DEVS State Sequence Analysis Toolkit (SSAT)

Overview

The Discrete Event System Specification (DEVS) -- State Sequence Analysis Toolkit (SSAT) is a research and development project aimed at detecting anomalous behaviours in complex control systems modelled with DEVS (Discrete Event System Specification).

Real-world DEVS-modelled systems produce massive logs of state transitions and message passing. Currently, fault detection requires manual expert oversight. This approach is infeasible at scale.

DEVS-SSAT proposes an unsupervised learning framework that:

• Translates DEVS logs into sequences
• Identifies behaviours by clustering subsequences
• Detects anomalous patterns or outliers
• Supports and directs analyst review of execution logs
• Future plans to expand to online fault monitoring

---

Problem Statement

• Faults in DEVS systems are hard to detect due to scale and complexity.
• Manual log parsing is not scalable.
• Logs are often unlabeled, making supervised ML approaches unsuitable.
• Need for an interpretable, unsupervised framework that can automatically:
  • Highlight faulty sequences
  • Explain why they were flagged
  • Support root cause analysis (RCA)
• Future work:
  • Predict faults earlier (i.e. before they happen)
  • Online monitoring (displaying status or fault prediction)
  • Add hooks to perform preventative actions

---

Design of the Toolkit

The toolkit introduces a multi-stage pipeline:

1. Log Parsing & Time Series Generation

   • Parse DEVS logs
   • Convert into a time series

2. Subsequence Partitioning

   • Split full system runs into logical subsequences (e.g., takeoff, hover, landing)
   • Initially relies on expert-provided rules, with future work exploring automatic partitioning

3. Sequence Similarity & Distance Matrix

   • Use categorical Hamming Dynamic Time Warping (DTW) to measure similarity between sequences
   • Treat state IDs as unordered labels: aligned states either match or differ, regardless of their numeric IDs
   • Generate a distance matrix

4. Behavior Clustering

   • Cluster subsequences into “behaviours” (e.g., normal vs faulty landing)
   • Initial clustering via K-Means
   • Future: hierarchical clustering, metric learning, generative models

5. Anomaly Detection

   • Even within valid behaviours, small deviations may signal faults
   • Apply anomaly detection methods such as:
     • Elliptic Envelope
     • Isolation Forest
   • Goal: Catch both gross behavioural faults and fine-grained anomalies

---

System Architecture

---

Acknowledgements

This work was funded and supported by the National Research Council of Canada (NRC). The authors gratefully acknowledge the NRC for providing the resources, expertise, and institutional support that made this research possible. This project was directly motivated by practical challenges encountered in real-world DEVS-modelled systems. Their collaboration was instrumental in shaping both the direction and the relevance of this toolkit.

---

License

This project is licensed under the MIT License — see the LICENSE file for details.

© His Majesty the King in right of Canada (2026)