# Architecting software monitors for control-flow anomaly detection through large language models and conformance checking

arXiv: https://arxiv.org/abs/2511.10876 · HTML: https://mlsanity.com/paper/2511.10876/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 12 of its 54 references that are in the map.
- First posted on arXiv 14 Nov 2025.

## Builds on (most cited first, 12 of 12)

- [SWE-bench: Can Language Models Resolve Real-World GitHub Issues?](https://mlsanity.com/paper/2310.06770/) (2023)
- [The Effect of Sampling Temperature on Problem Solving in Large Language Models](https://mlsanity.com/paper/2402.05201/) (2024)
- [Exploring the Impact of Temperature on Large Language Models:Hot or Cold?](https://mlsanity.com/paper/2506.07295/) (2025)
- [LogGPT: Log Anomaly Detection via GPT](https://mlsanity.com/paper/2309.14482/) (2023)
- [Unsupervised Anomaly Detectors to Detect Intrusions in the Current Threat Landscape](https://mlsanity.com/paper/2012.11354/) (2020)
- [Control-flow anomaly detection by process mining-based feature extraction and dimensionality reduction](https://mlsanity.com/paper/2502.10211/) (2025)
- [Log Statements Generation via Deep Learning: Widening the Support Provided to Developers](https://mlsanity.com/paper/2311.04587/) (2023)
- [From Model Checking to Runtime Verification and Back](https://mlsanity.com/paper/1805.12428/) (2018)
- [PREVENT: An Unsupervised Approach to Predict Software Failures in Production](https://mlsanity.com/paper/2208.11939/) (2022)
- [White-box validation of quantitative product lines by statistical model checking and process mining](https://mlsanity.com/paper/2401.13019/) (2024)
- [Scalable Online Conformance Checking Using Incremental Prefix-Alignment Computation](https://mlsanity.com/paper/2101.00958/) (2020)
- [Data-driven Mutation Analysis for Cyber-Physical Systems](https://mlsanity.com/paper/2201.10160/) (2022)

## Abstract (arXiv)

Context: Ensuring high levels of dependability in modern computer-based systems has become increasingly challenging due to their complexity. Although systems are validated at design time, their behavior can be different at runtime, possibly showing control-flow anomalies due to ``unknown unknowns''. Objective: We aim to detect control-flow anomalies through software monitoring, which verifies runtime behavior by logging software execution and detecting deviations from expected control flow. Methods: We propose a methodology to develop software monitors for control-flow anomaly detection through Large Language Models (LLMs) and conformance checking. The methodology builds on existing software development practices to maintain traditional V&V while providing an additional level of robustness and trustworthiness. It leverages LLMs to link design-time models and implementation code, automating source-code instrumentation. The resulting event logs are analyzed via conformance checking, an explainable and effective technique for control-flow anomaly detection. Results: We test the methodology on a case-study scenario from the European Railway Traffic Management System / European Train Control System (ERTMS/ETCS), which is a railway standard for modern interoperable railways. The results obtained from the ERTMS/ETCS case study demonstrate that LLM-based source-code instrumentation can achieve up to 82.849% control-flow coverage of the reference design-time process model, while the subsequent conformance checking-based anomaly detection reaches a peak performance of 95.957% F1-score and 93.669% AUC. Conclusion: Incorporating domain-specific knowledge to guide LLMs in source-code instrumentation significantly allowed obtaining reliable and quality software logs and enabled effective control-flow anomaly detection through conformance checking.