Applying Formal Methods to Gossiping Networks with mCRL and Groove

Applying Formal Methods to Gossiping Networks

with mCRL and Groove

Pepijn Crouzen

Department of Computer Science

Saarland University

crouzen@alan.cs.uni-sb.de

Jaco van de Pol

Arend Rensink

Department of Computer Science

University of Twente

f

vdpol,rensink

g

@cs.utwente.nl

ABSTRACT

Inthis paperweexplore thepra ti al possibilitiesof using formalmethodsto analyzegossiping networks. In parti u-lar,weuse CRLand Grooveto modelthepeersampling servi e,andanalyzeitthroughaseriesofmodel transforma-tionstoCTMCsandnallyMRMs. Ourtools omputethe expe ted value of various network quality indi ators, su h asaveragepathlengths,overallpossiblesystemruns. Both transientandsteadystateanalysisaresupported. We om-pareour resultswith thesimulationand emulation results foundin[10℄.

1.

INTRODUCTION

Gossiping networks provide anovelway of onstru ting distributedsystems. Agossipingnetwork onsistsofalarge numberof simplenodes, whi hhavea limited viewof the network. Theideaisthatinformationisdissipatedina gos-siping style, i.e. everynode ommuni ates itsinformation to asmall numberof othernodes inthe same waypeople spreadgossip througha ommunity. Thisstyle of ommu-ni ationisalso alledepidemi foritssimilaritytoadisease spreadingthrougha population. Gossiping networks have beenused su essfully inanumberofappli ations (for an overviewsee[6℄).

In[2℄theuseofformalmethodsisproposedtoanalyzethe behavior ofgossiping networks. Theadvantageis that for-malmethodsare pre iseand the resultsare tra eable (i.e. performan e problems an be tra ed ba k to spe i de-signde isions). Thedisadvantageofformalmethodsisthat theyrarely s ale. Asthesize ofthe systemunderanalysis isin reased,themodelsgrowexponentially. Another prob-lemis that a system may be too omplexto model using aparti ularformalism. First,agossiping networkis inher-entlydynami ,be ausenodesmayenterorleavethesystem, andtheir onne tionsvaryovertime. Furthermore, gossip-ingnetworkmodels ombine on urren yand probabilisti behavior ina timed setting, whi h leads to modeling and analysis ompli ations.

Inthispaper,wewilluseformalmethods(intheformof expli itstatemodel- he king)toanalyzegossipingnetworks. Ourmaingoalistoexperimentwithpre ise,expli it-state, formalmodelsandtoinvestigatethepotentialandthe lim-itationsofthisapproa h. Inparti ular,wewanttoanswer thefollowingquestions:

 Isitpossibletomodelthe omplexnatureofgossiping networksusingformalmethods?

 Arethe{possiblysmalls ale{resultsusefulinmaking designde isions?

Toinvestigatetherstquestion,wemodelthepeer sam-plingservi eof[10℄usingtheCRL[4℄tool-set,whi h sup-portstheuse of omplexdata-types. The entral hallenge is to model a dynami ally hanging network using stati data-types. TheCRLspe i ationisthentransformedto alabeled ontinuous-timeMarkov hain,by ombining on- urrent,probabilisti andsto hasti behavioralongthelines oftheMLotospro ess algebra[9℄. Wethenperform analy-sis(onanormalmodernworkstation) toseeforwhi hsize system we anstill generateexpli it-statemodels. Finally, we ompareour resultswiththe simulation andemulation results from [10℄to seeif we andete tthe same interest-ingphenomenausingformalmethodsasareobservedwhen employingsimulationandemulation.

Obviously, any omplete expli it state method anonly handle relatively small networks. Symmetry redu tion is parti ularlyinterestinginthesettingofgossiping networks, asitabstra tsindividualnodeidentitiesandinsteadlooksat theoverallstru tureofthenetwork(intermsofthe onne -tions between thenodes). Weexplore symmetryredu tion for gossiping networks byusingthe Groove tool[15℄. This toolutilizesgraphtransformationsandisthereforeidealfor the des ription of the behavior ofgossiping and other dy-nami networks. Furthermore,sin eGroovehandlesgraphs moduloisomorphism, it automati ally abstra tsindividual node identities. The results obtained in this way are still ompleteandpre ise. However,itis learlydesirableinthe futureto alsouse some formof abstra tionto ounter the state-spa eexplosionproblemevenmoredrasti ally [2℄.

Thepaperisorganizedasfollows. Se tion2des ribes gos-sipingnetworks. Se tion3givesanoverviewofthedierent formalisms usedinthis paper. Se tion4des ribeshowwe used these formalisms to model gossiping networks. The analysis of thegossiping networkmodels isthen explained inSe tion5. Thenthe resultsof the analysisare givenin Se tion6.Finally,wedis ussthepossibleavenuesforfuture workinSe tion7before on ludingthepaperinSe tion8.

2.

GOSSIPING NETWORKS

Oneoftheprimaryusesofnetworksisthedistributionof information fromand tothe onstituentnodes. Tradition-ally,spe ialnetworknodes,knownas servers,aredesigned toberesponsibleforthisdistribution;othernodesarethen alled lients. Thedrawba k of the lient-serverapproa h isthattheserversaloneareresponsiblefortheproper

fun -networkswithhighperformabilityrequirements[17℄. Anelegantalternativewasfoundbyabandoningtheidea ofa entral server oordinating the properfun tioning[5℄. Allnodesthenbehavea ording tosomesimplealgorithm and,hopefully,thepropernetworkbehavior emerges spon-taneously without any one node being responsible for the orre tness of the entire network. This approa h mimi s theway agroupofpeoplespreadgossip. No singleperson takes it upon him or herself to olle t all gossip and dis-tributeit to everyone, yetbe ause people naturally share the gossip theyknow, it anbe expe tedthat inthe long runeveryoneknows everythingabout everybody. Be ause ofthissimilarity,thesenetworksarereferredtoasgossiping networks (orepidemi networks,be ause the way informa-tionisspread throughoutthenetworkalsomimi stheway a disease spreads throughout a population during an epi-demi )[5℄.

In the absen e of a entral server, the nodes of a net-work must themselvesa quire and maintain knowledge of the stru tureof the network. This is the responsibility of the so- alled peer sampling servi e. The idea is that the nodes ontinuously ex hange information about the nodes theyknowabout. Thegoalofthisbehavioristomaintaina well-balan ed networkasthisgreatlyimprovesthe reliabil-ity andeÆ ien yofthenetwork. In[10℄itisassumedthat ea h node knows onlyasmallnumberofitspeers (theset ofpeers knownto a node is knownas its view, whi hhas amaximumsize). Thea tivebehaviorofanodeisthenas follows:

1. Itsele tsapeerfromitsview;

2. Itsele tswhatpartofitsviewitwillsend;

3. Itsendsthissubviewandre eivesasubviewinreturn;

4. Itmergesthere eivedsubviewwiththeoriginalview;

5. Itprunesex esspeersfromitsview,ifne essary.

Thereareseveralparametersinthisproto ol:

 The ommuni ationpoli y(step3): push,pullorboth (push-pull). This refersto ases where, respe tively, only thea tivenode sends itsview, onlythe passive node sends itsview, or both nodes send their views. In this paper we studythe dieren esbetween these poli ies.

 The sele tion of peers to ommuni ate, view tosend and peers to prune(steps 1,2 and 5), whi h anbe basedontheageofthelinksinthenetwork(beingthe time sin e the last ommuni ation between the two nodes). In this paper we ignore all age parameters: peersele tion andpruningare doneat random(with anequalprobabilityfor ea hpossible hoi e),and al-waystheentireviewissent.

GossipingnetworksarediÆ ulttoanalyzeduetotheirsize and themany dierent parameters. Furthermore, we an-notanalyzethenodesinisolation(ate hniquewhi his use-fulinanalyzing lient-serversystems)aswearespe i ally interestedin behavior that emergesin (large) networks of nodes. Sofar, mostlysimulationand emulation havebeen used[10℄,butthishas anumberofdrawba ks. Simulation reliesheavilyonthea ura yofthesimulationmodelsused

ise interpretationoftheresultsisoften obs ure,i.e. when somethinginterestinghappensitisdiÆ ulttondoutwhat aused this event. Finally, bothsimulationand emulation struggletondso- alledrareevents,i.e. eventsthathavea verylowprobabilitytohappen(su hthat theyrarely hap-peninsimulation/emulation),butarestill ommonenough to ausegreatproblemsduringtheoperationofthenetwork. Asarststartwestudyasimpleversionofthegossiping proto olasdes ribedin[10℄ wherepeersele tionand view sele tion are always random. Methodsto implementother peersele tionandviewsele tionstrategiesaredis ussedin Se tion7.

3.

FORMALISMS

In this se tion, we des ribe the formalisms used in the modelingand analysis of gossipingnetworks. For thesake ofbrevitywekeepthedes riptionsshortandrefertoother sour esformoredetailedinformationabouttheformalisms. Figure1showshowtheseformalismshavebeen hained to-getherfor thepurposeofthispaper.

3.1

mCRL

CRL[4℄ ombinespro essalgebra(inthestyleofthe al-gebra of ommuni atingpro esses, ACP [3℄)with abstra t datatypes. Frompro essalgebra,itinherits operatorslike +(alternative hoi e),
(sequential omposition)andjj (par-allel omposition). Normally, parallel pro esses interleave theira tionsinanasyn hronousway.Whenspe ied expli -itly,parallelpro esses ansyn hronizeonspe i a tions.

Thedata part is used to model the state of a re ursive pro ess(X(s)=p[X(s

0

)℄), onditionalbran hing(p/ b . q) and to des ribe the data ommuni ated by syn hro-nizeda tions (send(m)). The possibly innite summation (

P

x:N

read(x))is usedto modeltheinput of anarbitrary x:N,whereN isapossiblyinnitesetofvalues.

3.2

Groove

Groove[15℄ is atool for the veri ationof graph trans-formationsystems.AGroovespe i ation isasetofgraph transformation rules, ea h ofwhi h onsists ofa left hand side(LHS)andarighthandside(RHS).Theee tofarule isgivenbythe\dieren e"betweenLHSandRHS;in par-ti ular,nodesandedges anbeaddedorremoved.Aruleis appli abletoagraphwhereverthegraph ontainsanimage of the LHS; applying the rule essentially means repla ing theLHSimagebya opyoftheRHS.

Givenarulesystemandaninitialgraph,amodelofthe behavior is obtained by exploringall rule appli ations re- ursivelyto theinitial graphandall resulting newgraphs. This gives rise to a transition system in whi h the states aregraphsandthetransitionsareruleappli ations. Hen e, tomodelthebehavior ofagivensystem,all relevant infor-mation, in luding the data stru tures, should be en oded intotheinitialgraph,bymeansofnodesandedges,andall dynami stepsshould be en odedas graphtransformation rules.

Aspe ialfeatureisthatstatesare ollapsedmodulograph isomorphism; in otherwords, Groove performs automati symmetryredu tion(see[16℄). Thisturnsouttobeofgreat advantage infor the gossip proto ol, sin e this ontains a

CRL GROOVE CTMC MRM Results Interpret Cal ulation Model he king

Figure1: Theanalysis traje tory.

3.3

Continuous-time Markov chains

Continuous-time Markov hains are a lassof sto hasti pro esseswithadis retestatespa e,wherestatetransitions o ur after time-delays governed by negative exponential distributions(foranoverviewofCTMCsandother Marko-vianmodelssee [8℄). A CTMC anbe embellished witha labelingfun tionwhi hlabelsea hstatewithasetoflogi al propositions. We alltheresultingmodelalabeledCTMC. Inour ase,thestatesoftheCTMCarelabeledwithdire ted graphsrepresentingthestateofthegossipingnetworks,but itis obvious that adire ted graphof boundedsize anbe en odedasasetofpropositions.

3.4

Markov reward models

AMarkovrewardmodelisaCTMCaugmentedwitha re-wardstru ture assigningareal-valued rewardto ea hstate inthe model[1℄. Weuse thisreward stru turetomeasure severalqualityindi atorsofthegossipingnetworks: the vari-an eoftheindegreeofthenodes,theaveragelengthofthe shortestpathbetweeneverypossible ombinationofnodes andthe lustering oeÆ ient(see[10℄andSe tion5).

We are interested in al ulating the expe ted value of thesemeasuresat ertaintime-pointsaswellastheexpe ted valueofthemeasuresinthelongrun. We an al ulatethis byimplementingthepossibleextension toCSRL rst men-tionedin [1℄ and implemented in [11℄. The instantaneous reward orrespondstotheexpe tedvalueofameasureata ertaintimepoint. Theinstantaneousrewardattimepoint tis al ulatedbysummingup,forall statess,theprodu t of the probability of being ins at time-point t (transient probability)and therewardofs. Theexpe ted rewardrate orresponds to the long-run expe tedvalue of a measure. Theexpe tedrewardrate anbe al ulatedbysummingup, forall statess,the produ tofthelong-runaverage proba-bility(steady-stateprobability)ofbeing instates andthe rewardofs.

4.

MODELING

In this se tion, we des ribe how we modeled gossiping networks. First,anabstra t overview ofthe behavior ofa nodeinagossiping networkis provided. Next,the asso i-atedCRLspe i ation isgiven. Finally, wedes ribehow we modeledthe gossiping networks using the graph trans-formationtoolGroove.

4.1

Abstract model

Thestateofonenodeinourgossipingnetworkisdes ribed by its view, i.e. the other nodes it knows about, and its internal state. Su ha view is modeled simplyas a set of nodes. Thebehaviorofanodeisdividedintoana tiveanda passive\thread",following[10℄. As hemati representation ofthedierentinternalstatesofanodeusingthepushpoli y

S wait sele tpeer(1) send(3) re eive/merge(3,4) pruneview(5) Sto hasti delay Probabilisti hoi e Con urrenta tion

Figure 2: S hemati of the behavior of a gossiping networknode using thepush poli y.

Initially, a nodeis in itsstable state (markedS in Fig-ure2). Afterasto hasti delay(thewait transitionin Fig-ure 2) the node may move to its a tive thread. At this point the proto oldes ribedinSe tion 2starts: inits a -tive thread the node randomly sele ts a peer (with equal probability,step1),sendsitsview(augmentedwithitsown identity)tothesele tedpeer(step3)andreturnstoits sta-blestate. Thesele tedpeerre eivesthisviewinitspassive thread, providedit isinastable state,and mergesitwith itsownview(steps3and4);itthenprunesthemergedview randomlytoa orre tlysizedsubset(withequalprobability, step5). After thisviewsele tionthenodereturnsagainto itsstablestate.

The pull poli y is similar, ex ept that here the a tive thread,aftersele tingapeer,requeststheviewofthatpeer, mergesitwithitsownview,andtrun atesitrandomly. Fi-nally,inthepush-pullbehavior,viewsareex hangedinboth dire tions.

Afullnetwork onsists ofN su hnodes,workingin par-allel. It isimportantto understandthat ifall nodesarein astable state,anynode ould startthe a tivethread, and sele tpotentiallyanyothernode. SoforanNnodenetwork thereareN(N 1)potential ontinuations(limitedonlyby thea tual ontentsoftheviews).

Amajorissueinany on urrentsettingishowtheevents ofdierentnodesareordered. In[10℄around-robins hedule is assumed: inevery round, everynode a ts exa tlyon e. However, su hanordering wouldrequire a entral author-ity (at least a global lo k), whi h makes sure that ea h

networkssowendthisassumptiontoorestri tive. Inthis paper we assume that all nodes a t after a sto hasti ally distributeddelay. Thedelay distributionsofthenodes are identi al,butindependent. Thismeansthatthe nodesare all expe ted toa t at thesamerate, buttheindependen e meansthatthereisnoneedfora entralauthority. Inthis modelrare o urren es,su has asinglenodea tingmu h fasterthantheothernodesforaperiodoftime,arepossible eventhoughtheywill haveanextremelysmallprobability. Su hrareo urren esaregenerallydiÆ ulttodete tusing standardsimulationoremulationte hniques.

There ouldbe on ernthatamodel omposedofseveral nodesmightdeadlo k. Spe i ally,thiswouldhappeniftwo nodeswould simultaneouslyentertheir a tive threadsand attemptto ommuni atewithea hother. Bothnodeswould thenbestu kwaitingfortheothernode. Toavoidsu h sit-uations,thea tiveandpassivethreadsmustsomehowrun atomi ally. This anbe modeledbythe maximalprogress assumption[14℄, i.e. all internal behavior o urs immedi-ately. Inpra ti e, this means that all ommuni ationand view-updating a tionshave priorityoverthe sto hasti de-lay. This an also be explained sto hasti ally: Sin e the Wait delays are drawn from ontinuous distributions the probabilitythattwotimersexpireatthesametimeiszero. If internal omputationtimes are negle ted, the probabil-ity thatanothertimer expiresduringinternal omputation isalso zero. Hen ewemaysafelyassume thatthe passive threadsarealwaysreadytore eiveinformation.

Thesto hasti delay Wait isassumedtobegovernedby anegativeexponentialdistributionandis thus modeled as a ontinuous-time Markovian transition. In reality, how-ever,thedelay ouldbeimplementedasadeterministi de-lay. This anbeapproximatedusinganErlangdistribution. Su hanErlang distributionwould onsistinourmodelof a hain ofidenti allydistributed exponentialdistributions, i.e. a hainofMarkoviantransitions. Toimprovethe a u-ra yoftheapproximation weneedtoin reasethe number ofphasesintheErlangdistributions,i.e. wemustmakethe hainlonger. This,however,exponentiallyin reasesthesize ofthenetworkmodel. Wehavenotexperimentedwiththis inouranalysis.

4.2

mCRL

Using the CRL language, we modeled ea h node as a separatepro ess. Thestateparametersofea hnodedenote its identity and its urrent view. Nodes are omposed in parallel,and ommuni atebysending/re eiving views. For this,weintrodu eexpli itsendandre eivea tions,whi h syn hronizeatomi ally(handshaking). Complexoperations, like mergingviewsand sele tingsubviews, arespe iedby equationsintheabstra tdatapart.

In orderto model oneex hange (in ludingpushing and pulling views) in the proto ol atomi ally, we spe ify syn- hronized send- and re v-a tions with four arguments as follows:

send(i;j;v;w) denotes that (the a tive thread of) node i pushes viewv to(thepassive threadof) nodej,and pullsviewwfromit.

re v(i;j;v;w) denotesthat (thepassive threadof) nodej re eivesviewvfrom(thea tivethreadof)nodei,and

sele tionandviewsele tion,wein ludetwopredi ates:

peersele t(v;p) : given urrent view v, it is possible to sele tpfromitforthenext ommuni ation

viewsele t(v;u) : given a view v, it is possible to sele t thesubviewufromit.

Given all these ingredients, a node with identity i and urrent view v,and havingtwo threads, anessentially be modeledasfollows:

Node(i:Id;v:View)=

P

j:Id

P

w :View

P

u:View send(i;j;v;w)
Node(i;u) / peersel e t(v;j)^viewsel e t(merge(v;w);u) .Æ +

P

j:Id

P

w :View

P

u:View re v(j;i;w;v)
Node(i;u) / viewsel e t(merge(v;w);u) .Æ

Anetworkwiththreenodesandnode2inthe enteristhen modeledas:

Node(1;f2g)jjNode(2;f1;3g)jjNode(3;f2g)

Infa t,weusedaslightlymore ompli atedmodel: adelay a tionis added;the peersele tand view sele ttransitions areexpli itlymodeledasinternaltransitions;nodeiis prop-erlyadded tov and deletedfromw;all datatypes, in lud-ingthesele tionpredi ates,mustbespe iedinfulldetail. The a tual model that we used is parameterized over the pull/pushpoli y,thesizesofthenetworkandtheview,and overthe initial onguration. Wewerealso ableto spe ify peer and view sele tion strategies based on hop ounters, butthesemodelshavenotbeenanalyzedindetail.

Notethatwereliedonthestrongdataspe i ation apa-bilities of CRL.However, CRL has nonotion of proba-bilisti hoi e,or sto hasti time. So,asone anseeabove the hoi eofpeersele tionandview sele tionare modeled asnon-deterministi hoi einCRL.Inordertomodelthe delays, the send-a tion is pre eded by an a tion \delay". Onlyaftergeneratingthestatespa e,theothertoolsinthe tool hain interpret\delay" assto hasti delay. Also,they interpretnon-deterministi asequiprobable hoi e.

Thebehavior ofthe gossiping networkis nowdened as the parallel ompositionof thebehaviorsof its onstituent nodes. The maximalprogress assumptionis implemented by giving all other transitions priority over the delay a -tion. The state spa e ofthis networkbasi ally onsists of theviewsofallnodes. Ifweinterpretthepeersintheview of a node as its neighbors in a dire ted graph, then ea h stateinthebehaviorofthenetworkislabeledbyadire ted graph. InSe tion5,wewill seehowwe transformthis be-haviortoaMarkovrewardmodelandhowwethenanalyze itto omputeinterestingmeasuresfor thenetwork.

4.3

Groove

TheGroove modelofthe gossiping networkdire tly en- odesthestru tureofthenetworkasagraph,withnetwork nodes as graph verti es and their view as a set of outgo-ing edges. In addition, the model in ludes some auxiliary verti esandedgesto ontrolthebehavior. Anexample ini-tial graph, for a network of size 5 with initial view size 2 organizedinaringstru tureisgiveninFig.3.

om-Figure3: Start graphfor theGroove model

Elements Meaning

Thinbla k Presentinthegraph Widedashed Absentinthegraph Mediumgray Addedtothegraph Dotted Universallyquantied

Figure 4: Rule \pull": link edges are addedto the a tive nodefor all links known tothe passivenode.

andpullingtheviewsfromonenodetoanotherareea h ap-turedbyasinglerule,whi hin orporatesatthesametime the role of the a tive and the passive node. For instan e, theruleforpullingisdisplayedinFig.4.

Together with rules for hoosing the a tive and passive nodesandfor \ leaningup" afterwards, thisforms asmall proto ol like the one displayed in Fig. 2 for mCRL, with as main dieren e that there are no separate \send" and \re eive" a tions;rather, theseare ombinedinthe\pull" and\push"rules.

5.

ANALYSIS

In this se tion, we des ribe how we analyze the CRL andGroovemodelsdes ribedinthepreviousse tion. This analysisfollows thetraje tory ofFigure1. Wealsodis uss the omplexityofourapproa h,bothintermsofthesizeof themodelsandthetimeneededtoanalyzethemodels.

5.1

From mCRL/Groove to CTMC

In Se tion 4, we have seen that the CRL and Groove models ontain ontinuous sto hasti delays and dis rete probabilisti transitions. Following the strategy for the MLotos pro ess algebra [9℄ we interpret the CRL and GroovemodelsaslabeledCTMCs.

Let's rst onsider what a CRL or Groove modelof a gossiping network looks like. The CRL model is gener-ated by omposing all the node models inparallel, while theGroovemodelisgeneratedbyexhaustivelyapplyingall graph transformations. The hoi e of the node that will instigate a ommuni ationis modeledas a hoi e between sto hasti transitions. After a node X has been sele ted, the hoi einstep1oftheproto ol(thepeersele tion)isa

pla einstantaneouslyand,be auseofthemaximalprogress assumption, this prevents any other node from be oming a tive (i.e. nishing itssto hasti delay)before node X is donewithits ommuni ation. Thepeersele tionisfollowed byanotherprobabilisti hoi eoftheresultofstep5 (prun-ing). After this, the model returns to a newstable state, where all nodes are waiting on their sto hasti delays. A partialexampleofamodelwithasinglepruning hoi e an beseenontheleftsideofFigure5.

Sin eallinternaltransitionsaresubstitutedby probabilis-ti hoi e,thereisnointernalnon-determinismleft. Wealso seethatallprobabilisti transitionsaredelay-guarded

1 . This meansthatthemodels anbetransformedintoCTMCsas in [9℄. The main prin iple of this transformation is that a Markovian delay (e.g. with rate) followed by a prob-abilisti hoi e (e.g. between two transitions, one having probability

1 3

, theotherhavingprobability 2 3

) is sto hasti- allyequivalent toa hoi ebetween Markoviantransitions su h that the rate of the original Markovian transition is distributed over the new Markovian transitions a ording to the probabilisti hoi e (in ourexample we get Marko-vian transitions with rates

1 3  and 2 3  respe tively). The state-labelsofthe CRLandGroovemodelsare preserved intheresultinglabeledCTMCs. Ea hlabeldes ribesa on-gurationofthegossipingnetwork.

In pra ti e the transformation from CRL or Groove modeltoCTMCmeansthateverysequen eofwait (sto has-ti delay),peersele t(probabilisti hoi e)and viewsele t (probabilisti hoi e) transitions is repla ed with a group ofsto hasti delaytransitionsbydistributingthesto hasti delay ofthe waittransition overtheprobabilisti distribu-tions of subsequent transitions. A partial example ofthis transformation anbeseeninFigure5.

5.2

From CTMC to MRM

WenowhavealabeledCTMCwithea hofitsstates la-beled with a dire ted graph representing the state of the gossiping network. Wenow omputefor ea h state inthe CTMC, usingstandardalgorithmsfromgraphtheory, sev-eral measures of the graphasso iated with the state: the varian e of the indegreeof ea h of the nodes, the average shortest path lengthbetween all ombinations of dierent nodesandthe lustering oeÆ ient[10℄. Thisgivesusthree MRMswheretherewardstru tureistheindegreevarian e, average shortestpath or lustering oeÆ ient respe tively. The indegree varian e is a measure on the distribution of indegrees inthe network. Inaperfe tly balan ed network all indegrees would be equal and the varian e therefore 0. The higherthevarian ethe more unbalan edthe network is,whi hisundesirable. Alowaverageshortestpathlength is desirablesin e this will redu etransmission times. And nallythe lustering oeÆ ient measurestheamountof in-ter onne tions between the neighbors of any node. High valuesforthis oeÆ ientmeanthatthenodesform lusters whi hunbalan esthenetworkandisthereforeundesirable.

5.3

From MRM to results

Obtainingthe results onsists oftwosteps. First,using thetransientandsteadystateanalysistoolsfromtheCADP toolset[7℄,we omputetheprobabilitytoresideinea hstate

1

pre-A C D    1=2 1=2 1=2 1=2 1 ) A C D   1=4 1=4 1=2

Figure5: Example ofthetransformation ofpart ofaCRL/Groove modelto aCTMC.

at ertaintimepointsandonthelongrun.This anbedone on efortheCTMCobtainedafterremovingalllabels. The intermediateresultislumped,usingrate-preserving bran h-ingbisimulationminimalization.

Next,wemodel- he kea hMRMseparately,usingthe ex-tensiontoCSRLrstsuggestedin[1℄. Wehaveimplemented this extension using the extensible XTL model- he kerof theCADP tool-set [12℄. TheCSRLextensionis also sup-portedbythePRISMmodel he ker[11℄. Thisextensionto CSRLprovidesuswithbothinstantaneousrewards,i.e.the expe tedvalue ofoneofthe measuresatsome timepoint, aswellasthelongrunrewardrate,i.e.theexpe tedaverage valueofthemeasuresinthelongrun.

5.4

Complexity

Wenow onsider the omplexityofouranalysis method. We rst noti e that the state-spa e of the models, from CRLorGroovetoMRM,isboundedbythedierent possi-blenetwork ongurations(timesa onstantfa torbe ause oftheinternalstates),takenmoduloisomorphisminthe ase ofGroove. ForagossipingnetworkwithN nodesand

view-size(or onstantout-degree)C wend

„

N 1

C

«

N

dier-ent ongurations: ea hnodehasC outofN 1peers in

itsview(

„

N 1

C

«

possibilities)andthereareof ourseN

dierentnodes. Wedisregardthepossibilityofnodeshaving aview smaller thanthe maximum view-size sin e we on-sideronlymodelswhereall nodesstart withmaximum a-pa ityviews. Nowea hstateislabeledwithadire tedgraph representingthenetwork. To al ulatethegraphmeasures weneedto omputetheshortestpathlengthfor all ombi-nationsofnodes. Thisisdone byusing Dijkstra'sshortest pathalgorithm whi hhasa omplexityofN

2

. Cal ulating theothertwomeasures ostslesstime. Formeaningful val-uesofN this al ulationisdominatedhoweverbytheneed to al ulatesteady-stateresultsfortheresultingMRM.The omplexityofthisoperationisx

3

wherexisthenumberof statesinthemodel

2

. Overallwethenndatime omplexity

ofO(

„

N 1 C

«

N

!

3 ).

For the ase of Groove, dueto symmetryredu tion the statespa eis(mu h)smaller,butweknowofnoanalyti al waytopredi t theee tiveredu tion. Note,however,that every onguration of anetworkof size N, interpreted up toisomorphism, anrepresentatmostN!dierent \plain" ongurations. This provides an upper bound to the

de-2

We disregard here the possibility of iterative algorithms, forwhi hthe omplexitydependsonthedesireda ura y.

gree of symmetry redu tion. In Table 1 we ompare the al ulated number of \plain" ongurations (P) with the simulatednumberof ongurations modulosymmetry(S), insofar we have been able to omputethe latter. The re-du tion(P=S)is learlylarge(infa t,thereader an he k thatitapproa hesthemaximalredu tionofN!tomorethan 95%),butequally learly,thesizeoftheredu edstatespa e isstillmorethanlinearexponentialinthenetworksize,and sotheproblemisintra tableevenforsmallnetworksizes.

6.

RESULTS

Inthisse tionwegivetheresultsofouranalysis. Westart bygiving thelong-runaveragesfor indegreevarian e(IV), averageshortestpathlength(PL)and lustering oeÆ ient (CC ). We then present graphs showing the expe ted evo-lution of thesemeasuresand omparetheresults with the on lusionfoundin[10℄.

6.1

Long-run averages

Table 2 gives the long run average results for gossiping networks for the three dierent transmission poli ies pull, pushandpull-push(marked\both"inthetable),for dier-entnetworkandview sizes. Moreover, thetable also indi- atesthesizeofthemodelsinCRLandGroove. Theratio betweenthesetwonumbersissimilartothepotential redu -tionpredi tedinTable 1. Notethatfor N=7wewerenot able to omputethe CRLmodels; with Groovewe ould generateuptonetworksize 7,buttheresults ouldnotbe analyzed. We on lude from theseresults that, a ross the board, pull-push is the best transmission poli y, followed losely bypush, while pull is mu hworsethanthe others. Notethatthis orrespondstothendingsof[10℄.

Anotherobservationisthatthenumberofrea hable (sta-ble)network ongurations(moduloisomorphism)isalmost alwaysequalto thetotal numberof ongurations a ord-ing toTable1,ex eptfor thepushpoli yforN=6;7and C=2,whereapparentlyaveryfew ongurations arenot rea hable. Wehavenotanalyzedthisfurther.

A veryinteresting setof results emerges for N = 6 and C=2.Forthepushandthepull-pushstrategiesweseethat onthelongrunthenetworkwillhaveanindegreevarian e of 0,arelativelyhigh pathlengthof3.33 and a lustering oeÆ ientof1. Forpull,asimilaree to urs,butinthis ase theindegreevarian eisratherlarge,insteadof0.

The reason for these values is that (for push and pull-pushstrategieswithN=6andC=2)agossiping network will always eventually partition into a onguration on-sisting of twofully onne ted groups of3 nodes,shownin Figure6(left). ThisindeedhasIV=0,CC=1andaverage PL=3

1

N Plain(P) Sym.(S) P=S P S P=S P S P=S P S P=S 4 81 6 14 5 7776 79 98 1024 13 79 6 1.010 6 1499 667 1.010 6 1499 667 15625 40 391 7 1.710 8 35317 4838 1.310 9 257290 4975 1.710 8 35317 4838 279936 100 2799 8 3.810 10 967255 39103 2.310 12 { { 2.310 12 { { 3.810 12 { {

Table1: Network onguration ounts and symmetryredu tionfor variousnetworkand viewsizes.

N C Poli y IV PL CC Fullstatespa e Stable CRL Groove Groove 4 2 Pull 1.50 1.38 1.00 981 87 6 4 2 Push 1.03 1.16 0.79 945 80 6 4 2 Both 0.94 1.14 0.77 1989 96 6 5 2 Pull 2.93 2.16 1.00 121176 2006 79 5 2 Push 1.51 1.67 0.68 117936 1850 79 5 2 Both 1.53 1.63 0.64 408456 2064 79 5 3 Pull 2.40 1.48 1.00 16144 338 13 5 3 Push 1.15 1.07 0.81 17984 321 13 5 3 Both 1.02 1.05 0.79 39184 419 13 6 2 Pull 4.31 1.00 3.00 1.910 7 56843 1499 6 2 Push 0.00 1.00 3.33 1.810 7 56843 1498 6 2 Both 0.00 1.00 3.33 8.210 7 64389 1499 6 3 Pull 4.75 2.28 1.00 2.410 7 56843 1499 6 3 Push 2.02 1.39 0.70 2.310 7 56843 1499 6 3 Both 1.83 1.35 0.67 9.510 7 64389 1499 6 4 Pull 3.33 1.56 1.00 403075 1307 40 6 4 Push 1.15 1.02 0.83 386125 1247 40 6 4 Both 0.99 1.01 0.82 858475 1604 40 7 2 Pull { { { { 1515526 35317 7 2 Push { { { { 1405080 35314 7 2 Both { { { { 1429880 35317

Table2: LongrunaverageresultsforgossipingnetworkswithNnodesandviewsizeC;IV=IndegreeVarian e, PL=averageshortestPathLength,andCC=ClusteringCoeÆ ient. Additionallythesize(numberofstable states)ofthe CRLand Groove models isgiven.

Figure6: Degeneratenetwork ongurations: none ofthestrategies anre overfromthelefthandside, andpull annot re overfromtherighthand side.

thissituation. Weexpe ttoseealong-runpartitioning for any gossiping networkwhere N 2(C+1). However, the transientanalysiswillshowthatitusuallytakesalongtime for a network to partition. For the pull poli y, the right hand ongurationofFigure6(whi hisastartopologyin termsof[10℄), togetherwithotherstar ongurations,form a similar \trap", but this time with a very high indegree

6.2

Transient results

Figures 7-11showthe evolutionof thevaluesof the dif-ferent measuresovertime. A singletime unit orresponds to theexpe tedtimea node willtaketoexe ute itsa tive threadon e.

From Figures 7-9 we an see that the networks of size 5 stabilize fairly qui kly. Figures 10 and 11 look at the behaviorofnetworksofvaryingviewsizeandnetworksize, respe tively,underthe\winning"pull-pushstrategy. Here, we anseethat the shape of the fun tionfor the network of size 6 withview size 2 is dierent from the others: the indegreevarian eofthisnetwork(depi tedinFigure10)rst seeminglystabilizes,butthenslowlydropstowardszero. For the lustering oeÆ ient we seethesame ee t: at rst it appears to stabilize before it rises to 1 (as shown by the steady-stateanalysis). Bothee tsareduetothefa tthat the network will eventually rea h, with probability 1, the onguration of Figure 6 (left). It is also lear, however, thatonaverageittakesarelativelylongtimeforgossiping networkstorea hthisdegeneratestate.

0

0.5

1

1.5

2

2.5

3

0

2

4

6

8

10

12

14

16

Indegree variance

time

Indegree variance (5 nodes, view-size 2)

pull

push

pullpush

Figure7: Indegreevarian e graphfora5-node net-workwithview-size 2.

1.2

1.3

1.4

1.5

1.6

1.7

1.8

1.9

2

2.1

2.2

0

2

4

6

8

10

12

14

16

Average path length

time

Average path length (5 nodes, view-size 2)

pull

push

pullpush

Figure8: Averageshortest pathlength graph for a 5-node networkwithview-size2.

0.1

0.2

0.3

0.4

0.5

0.6

0.7

0.8

0.9

1

0

2

4

6

8

10

12

14

16

Clustering coefficient

time

Clustering coefficient (5 nodes, view-size 2)

pull

push

pullpush

Figure 9: Clustering oeÆ ient graph for a 5-node networkwithview-size2.

6.3

Traceability

Aninteresting aspe tofformalmethodsisthattheyare tra eable. This means that when we nd a modelwhi h behavesina spe i way we anas ertain why itbehaves insu ha way. We take as anexamplethe pull poli y for gossipingproto ols. In[10℄itisreasonedthatthisisapoor

0

0.5

1

1.5

2

0

10

20

30

40

50

60

70

Indegree variance

time

Indegree variance (6 nodes, view-size C)

N=6 C=2

N=6 C=3

N=6 C=4

Figure 10: Indegree varian e graph for networks withvaryingview-size withpull-push strategy.

0

0.2

0.4

0.6

0.8

1

0

10

20

30

40

50

60

70

Clustering coefficient

time

Clustering coefficient (N nodes, view-size 2)

N=4 C=2

N=5 C=2

N=6 C=2

Figure11: Clustering oeÆ ientgraphfornetworks withvaryingsizes withpull-push strategy.

ogy. Thishappenswhenanodehasnomorein ominglinks. No othernodethen onne ts toit, so noone an pull the identityofthisnode. Inotherwords,anewlinktothenode annotbeestablishedandthenodewillforeverhaveno in- ominglinks. With apushpoli ythisis notthe ase, asa node will pushitsownidentity to othernodes inthe net-work. Figure12(left)istheMRMgeneratedintheanalysis ofaGroovemodelofanetworkwithN=4andC=2using thepullpoli y. We an learlyseethedetrimentalbehavior of the pull proto ol. When the network rea hes the left-moststateit anneverleaveitagain. The\star"topology hereisformedbythe3totally onne tednodes(the enter ofthestar)andtheupper-leftnodewithnoin ominglinks (thesinglepointofthestar). In ontrast,theMRMmodel ofa4-nodenetworkusingthepushpoli y,depi tedonthe righthandside,doesnotshowanysinkstatesanddoesnot onvergetoastartopology.

7.

FUTURE WORK

Sin e this paper is meant as a rst exploration of the pra ti ality of using formal methods to analyze gossiping networksthereisalotofroomforfurtherresear h.

The use of sto hasti delays and dis rete probabilisti hoi ehasnotyetbeenformallyin orporatedintheCRL

=1:5 =0:5 =1:0 =0:5 =0:0 =1:5 =0:5 =1:0 =0:5 =0:0 2 2 3  1 3  1 2  1 3  2 3  1 3  2 3  1 6  1 6  1 3  3  1 3  1 3  2 2 3  1 3  1 3  1 2  2 3  1 3  1 3  2 3  1 3  1 6  1 2  3 

Figure 12: Lumped MRMs of a gossiping network with 4 nodes, view size 2 and pull (left-hand side) and push (right-hand side)poli y. The transmissionrateofea hnodeis. The rewardstru turerepresents the indegreevarian e of the gossiping network. The states arelabeled with graph ongurations (The bottom stateinfa trepresents twostateswithbisimilar behaviors butdierent graph ongurations).

elinggossiping networkswedonotforesee anymajor theo-reti aldiÆ ultiesinin orporatingsto hasti sinCRLand Groove. It is important to develop this theory further as thiswill alsoallowotherinterestingsto hasti systems be-sidesgossipingnetworkstobemodeledusingthesepowerful formalisms.

The design spa e for gossiping networks is quite large. In[10℄,variousstrategiesforpeersele tion,viewsele tionas wellasthedierentpeer-ex hangepoli ieshavebeen stud-ied. Inthefuture, we plantomodeland analyzegossiping networkswithpeerandviewsele tionstrategiesotherthan purelyrandomones.Thisrequiresustomodeltheageofthe linksinthegossipingnetworks. This anbeeasilymodeled usingthe omplexdatatypesofCRL,wherethesele tion strategiesareparameterizedbyapredi ate( f.Se tion4.2). However,ourinitialexperimentssoonpresentedanew hal-lenge,astheageofthelinksmaybeunbounded,leadingto innitemodels. Arstapproa htodealingwiththis prob-lemwould be toinvestigatethe me hanismusedina tual implementationsofgossipingnetworks. Anotherlogi al ap-proa histousesomeformofabstra tiontomodeltheage

ofthelinks.

Anotheraspe tofgossipingnetworksthatisvery impor-tant to investigate inthe futureis dynami ally appearing anddisappearingnodesas dis ussedin[10℄. Themodeling ofsystemsthat angrowlargerandsmallerovertimeis no-toriouslydiÆ ultwith lassi alpro essalgebras,butspe ial mobileformalismsexist,su hasthe- al ulus(see[13℄). In thegraphtransformation approa hofGroove,ontheother hand,itshouldbeeasytoin orporatethistypeofbehavior. Regardingthe typeofanalysis we havedone,with hind-sight we anobserve that the long-runvalues donot give interesting measures. Asdis ussedinSe tion6,we onje -turethatreal-lifenetworks,whosesizefarex eedstheview size, will always tend to partition, giving rise to atypi al long-runaverages. Itismoreinterestingtoinvestigate ques-tions of the type \how long will it take until the network partitionswithaprobabilityofx",wherethedesired prob-abilityxisaparameter. Ourmethodinprin ipleallows to answerthistypeofquestion.

Asexpe ted,we on ludethats alabilityisarealproblem whenformallymodelinggossipingnetworks. Modeling

net-workswithmorethatsixnodesturnsoutto bepra ti ally impossible using CRL. Although using Groove's in-built symmetry redu tion allows us to analyze larger networks thesizeofthemodelsstillgrowsexponentially,limitingthe approa h to 7 nodes. Furthermore the modeling of more advan ed ommuni ationproto ols with omplexpeerand viewsele tion strategieswould ausethemodelstobe ome evenlarger. It isthenobvioustolookforabstra tion te h-niquesto ounterthisstatespa eexplosion. Largenetworks ouldbeta kledbyonlymodelingasmallamountofnodes expli itly and modeling the rest of the nodes as a single entitybehavinga ordingtosomeaverageexpe ted behav-ior. Theproblem ofrepresentingtheage oflinks ouldbe handledwithaformofpredi ateabstra tion: insteadof de-notingtheagesofthelinksexpli itlythemodel ouldsimply listtheorderoftheages. Manyotherabstra tionte hniques areof ourse on eivable.

8.

CONCLUSION

Gossiping networks anbe analyzedusing formal meth-ods. Thestru tureof anetwork anbe apturedby using theabstra tdatatypesofCRL.Alternatively,the hanges inthe network an be aptured by the graph transforma-tionsof Groove, whi hmodelsthe networksimplyas a di-re tedgraph. Furthermore,the ombinationof on urrent, probabilisti andsto hasti behavior anbeinterpreted as a CTMC in the style of the MLotos pro ess algebra (see [9℄),althoughthetheorybehindthetransformationofCRL andGroovetolabeledCTMCsneedsfurtherresear h. The CRL and Groove models an then be interpreted as a CTMClabeledwithnetworkstru tures. By al ulating in-teresting graph-measures for these network stru tures we thenobtainMRM modelswhi h anbeanalyzedusingan extensiontoCSRL(see[1,11℄).

Itwasparti ularlyinteresting forustoobservethe devi-ationintheresultsthato ursfor networksofsize 6,with viewsize2,be ausewehadnotpredi tedorexpe tedthis. Theexplanationofthisphenomenon, viz.thatonthelong run,networkswitha ertainratioofsizetoviewsizetendto partition,impliesthatothertypesofanalysismaybe alled for.

Mu hresear h remainsto bedone inthisarea (see Se -tion7). Itisdesirable,butalso hallenging,tomodelmore advan edgossipingproto ols. Studyinglargernetworks,by meansofsomeformofabstra tionisalsoapromisingavenue ofresear h. Simplyabstra ting fromnode identities(thus only onsideringtheshapeofanetwork)byusingsymmetry redu tionwithGroovealreadyprovidedgreatredu tionsin statespa e size,butnotsuÆ ientfor s alability.

Themaindrawba ktothepre iseexpli itapproa histhe la k ofs alability. Inpra ti e,wewereonlyable to gener-atemodels ofup to6nodes using CRLor upto 7nodes usingGroove. However, the results found for these small models onrmthesimulationandemulationresultsfound in[10℄, suggestingthat small-s ale analysis anlead to in-sightsinthebehavioroflarge-s alenetworks. Furthermore, thetra eabilityofthemodels angiveadeeper understand-ingoftheemergentbehaviorofagossipingnetwork.

9.

REFERENCES

[1℄ C.Baier,B.Haverkort,H.Hermanns,andJ.-P. Katoen.Onthelogi al hara terisationof

performabilityproperties.InICALP,volume1853of LNCS,pages780{792,2000.

[2℄ R.Bakhshi,F.Bonnet,W.Fokkink,andB.Haverkort. Formalanalysiste hniquesforgossiping proto ols. ACM SIGOPSOper.Syst.Rev.,41(5):28{36,2007. [3℄ J.BergstraandJ.Klop.Pro essalgebrafor

syn hronous ommuni ation.Informationand Control,60(1):109{137,1984.

[4℄ S.Blom,W.Fokkink,J.F.Groote,I.vanLangevelde, B.Lisser,andJ.vandePol.CRL:Atoolsetfor analysing algebrai spe i ations.InCAV,volume 2102 ofLNCS,pages250{254,2001.

[5℄ A.Demers,D.Greene,C.Hauser,W.Irish,J.Larson, S.Shenker,H.Sturgis,D.C.Swinehart,andD.B. Terry.Epidemi algorithmsforrepli ateddatabase maintenan e.ACM SIGOPSOper.Syst.Rev., 22(1):8{32, 1988.

[6℄ P.Eugster,R.Guerraoui,A.-M.Kermarre ,and L. Massouliea ute.Epidemi information

disseminationindistributedsystems.IEEE Computer, 37(5):60{67, 2004.

[7℄ H.GaravelandH.Hermanns.On ombining fun tionalveri ationandperforman eevaluation usingCADP.InL.-H.ErikssonandP.Lindsay, editors, FME,volume2391ofLNCS,pages410{429. Springer,2002.

[8℄ B.Haverkort.Markovianmodelsforperforman eand dependabilityevaluation.InEuroSummerS hoolon TrendsinComputer S ien e,volume2090ofLNCS, pages38{83,2000.

[9℄ H.HermannsandM.Rettelba h.Towards asuperset ofbasi LOTOSforperforman e predi tion.In PAPM,1996.

[10℄ M. Jelasity,S.Voulgaris,R.Guerraoui,A.-M. Kermarre ,andM.vanSteen.Gossip-basedpeer sampling.ACMTrans.Comput. Syst.,25(3):8,2007. [11℄ M. Kwiatkowska,G.Norman,andD.Parker.

Sto hasti model he king.InSFM-07:PE,volume 4486 ofLNCS(TutorialVolume),pages220{270. Springer,2007.

[12℄ R.Matees uandH.Garavel.XTL:Ameta-language andtoolfortemporallogi model- he king.InSTTT, volumeNS-98-4ofBRICSNotesSeries,1998. [13℄ R.Milner.Communi atingandMobileSystems;The

PiCal ulus.CambridgeUniversityPress,1999. [14℄ X.Ni ollinandJ.Sifakis.Anoverviewandsynthesis

ontimedpro essalgebras.InCAV,volume575of LNCS,pages376{398,1991.

[15℄ A.Rensink.TheGROOVEsimulator: Atoolforstate spa egeneration.InAGTIVE,volume3062ofLNCS, pages479{485,2004.

[16℄ A.Rensink.Isomorphism he kinginGROOVE.In A.ZundorfandD.Varro,editors,Graph-BasedTools (GraBaTs),Natal,Brazil, volume1ofEle troni Communi ationsof theEASST,September2007. [17℄ W.Vogels,R.vanRenesse,andK.Birman.The

powerofepidemi s: robust ommuni ationfor large-s aledistributedsystems.ACMSIGCOMM