{i},\pi_{i+1})\notin\mathfrak{S}(\pi_{\leq i})$. The set of outcomes of an $n$-strategy $\mathfrak{S}$ and state $q$ is denoted as $\textsf{Out}(q,\mathfrak{S})$ and it returns the set of all paths that can result from a strategy $\mathfrak{S}$ and a state $q$. As said in the introduction, our logic (POTL) aims to capture strategies for a particular type of game played over a POTS, in such games, one of the two players (the Demon) has the power to temporally deactivate some transitions of the model. We now introduce the syntax of our logic.

Definition 5.

Let $\mathsf{Ap}$ be an at most countable set of atomic formulas (or atoms). Formulas of Probabilistic Obstruction Temporal Logic (POTL, for short) are defined by the following grammar:

$$\varphi::=\top\mid p\mid\neg\varphi\mid\varphi\land\varphi\mid\langle\textbf{\raisebox{2.15277pt}{\makebox[0.0pt][l]{\rule[-0.2pt]{3.22916pt}{0.4pt}}\makebox[3.22916pt]{\rule[-2.15277pt]{0.4pt}{6.45831pt}}}}_{n}^{\bowtie k}\rangle\theta$$

$$\theta::=\mathsf{X}\,\varphi\mid\varphi\,\mathsf{U}\,^{\leq m}\varphi\mid\varphi\,\mathsf{U}\,\varphi\mid\varphi\,\mathsf{R}\,^{\leq m}\varphi\mid\varphi\,\mathsf{R}\,\varphi$$

where $p$ $\in$ $\mathsf{Ap}$ is an atomic formula, $k$ $\in$ $[0,1]$ is a rational constant, $n$ (the grade) and $m$ are any natural number in $\mathbb{N}$, and $\bowtie$ $\in$ $\{\leq,<,>,\geq\}$.

In the above syntax, we distinguish between state formulas $\varphi$ and path formulas $\theta$. State formulas are evaluated over states and path formulas over paths. A model property is always expressed as a state formula, path formulas appear only as parameters of the probabilistic path operator $\langle\textbf{\raisebox{2.15277pt}{\makebox[0.0pt][l]{\rule[-0.2pt]{3.22916pt}{0.4pt}}\makebox[3.22916pt]{\rule[-2.15277pt]{0.4pt}{6.45831pt}}}}_{n}^{\bowtie k}\rangle\theta$. The operators $X$ (next), $\,\mathsf{U}\,^{\leq m}$ (bounded until), $\,\mathsf{U}\,$ (until), $\,\mathsf{R}\,^{\leq m}$ (bounded release), and $\,\mathsf{R}\,$ (release), which are standard in temporal logic, are allowed as path formulas. The number $n$ is called the grade of the strategic operator. The boolean connectives $\bot$, $\vee$ and $\to$ can be defined as usual, we define $\langle{\textbf{\raisebox{2.15277pt}{\makebox[0.0pt][l]{\rule[-0.2pt]{3.22916pt}{0.4pt}}\makebox[3.22916pt]{\rule[-2.15277pt]{0.4pt}{6.45831pt}}}}_{n}^{\bowtie k}}\rangle\mathsf{F}\varphi:=\langle{\textbf{\raisebox{2.15277pt}{\makebox[0.0pt][l]{\rule[-0.2pt]{3.22916pt}{0.4pt}}\makebox[3.22916pt]{\rule[-2.15277pt]{0.4pt}{6.45831pt}}}}_{n}^{\bowtie k}}\rangle(\top\,\mathsf{U}\,\varphi)$, $\langle{\textbf{\raisebox{2.15277pt}{\makebox[0.0pt][l]{\rule[-0.2pt]{3.22916pt}{0.4pt}}\makebox[3.22916pt]{\rule[-2.15277pt]{0.4pt}{6.45831pt}}}}_{n}^{\bowtie k}}\rangle\mathsf{G}\,\varphi:=\langle{\textbf{\raisebox{2.15277pt}{\makebox[0.0pt][l]{\rule[-0.2pt]{3.22916pt}{0.4pt}}\makebox[3.22916pt]{\rule[-2.15277pt]{0.4pt}{6.45831pt}}}}_{n}^{\bowtie k}}\rangle(\bot\,\mathsf{R}\,\varphi)$ and $\langle{\textbf{\raisebox{2.15277pt}{\makebox[0.0pt][l]{\rule[-0.2pt]{3.22916pt}{0.4pt}}\makebox[3.22916pt]{\rule[-2.15277pt]{0.4pt}{6.45831pt}}}}_{n}^{\bowtie k}}\rangle(\varphi\,\mathsf{W}\,\psi):=\langle{\textbf{\raisebox{2.15277pt}{\makebox[0.0pt][l]{\rule[-0.2pt]{3.22916pt}{0.4pt}}\makebox[3.22916pt]{\rule[-2.15277pt]{0.4pt}{6.45831pt}}}}_{n}^{\bowtie k}}\rangle(\psi\,\mathsf{R}\,(\varphi\vee\psi))$. The size $|\varphi|$ of a formula $\varphi$ is the number of its connectives. The intuitive meaning of a formula $\langle{\textbf{\raisebox{2.15277pt}{\makebox[0.0pt][l]{\rule[-0.2pt]{3.22916pt}{0.4pt}}\makebox[3.22916pt]{\rule[-2.15277pt]{0.4pt}{6.45831pt}}}}_{n}^{\bowtie k}}\rangle\varphi$ with $\varphi$ temporal formula is “there is a demonic strategy such that all paths of the graphs that are compatible with the strategy satisfy $\varphi$ with a probability in relation $\bowtie$ with constant $k$” where “demonic strategy” means “a strategy for disabling arcs”. Formulas of POTL can be interpreted over POTS. We can now precisely define the semantics of POTL formulas.

Definition 6.

The satisfaction relation between a model $\mathcal{M}$, a state $q$ of $\mathcal{M}$, and a formula $\varphi$ is defined by induction on the structure of $\varphi$:

• $\mathcal{M},q\models\top$ for all state $q$,

• $\mathcal{M},q\models p$ iff $p\in\mathcal{L}(q)$,

• $\mathcal{M},q\models\neg\varphi$ iff not $\mathcal{M},q\models\varphi$ (notation $\mathcal{M},q\not\models\varphi$),

• $\mathcal{M},q\models\varphi_{1}\land\varphi_{2}$ iff $\mathcal{M},q\models\varphi_{1}$ and $\mathcal{M},q\models\varphi_{2}$,

• $\mathcal{M},q\models\langle\textbf{\raisebox{2.15277pt}{\makebox[0.0pt][l]{\rule[-0.2pt]{3.22916pt}{0.4pt}}\makebox[3.22916pt]{\rule[-2.15277pt]{0.4pt}{6.45831pt}}}}_{n}^{\bowtie k}\rangle\theta$ iff there is a n-strategy $\mathfrak{S}$ such that $\textsf{Pr}_{\mathcal{M}}^{q}$$(\{\pi\in\textsf{Out}(q,\mathfrak{S})\ \mid\ \mathcal{M},\pi\models\theta\})$ $\bowtie$ $k$.

The satisfaction relation $\mathcal{M},\pi\models\varphi$ between a model $\mathcal{M}$, a path $\pi$ $\in$ $\textsf{Paths}_{\mathcal{M},q}^{*}$ of $\mathcal{M}$, and path formula $\theta$ is defined as follows:

• $\mathcal{M},\pi\models\mathsf{X}\,\varphi$ iff $\mathcal{M},\pi_{2}\models\varphi$,

• $\mathcal{M},\pi\models\varphi_{1}\,\mathsf{U}\,^{\leq m}\varphi_{2}$ iff there is an $0\leq i\leq m$ such that $\mathcal{M},\pi_{i}\models\varphi_{2}$ and $\mathcal{M},\pi_{j}\models\varphi_{1}$ for all $0\leq j<i$,

• $\mathcal{M},\pi\models\varphi_{1}\,\mathsf{U}\,\varphi_{2}$ iff there is an $i\geq 0$ such that $\mathcal{M},\pi_{i}\models\varphi_{2}$ and $\mathcal{M},\pi_{j}\models\varphi_{1}$ for all $0\leq j<i$,

• $\mathcal{M},\pi\models\varphi_{1}\,\mathsf{R}\,^{\leq m}\varphi_{2}$ iff either $\mathcal{M},\pi_{i}\models\varphi_{2}$ for all $0\leq i\leq m$ or there is an $0\leq i\leq m$ such that $\mathcal{M},\pi_{i}\models\varphi_{1}$ and $\mathcal{M},\pi_{j}\models\varphi_{2}$ for all $0\leq j\leq i$.

• $\mathcal{M},\pi\models\varphi_{1}\,\mathsf{R}\,\varphi_{2}$ iff either $\mathcal{M},\pi_{i}\models\varphi_{2}$ for all $i\geq 0$ or there is an $i\geq 0$ such that $\mathcal{M},\pi_{i}\models\varphi_{1}$ and $\mathcal{M},\pi_{j}\models\varphi_{2}$ for all $0\leq j\leq i$.

Let $\varphi$ be a formula and $\mathcal{M}$ be a model, then Sat$({\varphi},\mathcal{M})$ denotes the set of states of $\mathcal{M}$ verifying $\varphi$, i.e., Sat$(\varphi,\mathcal{M})=\{q\in Q\ \,|\,\ \mathcal{M},q\models\varphi\}$. Two formulas $\varphi$ and $\psi$ are equivalent (denoted by $\varphi\equiv\psi$) if for all models $\mathcal{M}$, Sat$(\varphi,\mathcal{M})$ = Sat$(\psi,\mathcal{M})$ The semantics of the obstruction probabilistic operator $\langle{\textbf{\raisebox{2.15277pt}{\makebox[0.0pt][l]{\rule[-0.2pt]{3.22916pt}{0.4pt}}\makebox[3.22916pt]{\rule[-2.15277pt]{0.4pt}{6.45831pt}}}}_{n}}^{\bowtie k}\rangle$ refers to the probability for the sets of paths for which a path formula holds. To ensure that this is well-defined, we need to establish that the events specified by POTL path formulas are measurable. Since the set $\{\pi\in\textsf{Out}(q,\mathfrak{S})\mid\mathcal{M},\pi\models\varphi\}$ for POTL path formula $\varphi$ can be considered as a countable union of cylinder sets, its measurability is ensured. This follows from the following lemma.

Lemma 1.

For each POTL path formula $\varphi$ and state $q$ of a model $\mathcal{M}$, the set $\{\pi\in\textsf{Out}(q,\mathfrak{S})|\ \mathcal{M},\pi\models\varphi\}$ is measurable.

Proof.

The approach is similar to the one proposed in (Baier and Katoen 2008) for PCTL. ∎

4 Model Checking

Here, we present our model checking algorithm for POTL. Furthermore, we show that the model checking problem for POTL is decidable in PTIME. POTL model checking algorithm is based on the computation of the set Sat$(\varphi,\mathcal{M})$ of all states satisfying a POTL formula $\varphi$, followed by checking whether the initial state is included in this set. The most interesting part of our logic is the treatment of the formula $\psi$ = $\langle\textbf{\raisebox{2.15277pt}{\makebox[0.0pt][l]{\rule[-0.2pt]{3.22916pt}{0.4pt}}\makebox[3.22916pt]{\rule[-2.15277pt]{0.4pt}{6.45831pt}}}}_{n}^{\bowtie k}\rangle\theta$. In order to determine whether $q$ $\in$ $\textsf{Sat}(\psi,\mathcal{M})$, we will use $\textsf{Pr}_{\mathcal{M},q}^{\mathfrak{S}}$ $(\theta)$ to denote the probability that all paths from $q$ that are in accordance with the n-strategy $\mathfrak{S}$ satisfies path formula $\theta$, that is $\textsf{Pr}_{\mathcal{M},q}^{\mathfrak{S}}(\theta)=\textsf{Pr}_{\mathcal{M}}^{q}(\{\pi\in\textsf{Out}(q,\mathfrak{S})\mid\mathcal{M},\pi\models\theta\})$. Then

$$\textsf{Sat}(\psi,\mathcal{M})=\{q\in Q\ \mid\ \textsf{Pr}_{\mathcal{M},q}^{\mathfrak{S}}(\theta)\bowtie k\}$$

We omit the superscript $\mathcal{M}$ in $\textsf{Pr}_{q}^{\mathfrak{S}}$ $(\theta)$ and $\textsf{Sat}(\psi)$ when the model is clear from the context. Now, we introduce our predecessor operator. Let $A$ = $\textsf{Sat}(\varphi)$ be a set of states, then the predecessor computation is done by the obstruction predecessor operator $\blacktriangledown(n,A)$ where $n$ is an integer and the operator computes the set of all predecessor states.

Definition 7.

Given a set of states $A$ $\subseteq$ $Q$, we define $\textsf{Pre}(A)$ = $\bigcup_{q\in A}$ $\textsf{pre}(q)$.

Now, let us define the obstruction predecessor operator.

Definition 8 (Obstruction Predecessor).

Let $\mathcal{M}=(Q,q_{0},\mathbf{P},\mathcal{L},\mathsf{C})$ be a model. Given a state $q$, a natural number $n$, and a set of states $A$ $\subseteq$ $Q$, we write:

$$\blacktriangleright(q,n,A)\ =\ \sum_{q^{\prime}\in A}\mathsf{C}(q,q^{\prime})\leq n$$

$$\blacktriangledown(n,A)=\{q\in\textsf{Pre}(A)\,\mid\,\blacktriangleright(q,n,\overline{A})\}$$

The general structure of the Algorithm 1 shown here is similar to OL model checking algorithm (Catta, Leneutre, and Malvone 2023b). However, it is now necessary to compute relevant probabilities. For model checking operator $\langle\textbf{\raisebox{2.15277pt}{\makebox[0.0pt][l]{\rule[-0.2pt]{3.22916pt}{0.4pt}}\makebox[3.22916pt]{\rule[-2.15277pt]{0.4pt}{6.45831pt}}}}_{n}^{\bowtie k}\rangle\theta$ applied to a model $\mathcal{M}$ the probability of a path leaving each state $q$ satisfying the path formula $\theta$ must be computed. This may require a calculation involving the operators: next $(\mathsf{X}\,\varphi)$, bounded until ($\varphi_{1}\,\mathsf{U}\,^{\leq m}\varphi_{2}$), until ($\varphi_{1}\,\mathsf{U}\,\varphi_{2}$), bounded release ($\varphi_{1}\,\mathsf{R}\,^{\leq m}\varphi_{2}$), or release ($\varphi_{1}\,\mathsf{R}\,\varphi_{2}$). We calculate, for an n-strategy and all states $q$ $\in$ $Q$, the probabilities: $\textsf{Pr}_{q}^{\mathfrak{S}}(\mathsf{X}\,\varphi)$, $\textsf{Pr}_{q}^{\mathfrak{S}}(\varphi_{1}\,\mathsf{U}\,^{\leq m}\varphi_{2})$, $\textsf{Pr}_{q}^{\mathfrak{S}}(\varphi_{1}\,\mathsf{U}\,\varphi_{2})$, $\textsf{Pr}_{q}^{\mathfrak{S}}(\varphi_{1}\,\mathsf{R}\,^{\leq m}\varphi_{2})$, and $\textsf{Pr}_{q}^{\mathfrak{S}}(\varphi_{1}\,\mathsf{R}\,\varphi_{2})$ respectively.

Algorithm 1 POTL model checking
Input: A model $\mathcal{M}$ and $\varphi$ is a POTL formula
Output: Sat$(\varphi)$ $\leftarrow$ $\{q\in Q\ |\ \mathcal{M},q\models\varphi\}$

1:for all $\psi$ $\in Sub(\varphi)$ do

2:     switch $(\psi)$ do

3:         case $\psi=\top$

4:              $\textsf{Sat}(\psi)\leftarrow Q$          

5:         case $\psi=p$

6:              $\textsf{Sat}(\psi)\leftarrow\{q\in Q\,|\,p\in\mathcal{L}(q)\}$          

7:         case $\psi=\neg\psi_{1}$

8:              $\textsf{Sat}(\psi)\leftarrow Q\setminus\textsf{Sat}(\psi)$          

9:         case $\psi=\psi_{1}\land\psi_{2}$

10:              $\textsf{Sat}(\psi)\leftarrow\textsf{Sat}(\psi_{1})\cap\textsf{Sat}(\psi_{2})$          

11:         case $\psi=\langle\textbf{\raisebox{2.15277pt}{\makebox[0.0pt][l]{\rule[-0.2pt]{3.22916pt}{0.4pt}}\makebox[3.22916pt]{\rule[-2.15277pt]{0.4pt}{6.45831pt}}}}_{n}^{\bowtie k}\rangle\theta$

12:              $\textsf{Sat}(\psi)\leftarrow\{q\in Q\ \mid\ \textsf{Pr}_{\mathcal{M},q}^{\mathfrak{S}}(\theta)\bowtie k\}$               

Let us first consider the next operator. For $\psi$ = $\mathsf{X}\,\varphi$, the following equality holds: $\textsf{Pr}_{q}^{\mathfrak{S}}(\mathsf{X}\,\varphi)=\min_{q^{\prime}\in\blacktriangledown(n,\textsf{Sat}(\varphi))}\mathbf{P}(q^{\prime},q)$, where $\mathbf{P}$ is the transition probability function of $\mathcal{M}$. Thus, we have the resulting vector $(\textsf{Pr}_{q}^{\mathfrak{S}}(\mathsf{X}\,\varphi))_{q\in\textsf{Sat}(\varphi)}$.

Let us consider the bounded until operator. For $\psi$ = $\varphi_{1}\,\mathsf{U}\,^{\leq m}\varphi_{2}$, the following equality holds: $\textsf{Pr}_{q}^{\mathfrak{S}}(\varphi_{1}\,\mathsf{U}\,^{\leq m}\varphi_{2})$. The set of states is partitioned into the three disjoint sets to perform the computation associated with this operator: $Q^{no}$ = $Q\setminus(\blacktriangledown(n,\textsf{Sat}(\varphi_{1}))$ $\cup$ $\blacktriangledown(n,\textsf{Sat}(\varphi_{2}))$, $Q^{yes}$ = $\blacktriangledown(n,\textsf{Sat}(\varphi_{2}))$, and $Q^{?}$ = $Q\setminus(Q^{no}\cup Q^{yes})$. The sets $Q^{yes}$ and $Q^{no}$ contain the states for which $\textsf{Pr}_{q}^{\mathfrak{S}}(\varphi_{1}\,\mathsf{U}\,^{\leq m}\varphi_{2})$ is equal to 1 and 0 respectively, and $Q^{?}$ contains all other states. For the set of states $Q^{?}$ we have:

$$\mathcal{X}_{q}^{m}=\begin{cases}0&\text{if $m=0$}\\ \min_{q^{\prime}\in\blacktriangledown(n,\textsf{Sat}(\varphi_{1}))}\mathbf{P}(q^{\prime},q)\cdot\mathcal{X}_{q}^{m-1}&\text{if $m\geq 1$}\end{cases}$$

where $\mathcal{X}_{q}^{m}$ = $\textsf{Pr}_{q}^{\mathfrak{S}}(\varphi_{1}\,\mathsf{U}\,^{\leq m}\varphi_{2}$). This is essentially applying the next operator $m$ times, while checking the satisfaction of $\varphi_{1}$ and $\varphi_{2}$. Let $(\mathcal{X}_{q}^{m})$ = $(\textsf{Pr}_{q}^{\mathfrak{S}}(\varphi_{1}\,\mathsf{U}\,^{\leq m}\varphi_{2})$ be a state indexed vector and by defining the matrix $\mathbf{P}^{\prime}$ as follows:

$$\mathbf{P}^{\prime}(q^{\prime},q)=\begin{cases}\mathbf{P}^{\prime}(q^{\prime},q)&\text{if $q\in Q^{?}$}\\ $1$&\text{if $q\in Q^{yes}$ and $q^{\prime}=q$}\\ $0$&\text{if $q\in Q^{no}$}\par\end{cases}$$

The probabilities can be computed as follows. If $m=0$ and $q$ $\in$ $Q^{yes}$, then $(\mathcal{X}_{q}^{0})$ = 1, and if $q\in Q^{no}$, $(\mathcal{X}_{q}^{0})$ = 0. In the case where $m\geq 1$, the vector $(\mathcal{X}_{q}^{m})$ can be computed by $m$ matrix-vector multiplication $(\mathcal{X}_{q}^{m})$ = $\mathbf{P}^{\prime}$ $\cdot$ $(\mathcal{X}_{q}^{m-1})$.

Now consider the (unbounded) until operator. For $\psi$ = $\varphi_{1}\,\mathsf{U}\,\varphi_{2}$ the following equality holds: $\textsf{Pr}_{q}^{\mathfrak{S}}(\varphi_{1}\,\mathsf{U}\,\varphi_{2})$ . As with the bounded until operator, all states are partitioned into the three disjoint sets $Q^{yes}$, $Q^{no}$, and $Q^{?}$. The sets are defined as above. However, the sets $Q^{yes}$, $Q^{no}$ are extended to contain all states for which $\textsf{Pr}_{q}^{\mathfrak{S}}(\varphi_{1}\,\mathsf{U}\,\varphi_{2})$ is 1 or 0. They can be determined with the fixed-point algorithms described in Algorithm 2 (Algo2) and Algorithm 3 (Algo3), respectively. Algo2 (i.e., the set $Q^{no}$) is computed by first computing the set of states reachable with non-zero probability that satisfy $\varphi_{2}$ whose predecessors do not satisfy $\varphi_{1}$. Subtracting these states from the set $Q$ gives the set of states with 0 probability. Algo3 (i.e. the set $Q^{yes}$) computes similarly the set of states that are reachable with probability less than 1 and that satisfy $\varphi_{2}$ whose predecessors do not satisfy $\varphi_{1}$. The set of states satisfying the operator with probability 1 is determined by subtracting these states from $Q$. The reason for precomputing $Q^{yes}$, $Q^{no}$ is that it ensures a unique solution to the linear system of equations and reduces the set of states in $Q^{?}$ for which probabilities must be computed numerically. In addition, the model checking of qualitative properties for which the probability bound is 1 or 0 does not require any further computation. The final set $Q^{?}$ can be computed by solving the linear equation.

$$\mathcal{X}_{q}=\begin{cases}$0$&\text{if $q$ $\in$ $Q^{no}$}\\ $1$&\text{if $q\in Q^{yes}$}\\ \min_{q^{\prime}\in Q}\mathbf{P}(q^{\prime},q)\ \cdot\ \mathcal{X}_{q}^{\prime}&\text{if $q$ $\in$ $Q^{?}$}\par\end{cases}$$

where $\mathcal{X}_{q}$ = $\textsf{Pr}_{q}^{\mathfrak{S}}(\varphi_{1}\,\mathsf{U}\,\varphi_{2})$. To reconstruct the problem in the form $\mathbf{A}\cdot x=b$. Let $(\mathcal{X}_{q})$ be the state indexed vector where $(\mathcal{X}_{q}=1$ if $q$ $\in$ $Q^{yes}$ and $(\mathcal{X}_{q})=0$ if $q$ $\in$ $Q^{no}$, and $\mathbf{A}$ = $\mathbf{I}$ – $\mathbf{P}^{\prime}$ where $\mathbf{I}$ is the identity matrix and matrix $\mathbf{P}^{\prime}$ is as defined below:

$$\mathbf{P}^{\prime}(q^{\prime},q)=\begin{cases}\mathbf{P}^{\prime}(q^{\prime},q)&\text{if $q\in Q^{?}$}\\ $1$&\text{if $q\in Q^{yes}$}\\ $0$&\text{if $q\in Q^{no}$}\par\end{cases}$$

The Power method (Varga 1962), can then be used to solve the linear system $\mathbf{A}\cdot x=b$.

Algorithm 2 Backward search for computing $Q^{no}$ (Algo2)
Input: A formula $\textsf{Pr}_{q}^{\mathfrak{S}}(\textsf{Sat}(\varphi_{1})\,\mathsf{U}\,\textsf{Sat}(\varphi_{2}))$ and $Q$.
Output: A set R of states which have a zero probability.

1:$Y\leftarrow\textsf{Sat}(\varphi_{2})$

2:$X\leftarrow\emptyset$

3:while $(Y\neq X)$ do

4:     $X\leftarrow Y$

5:     $Y\leftarrow Y\cup(\{q\in\textsf{Sat}(\varphi_{1})|$ $\exists q^{\prime}\in Y,\textbf{P}(q^{\prime},q)>0\}$ $\cap$ $\blacktriangledown(n,\textsf{Sat}(X)))$

6:$R\leftarrow Q\setminus Y$

7:$\mathbf{return}\ R$

Algorithm 3 Backward search for computing $Q^{yes}$ (Algo3)
Input: A formula $\textsf{Pr}_{q}^{\mathfrak{S}}(\textsf{Sat}(\varphi_{1})\,\mathsf{U}\,\textsf{Sat}(\varphi_{2}))$, $Q$ and $Q^{no}$
Output: A set R of states satisfying the operator with probability 1.

1:$Y\leftarrow Q^{no}$

2:$X\leftarrow\emptyset$

3:while ($Y\neq X)$ do

4:     $X\leftarrow Y$

5:     $Y\leftarrow Y\cup(\{q\in(\textsf{Sat}(\varphi_{1})\setminus\textsf{Sat}(\varphi_{2}))|$ $\exists q^{\prime}\in Y,$ $\textbf{P}(q^{\prime},q)>0\}$ $\cap$ $\blacktriangledown(n,\textsf{Sat}(X)))$

6:$R\leftarrow Q\setminus Y$

7:$\mathbf{return}\ R$

Now consider the bounded release operator. For $\psi$ = $\varphi_{1}\,\mathsf{R}\,^{m}\varphi_{2}$ the following equality holds: $\textsf{Pr}_{q}^{\mathfrak{S}}(\varphi_{1}\,\mathsf{R}\,\varphi_{2})$. The argument is dual to bounded until operator.

The last case is the (unbounded) release operator. For $\psi$ = $\varphi_{1}\,\mathsf{R}\,\varphi_{2}$ the following equality holds: $\textsf{Pr}_{q}^{\mathfrak{S}}(\varphi_{1}\,\mathsf{R}\,\varphi_{2})$. The argument is dual to unbounded until operator. However, Algorithm 2 and 3 should be modified at line 5, where the intersection operator should be changed to the union operator.

Let us now prove the termination and correctness of the Algorithm 1.

Theorem 1 (Correctness).

Let $\mathcal{M}$ be a POTS model and $\varphi$ be a POTL formula. Then, $(i)$ $\textsf{Sat}(\varphi)$ terminates and $(ii)$ $q$ $\in$ $\textsf{Sat}(\varphi)$ iff $\mathcal{M},q$ $\models$ $\varphi$.

Proof.

(Sketch) Intuitively, termination is straightforward because recursive calls within $\textsf{Sat}(\varphi)$ are always applied to strictly sub-formulas of $\varphi$. Let us prove $(i)$ and $(ii)$ by induction over the structure of $\varphi$ that, for every $\psi$ $\in$ $\textsf{Sub}(\varphi)$ and $q$ $\in$ $Q$ holds iff, $\mathcal{M},q$ $\models$ $\psi$.

(Soundness.) For every $\psi$ $\in$ Sub($\varphi$) and $q$ $\in$ $Q$, implies $\mathcal{M},q$ $\models$ $\psi$. We prove this by induction over the structure of $\psi$ as follows. For the base case: If $\psi=\top$, then $\textsf{Sat}(\top)$ = $Q$. That means $(i)$ holds immediately and $(ii)$ follows directly from the truth definition. If $\psi=p$ ($p$ $\in$ $\mathsf{Ap}$), then $\textsf{Sat}(p)$ = $\mathcal{L}(p)$ by definition. That means $(i)$ holds immediately and for $(ii)$ $q$ $\in$ $\textsf{Sat}(\psi)$ iff $q$ $\in$ $\mathcal{L}(p)$ then $\mathcal{M},q$ $\models$ $p$ by the truth definition. For the induction case: the cases of boolean combinations, if $\psi=\neg\psi$, then $\textsf{Sat}(\psi)$ = $Q$ $\setminus$ $\textsf{Sat}(\psi_{1})$ then induction hypothesis, $\textsf{Sat}(\psi_{1})$ terminates, therefore, $(i)$ holds. For $(ii)$ $q$ $\in$ Sat$(\psi)$ iff $q$ $\in$ $Q$ $\setminus$ Sat$(\psi)$ then, $q$ $\notin$ Sat$(\psi_{1})$ which means that $\mathcal{M},q$ $\not\models$ $\psi_{1}$ by the induction hypothesis then $\mathcal{M},q$ $\models$ $\neg\psi_{1}$ by truth definition. If $\psi=\psi_{1}\wedge\psi_{2}$, then Sat$(\psi)$ = Sat$(\psi_{1})$ $\cap$ Sat$(\psi_{2})$. By the induction hypothesis, Sat$(\psi_{1})$ and Sat$(\psi_{2})$ terminate, therefore, $(i)$ holds. For $(ii)$ $q$ $\in$ Sat$(\psi)$ iff $q$ $\in$ Sat$(\psi_{1})$ $\cap$ Sat$(\psi_{2})$ then, $q$ $\in$ Sat$(\psi_{1})$ and $q$ $\in$ Sat$(\psi_{1})$ which means that $\mathcal{M},q$ $\models$ $\psi_{1}$ and $\mathcal{M},q$ $\models$ $\psi_{2}$ by the induction hypothesis then $\mathcal{M},q$ $\models$ $\psi_{1}$ $\wedge$ $\mathcal{M},q$ $\models$ $\psi_{2}$ by truth definition. The induction step for the remaining obstruction operators is as follows: If $\psi$ = $\langle\textbf{\raisebox{2.15277pt}{\makebox[0.0pt][l]{\rule[-0.2pt]{3.22916pt}{0.4pt}}\makebox[3.22916pt]{\rule[-2.15277pt]{0.4pt}{6.45831pt}}}}_{n}^{\bowtie k}\rangle\theta$ then Sat$(\psi)$ = $\{q\in Q\ \mid\ \textsf{Pr}_{\mathcal{M},q}^{\mathfrak{S}}(\theta)\bowtie k\}$ by the Sat definition. To prove that $(i)$ holds, we must show $\textsf{Pr}_{\mathcal{M},q}^{\mathfrak{S}}(\theta)$ terminates. If $\psi$ = $\mathsf{X}\,\varphi_{1}$, the computation of $\textsf{Pr}_{\mathcal{M},q}^{\mathfrak{S}}(\theta)$ terminates due to the fact that Sat$(\varphi_{1})$ terminates by the induction hypothesis, and the functions $\blacktriangleright(q,n,A)$ and $\blacktriangledown(n,A)$ are finite. If $\psi$ = $\varphi_{1}\,\mathsf{U}\,^{\leq m}\varphi_{2}$, the computation of $\textsf{Pr}_{\mathcal{M},q}^{\mathfrak{S}}(\theta)$ terminates due to the fact that Sat$(\varphi_{1})$ and Sat$(\varphi_{2})$ terminate by the induction hypothesis. $\blacktriangleright(q,n,A)$, $\blacktriangledown(n,A)$, Sat$(\varphi_{1})$ and Sat$(\varphi_{2})$ are all finite and the solution of the corresponding linear equation systems also terminates. If $\psi$ = $\varphi_{1}\,\mathsf{U}\,\varphi_{2}$, the computation of $\textsf{Pr}_{\mathcal{M},q}^{\mathfrak{S}}(\theta)$ terminates due to the fact that Sat$(\varphi_{1})$ and Sat$(\varphi_{2})$ terminate by the induction hypothesis. If $\psi$ = $\varphi_{1}\,\mathsf{R}\,^{\leq m}\varphi_{2}$, the computation of $\textsf{Pr}_{\mathcal{M},q}^{\mathfrak{S}}(\theta)$ terminates due to the fact that Sat$(\varphi_{1})$ and Sat$(\varphi_{2})$ terminate by the induction hypothesis. The argument is symmetric to bounded until operator. Let $R$ be the set of symbolic states of $Q$ that is returned by algorithm 3 at line $6$. We need to show that $R=\textsf{Sat}(\psi_{2})$ provided that $X=\textsf{Sat}({\psi_{1}})$. We first show that $\textsf{Sat}({\psi})\subseteq Y$. Suppose that $q\in\textsf{Sat}(\psi)$. By the definition of satisfaction, this means that there is a strategy $\mathfrak{S}$ such that given any $\rho=q_{1},q_{2},\ldots$ in $Out(q,\mathfrak{S})$ and note that since the cardinality of $\mathcal{M}$ is finite, and we can suppose that $\mathfrak{S}$ is memoryless, we can focus on the finite prefix $q_{1},\ldots q_{m}$ of $\rho$ in which all the $q_{i}$ are distinct. Let $A_{i}$ (for $i<|{\mathcal{M}}|)$ be the value of the variable $A$ before the first $i$-th iteration of the algorithm. We show that if $C\subseteq A_{i}$ then $C\subseteq A_{i+1}$. Firstly, note that $A_{i}\subseteq\textsf{Sat}(\psi_{1})$ for all $i$. By definition, we have that $A_{i+1}=\blacktriangledown(n,A_{i})\cap\textsf{Sat}(\psi_{1})$, i.e., $A_{i+1}$ is computed by taking all the element of $\textsf{Sat}(\psi)$ that have at most $n$ successors that are not in $A_{i}$. If $\psi$ = $\varphi_{1}\,\mathsf{R}\,\varphi_{2}$ then the proof is similar to the above case.

(Completeness) For every $\psi$ $\in$ Sub($\varphi$) and $q$ $\in$ $Q$, we prove that $\mathcal{M},q$ $\not\models$ $\psi$ by induction over the structure of $\psi$ as follows. For the base case: If $\psi=\top$ and $\psi=p$ ($p$ $\in$ $\mathsf{Ap}$), are obvious. For the induction case, the cases of boolean combinations, $\psi=\neg\psi$, then $\psi$ was model checked, and it was found to be true. Thus, $\mathcal{M},q$ $\not\models$ $\psi$. For $\psi=\psi_{1}\wedge\psi_{2}$, then $\psi_{1}$ and $\psi_{2}$ were model checked and at least one of them was found to be false. Therefore, $\mathcal{M},q$ $\not\models$ $\psi$. The induction step for the remaining obstruction operators is as follows: If $\psi$ = $\langle\textbf{\raisebox{2.15277pt}{\makebox[0.0pt][l]{\rule[-0.2pt]{3.22916pt}{0.4pt}}\makebox[3.22916pt]{\rule[-2.15277pt]{0.4pt}{6.45831pt}}}}_{n}^{\bowtie k}\rangle\theta$ then Sat$(\psi)$ = $\{q\in Q\ \mid\ \textsf{Pr}_{\mathcal{M},q}^{\mathfrak{S}}(\theta)\bowtie k\}$ by the Sat definition. The proof for $X=\textsf{Sat}({\psi_{1}})$, $\psi$ = $\varphi_{1}\,\mathsf{U}\,^{\leq m}\varphi_{2}$ and $\psi$ = $\varphi_{1}\,\mathsf{U}\,\varphi_{2}$ then $\mathcal{M},s\not\models\psi$ is similar to the above case (similar for bounded and unbounded $\,\mathsf{R}\,$).

∎

The following theorem establishes the complexity of our model checking algorithms.

Theorem 2.

The model checking problem of POTL on POTS is PTIME

Proof.

(Sketch). Algorithm 1 shows a procedure for model checking POTL, which manipulates a set of states of $Q$. The procedure is inspired by the model checking for OL (Catta, Leneutre, and Malvone 2023a), PCTL (Hansson and Jonsson 1994) and ATL (Alur, Henzinger, and Kupferman 2002). However, we use two additional procedures $\blacktriangleright$ and $\blacktriangledown$ linked to the pre-image function Pre. In detail, our algorithm uses the following functions:

• The function Sub returns an ordered sequence, w.r.t. their complexities, of syntactic sub-formulas of a given formula $\varphi$.

• The function Pre is the same as for OL (Catta, Leneutre, and Malvone 2023a).

• The function $\blacktriangleright(q,n,A)$ takes in input a state $q$, a natural numbers $n$, and a subset of states $A$. Such a function returns true if $(\sum_{q^{\prime}\in A}\mathsf{C}(\langle q,q^{\prime}\rangle))<n$. If we represent the graph via an adjacent matrix, we can calculate such function in a linear number of steps w.r.t. the size of $A$.

• The function $\blacktriangledown(n,A)$ takes in input a natural number $n$ and a subset of states $A$. The function returns the subset $A^{\prime}$ of $\textsf{Pre}(A)$, such that $\blacktriangleright(q^{\prime},n,\overline{A})$ for all $q^{\prime}\in A^{\prime}$. The worst possible case is when $\textsf{Pre}(A)=Q$, and one needs to call $|Q|$-times the function $\blacktriangleright$. So, we are quadratic in $Q$, i.e. polynomial.

Algorithm 1 works bottom-up on the structure of the formula, the cases of interest are for strategic formulas. For $\varphi=\langle\textbf{\raisebox{2.15277pt}{\makebox[0.0pt][l]{\rule[-0.2pt]{3.22916pt}{0.4pt}}\makebox[3.22916pt]{\rule[-2.15277pt]{0.4pt}{6.45831pt}}}}_{n}^{\bowtie m}\rangle\mathsf{X}\,\varphi$, the procedure calls function $\blacktriangledown(n,\textsf{Sat}(\varphi))$ to compute the subset of set of states of $\textsf{Pre}(\textsf{Sat}(\varphi_{1}))$ that are bound to end up in satisfaction set. As regard $\varphi=\langle\textbf{\raisebox{2.15277pt}{\makebox[0.0pt][l]{\rule[-0.2pt]{3.22916pt}{0.4pt}}\makebox[3.22916pt]{\rule[-2.15277pt]{0.4pt}{6.45831pt}}}}_{n}^{\bowtie m}\rangle(\varphi_{1}\,\mathsf{U}\,\varphi_{2})$, the procedure computes the least fixed-point. We observe that, since it is monotone, such a fixed-point always exists. A similar reasoning can be done for $\varphi=\langle\textbf{\raisebox{2.15277pt}{\makebox[0.0pt][l]{\rule[-0.2pt]{3.22916pt}{0.4pt}}\makebox[3.22916pt]{\rule[-2.15277pt]{0.4pt}{6.45831pt}}}}_{n}^{\bowtie m}\rangle\varphi_{1}\,\mathsf{U}\,^{\leq m}\varphi_{2}$, $\varphi=\langle\textbf{\raisebox{2.15277pt}{\makebox[0.0pt][l]{\rule[-0.2pt]{3.22916pt}{0.4pt}}\makebox[3.22916pt]{\rule[-2.15277pt]{0.4pt}{6.45831pt}}}}_{n}^{\bowtie m}\rangle\varphi_{1}\,\mathsf{R}\,^{m}\varphi_{2}$ and $\varphi=\langle\textbf{\raisebox{2.15277pt}{\makebox[0.0pt][l]{\rule[-0.2pt]{3.22916pt}{0.4pt}}\makebox[3.22916pt]{\rule[-2.15277pt]{0.4pt}{6.45831pt}}}}_{n}^{\bowtie m}\rangle\varphi_{1}\,\mathsf{R}\,\varphi_{2}$. From the above, our procedure runs in polynomial-time in the size of the model and formula, where parameter sizes are defined as follows. The size of $\mathcal{M}$, is denoted by $|\mathcal{M}|$ and the size of a state formula $\varphi$, denoted by $|\varphi|$, is equal to the number of logical connectives and temporal operators in $\varphi$ plus the sum of the size $log(m)$ of each bounded temporal operators $\,\mathsf{U}\,^{\leq m}$ occurring in $\varphi$ and the function $\blacktriangledown(n,A)$. Therefore, checking whether a model $\mathcal{M}$ satisfies formula $\varphi$, which depends on the size of $\varphi$ and is at most $O(|\varphi|\cdot|\mathcal{M}|\cdot m_{max})$, where $m_{max}$ is the maximal step bound that appears in a subformula $\psi_{1}\,\mathsf{U}\,^{\leq m}\psi_{2}$ of $\varphi$ and if $m_{max}$ = 1, then $\varphi$ does not contain a step-bounded until operator. Termination of such procedure is guaranteed, as the state space $Q$ is finite.

∎

5 Illustration Example

Probability theory is well-suited for cybersecurity risk analysis because it provides a framework for understanding and quantifying uncertainty. To illustrate this, we will consider the following general cybersecurity scenario. Let $\mathcal{G}$ be an AG and we want to check if there are MTD response strategies that will satisfy certain security goals.

Figure 1: Example of an AG $\mathcal{G}$ from (Ismail 2016).

Consider the AG in Fig. 1 with four states: $S_{0}$, $S_{1}$, $S_{2}$, and $S_{3}$. Each state represents a state of the attacker in the system. If the attacker is in $S_{0}$ or $S_{1}$, he can perform one or two of the following actions: exploit vulnerability $v_{1}$, exploit vulnerability $v_{2}$, and access device $t$. If the attacker succeeds in exploiting $v_{1}$, he will transition to state $S_{1}$. Here, we assume that depending on the attacker’s preferences, there are 70$\%$ chance that the attacker will attempt to access equipment $t$ and a 30$\%$ chance that he will attempt to exploit $v_{2}$.

Action	Countermeasure	Cost	Efficiency
exploit($v_{1}$)	$c_{1}$	5	47.5$\%$
access($t$)	$c_{2}$	1	22.5$\%$
exploit($v_{2}$)	$c_{3}$	3	24.7$\%$

Table 1: Actions and Attack countermeasure

In Table 1, there are the three possible actions the attacker can deploy, with their respective countermeasures, cost, and effectiveness. Let Fig. 2 depict the POTS $\mathcal{M}$, constructed using the information from the attack graph presented in  (Ismail 2016). Notice that, in contrast to  (Ismail 2016), here we remove the actions because we do not have any actions in our POTS model. Therefore, the probabilities present in each state of the model are divided by the number of outgoing actions of that state. In Fig. 2 the yellow line (do nothing), indicates that no countermeasure will be deployed. The red lines ($c_{1}$ in Table 1), refer to a defensive countermeasure aimed at protecting the system against the attack attempt. However, $c_{1}$ has an efficiency of 47.5$\%$. Therefore, an attacker attempting to exploit$(v_{1})$ has a 5$\%$ chance of success. The violet lines ($c_{2}$) are a defensive countermeasure against accessing equipment $t$ and have an efficiency of 22.5$\%$. The orange lines ($c_{3}$) are a defensive countermeasure against exploiting vulnerability $v_{2}$ and have an efficiency of 24.7$\%$. Finally, green lines refer to the deployment of countermeasures $c_{2}$ and $c_{3}$ at the same time. Let us take the case where the defender chooses to deploy the countermeasure $c_{3}$ (orange lines) in state $S_{1}$, the attacker can either succeed or fail in his attack attempt. The efficiency of $c_{3}$ is 24.7$\%$. Therefore, the probability that the attacker fails in his attack attempt is 0.07425 (exploit$(v_{2})$ $\times$ efficiency$(c_{3}))$. Otherwise, the probability of success is of 0.00075.

Figure 2: The POTS $\mathcal{M}$ from $\mathcal{G}$.

Let $r_{2}$ and $r_{3}$ be the atomic propositions for the states, $S_{2}$ and $S_{3}$. We can express, via POTL formulas, the following security objective:

• There is a defender strategy with a cost $4$ such that the attacker reaches the state satisfying $r_{2}$ or the state satisfying $r_{3}$ with a probability less than a given threshold $0.1$. The following POTL formula captures the objective: $\varphi_{1}:=\langle\textbf{\raisebox{2.15277pt}{\makebox[0.0pt][l]{\rule[-0.2pt]{3.22916pt}{0.4pt}}\makebox[3.22916pt]{\rule[-2.15277pt]{0.4pt}{6.45831pt}}}}_{4}^{{}^{<0.1}}\rangle\mathsf{F}\,(r_{2}\vee r_{3})$.

• There exists a defender strategy with cost 5 such that the probability that the attacker reaches state satisfying $r_{3}$ is less than 0.2. The following POTL formula captures the objective: $\varphi_{1}:=\langle\textbf{\raisebox{2.15277pt}{\makebox[0.0pt][l]{\rule[-0.2pt]{3.22916pt}{0.4pt}}\makebox[3.22916pt]{\rule[-2.15277pt]{0.4pt}{6.45831pt}}}}_{5}^{{}^{<0.2}}\rangle\mathsf{F}\,r_{3}$.

6 Related Work

There are some papers that have focused on the strategic capabilities of agents playing within dynamic game models. In this section, we compare our approach with them.

Non-Probabilistic Games and Strategic Logics. Some research related to sabotage games has been introduced by van Benthem to study the computational complexity of a special class of graph reachability problems in which an agent has the ability to delete edges  (van Benthem 2005; Aucher, Benthem, and Grossi 2018). Sabotage Modal Logic (SML) was introduced by (van Benthem 2005) to reason about sabotage games. The model checking problem for the sabotage modal logic is PSPACE-complete (Löding and Rohde 2003). Our version of the games is not comparable to the sabotage games, because we provide the possibility to temporarily select subsets of edges, while in the sabotage games, the saboteur can only delete one edge at a time. In this respect, our work is related to (Catta, Leneutre, and Malvone 2023a), where the authors use an extended version of sabotage modal logic, called Subset Sabotage Modal Logic (SSML), which allows for the deactivation of certain subsets of edges of a directed graph. The authors show that the model checking problems for such logics are decidable. Also, we recall that SSML is an extension of SML, but does not include temporal operators. Also, neither SML nor SSML takes into account quantitative information about the cost of edges, as we do. In (Stasio et al. 2018) Dynamic Escape Games (DEG) have been introduced. In a DEG, an agent can inhibit edges but only reachability objectives have been studied. In (Catta, Leneutre, and Malvone 2023b) has been introduced Obstruction Logic which allows reasoning about two-player games played on weighted directed graphs. However, all these logics do not include quantitative information about probability and temporal operators.

Probabilistic Games and Strategic Logics. Several papers consider the verification of stochastic games using probabilistic logics. In particular, when agents play deterministic strategies (as in PSL (Aminof et al. 2019)) and probabilistic knowledge (as in PATL and $\textsf{PATL}^{*}$ (Huang and Luo 2013)). These logics are extensions of the Alternating- time Temporal Logics ATL and $\textsf{ATL}^{*}$ (Alur, Henzinger, and Kupferman 2002) and can be used to reason about the probabilistic knowledge and the probabilistic strategy in stochastic game systems. In (Song et al. 2019), the model checking problem has been studied for probabilistic alternating time $\mu$-calculus. (Huang, Su, and Zhang 2012) consider the logic Probabilistic $\textsf{PATL}^{*}$ under incomplete information and synchronous perfect recall. PATL has also been studied with incomplete information and memoryless strategy (Belardinelli et al. 2023), and with cumulative costs/rewards (Chen et al. 2012). In the context of MAS, probabilistic logic has been used to verify unconstrained parameterized systems, a fragment of $\textsf{PATL}^{*}$ called $\textsf{P[ATL}^{*}\textsf{]}$ (Lomuscio and Pirovano 2020), constrained resource systems (Probabilistic Resource-Bounded ATL (pRB-ATL) (Nguyen and Rakib 2019), and under assumptions about adversarial strategies, an extension of ATL with probability success (pATL) (Bulling and Jamroga 2009). However, none of these logics combine probabilistic settings with dynamic models.

7 Conclusions

In this paper, we presented POTL, a logic that allows reasoning about probabilistic two-player games temporal goals, where one of the players has the power to locally and temporarily modify the game structure. We proved that its model checking problem is in PTIME. We also showed how POTL expresses cybersecurity properties in a suitable way. Several directions we would like to explore for future work. A possible extension would be to consider probabilistic games with many players, between a demon and coalitions of travelers. Such an extension would have the same relationship with the PATL logic as TOTL has with TCTL. Another extension could be to introduce imperfect information in our setting. Unfortunately, this context is generally non-decidable (Dima and Tiplea 2011). To overcome this problem, we could use an approximation to perfect information (Belardinelli, Ferrando, and Malvone 2023), a notion of bounded memory (Belardinelli et al. 2022), or some hybrid technique (Ferrando and Malvone 2022, 2023).