[2511.10876] Architecting software monitors for control-flow anomaly detection through large language models and conformance checking

Computer Science > Software Engineering arXiv:2511.10876 (cs) [Submitted on 14 Nov 2025 (v1), last revised 27 Mar 2026 (this version, v2)] Title:Architecting software monitors for control-flow anomaly detection through large language models and conformance checking Authors:Francesco Vitale, Francesco Flammini, Mauro Caporuscio, Nicola Mazzocca View a PDF of the paper titled Architecting software monitors for control-flow anomaly detection through large language models and conformance checking, by Francesco Vitale and 3 other authors View PDF HTML (experimental) Abstract:Context: Ensuring high levels of dependability in modern computer-based systems has become increasingly challenging due to their complexity. Although systems are validated at design time, their behavior can be different at runtime, possibly showing control-flow anomalies due to ``unknown unknowns''. Objective: We aim to detect control-flow anomalies through software monitoring, which verifies runtime behavior by logging software execution and detecting deviations from expected control flow. Methods: We propose a methodology to develop software monitors for control-flow anomaly detection through Large Language Models (LLMs) and conformance checking. The methodology builds on existing software development practices to maintain traditional V\&V while providing an additional level of robustness and trustworthiness. It leverages LLMs to link design-time models and implementation code, automating source-code inst...