Matching Trace Patterns With Regular Policies Franz Baader 1⋆ , Andreas Bauer 2 , and Alwen Tiu 2 1 TU Dresden, Germany, baader@inf.tu-dresden.de 2 The Australian National University, {baueran, alwen.tiu}@rsise.anu.edu.au Abstract. We consider policies that are described by regular expres- sions, finite automata, or formulae of linear temporal logic (LTL). Such policies are assumed to describe situations that are problematic, and thus should be avoided. Given a trace pattern u, i.e., a sequence of ac- tion symbols and variables, were the variables stand for unknown (i.e., not observed) sequences of actions, we ask whether u potentially violates a given policy L, i.e., whether the variables in u can be replaced by se- quences of actions such that the resulting trace belongs to L. We also consider the dual case where the regular policy L is supposed to describe all the admissible situations. Here, we want to know whether u always adheres to the given policy L, i.e., whether all instances of u belong to L. We determine the complexity of the violation and the adherence problem, depending on whether trace patterns are linear or not, and on whether the policy is assumed to be fixed or not. 1 Introduction Regular languages (defined by regular expressions, finite automata, or temporal logics such as LTL) are frequently used in Computer Science to specify the wanted or unwanted behaviour of a system [1, 8, 3, 4]. Such specifications are not only employed in the design phase of the system, where one may try to verify that every execution trace of the system respects the specification [5]. They can also be used in the deployment phase to monitor the actual system trace and raise an alarm if the specification is violated by the behaviour of the system [7, 2]. In many of these applications, one actually employs ω-regular languages to describe the infinite behaviour of a reactive system, but in our intended application domain, considering finite sequences of actions (called traces in the following) appears to be more appropriate. In online trading systems, like eBay, formal policies can be used to describe sequences of actions that indicate potentially malicious, dishonest, or fraudulent behaviour (see, e.g., [14]). Of course, it is not always easy to define potentially problematic behaviour without creating too many false positives. But even if such a definition is available, detecting that the actual trace indeed violates the given policy is non-trivial due to the fact that the administrator of an online trading platform may not be able to observe all the relevant user actions. For example, payments made through a third-party institution, shipments of goods, ⋆ Supported by NICTA, Canberra Research Lab.