{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,19]],"date-time":"2026-04-19T06:40:49Z","timestamp":1776580849000,"version":"3.51.2"},"reference-count":63,"publisher":"Elsevier BV","license":[{"start":{"date-parts":[[2026,7,1]],"date-time":"2026-07-01T00:00:00Z","timestamp":1782864000000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/tdm\/userlicense\/1.0\/"},{"start":{"date-parts":[[2026,7,1]],"date-time":"2026-07-01T00:00:00Z","timestamp":1782864000000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/legal\/tdmrep-license"},{"start":{"date-parts":[[2026,3,24]],"date-time":"2026-03-24T00:00:00Z","timestamp":1774310400000},"content-version":"vor","delay-in-days":0,"URL":"http:\/\/creativecommons.org\/licenses\/by-nc-nd\/4.0\/"}],"funder":[{"DOI":"10.13039\/501100000780","name":"European Commission","doi-asserted-by":"publisher","award":["E63C22000980007"],"award-info":[{"award-number":["E63C22000980007"]}],"id":[{"id":"10.13039\/501100000780","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/100004152","name":"Spine Education and Research Institute","doi-asserted-by":"publisher","id":[{"id":"10.13039\/100004152","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100007352","name":"Staatssekretariat f\u00fcr Bildung, Forschung und Innovation","doi-asserted-by":"publisher","id":[{"id":"10.13039\/501100007352","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["elsevier.com","sciencedirect.com"],"crossmark-restriction":true},"short-container-title":["Information and Software Technology"],"published-print":{"date-parts":[[2026,7]]},"DOI":"10.1016\/j.infsof.2026.108133","type":"journal-article","created":{"date-parts":[[2026,3,24]],"date-time":"2026-03-24T17:17:46Z","timestamp":1774372666000},"page":"108133","update-policy":"https:\/\/doi.org\/10.1016\/elsevier_cm_policy","source":"Crossref","is-referenced-by-count":0,"special_numbering":"C","title":["Architecting software monitors for control-flow anomaly detection through large language models and conformance checking"],"prefix":"10.1016","volume":"195","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-2325-0056","authenticated-orcid":false,"given":"Francesco","family":"Vitale","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-2833-7196","authenticated-orcid":false,"given":"Francesco","family":"Flammini","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-6981-0966","authenticated-orcid":false,"given":"Mauro","family":"Caporuscio","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-0401-9687","authenticated-orcid":false,"given":"Nicola","family":"Mazzocca","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"78","reference":[{"key":"10.1016\/j.infsof.2026.108133_b1","doi-asserted-by":"crossref","first-page":"605","DOI":"10.1109\/TSE.2015.2510001","article-title":"A game-theoretic foundation for the maximum software resilience against dense errors","volume":"42","author":"Huang","year":"2016","journal-title":"IEEE Trans. Softw. Eng."},{"key":"10.1016\/j.infsof.2026.108133_b2","doi-asserted-by":"crossref","DOI":"10.1016\/j.engappai.2023.106478","article-title":"Rational software agents with the BDI reasoning model for Cyber\u2013Physical Systems","volume":"123","author":"Karaduman","year":"2023","journal-title":"Eng. Appl. Artif. Intell."},{"key":"10.1016\/j.infsof.2026.108133_b3","doi-asserted-by":"crossref","first-page":"2182","DOI":"10.1109\/TSE.2022.3213041","article-title":"Data-driven mutation analysis for cyber-physical systems","volume":"49","author":"Vigan\u00f2","year":"2022","journal-title":"IEEE Trans. Softw. Eng."},{"key":"10.1016\/j.infsof.2026.108133_b4","doi-asserted-by":"crossref","DOI":"10.1002\/stvr.1835","article-title":"RATE: A model-based testing approach that combines model refinement and test execution","volume":"33","author":"Bombarda","year":"2023","journal-title":"Softw. Test. Verif. Reliab."},{"key":"10.1016\/j.infsof.2026.108133_b5","doi-asserted-by":"crossref","DOI":"10.1016\/j.jss.2024.111983","article-title":"White-box validation of quantitative product lines by statistical model checking and process mining","volume":"210","author":"Casaluce","year":"2024","journal-title":"J. Syst. Softw."},{"key":"10.1016\/j.infsof.2026.108133_b6","doi-asserted-by":"crossref","first-page":"344","DOI":"10.1016\/j.jss.2016.05.038","article-title":"Achieving resilience in distributed software systems via self-reconfiguration","volume":"122","author":"Pradhan","year":"2016","journal-title":"J. Syst. Softw."},{"key":"10.1016\/j.infsof.2026.108133_b7","doi-asserted-by":"crossref","DOI":"10.1016\/j.jss.2023.111726","article-title":"An empirical study of software architecture resilience evaluation methods","volume":"202","author":"Pan","year":"2023","journal-title":"J. Syst. Softw."},{"key":"10.1016\/j.infsof.2026.108133_b8","doi-asserted-by":"crossref","first-page":"1665","DOI":"10.1109\/TR.2016.2570564","article-title":"Characterizing Direct Monitoring Techniques in Software Systems","volume":"65","author":"Cinque","year":"2016","journal-title":"IEEE Trans. Reliab."},{"key":"10.1016\/j.infsof.2026.108133_b9","doi-asserted-by":"crossref","first-page":"902","DOI":"10.1109\/TSE.2022.3166924","article-title":"Logging Practices in Software Engineering: A Systematic Mapping Study","volume":"49","author":"Gu","year":"2023","journal-title":"IEEE Trans. Softw. Eng."},{"key":"10.1016\/j.infsof.2026.108133_b10","doi-asserted-by":"crossref","DOI":"10.1016\/j.knosys.2025.112970","article-title":"Control-flow anomaly detection by process mining-based feature extraction and dimensionality reduction","volume":"310","author":"Vitale","year":"2025","journal-title":"Knowl.-Based Syst."},{"key":"10.1016\/j.infsof.2026.108133_b11","doi-asserted-by":"crossref","first-page":"806","DOI":"10.1109\/TSE.2012.67","article-title":"Event Logs for the Analysis of Software Failures: A Rule-Based Approach","volume":"39","author":"Cinque","year":"2013","journal-title":"IEEE Trans. Softw. Eng."},{"key":"10.1016\/j.infsof.2026.108133_b12","series-title":"Runtime Verification: 17th International Conference, RV 2017, Seattle, WA, USA, September 13-16, 2017, Proceedings 17","first-page":"225","article-title":"From model checking to runtime verification and back","author":"Kejstov\u00e1","year":"2017"},{"key":"10.1016\/j.infsof.2026.108133_b13","series-title":"Runtime Verification","first-page":"382","article-title":"NuRV: A nuXmv Extension for Runtime Verification","author":"Cimatti","year":"2019"},{"key":"10.1016\/j.infsof.2026.108133_b14","doi-asserted-by":"crossref","first-page":"100","DOI":"10.1109\/TSE.2018.2859926","article-title":"On the Understandability of Temporal Properties Formalized in Linear Temporal Logic, Property Specification Patterns and Event Processing Language","volume":"46","author":"Czepa","year":"2020","journal-title":"IEEE Trans. Softw. Eng."},{"key":"10.1016\/j.infsof.2026.108133_b15","series-title":"Software Engineering and Formal Methods","first-page":"70","article-title":"Exploiting Assumptions for Effective Monitoring of Real-Time Properties Under Partial Observability","author":"Cimatti","year":"2025"},{"issue":"8","key":"10.1016\/j.infsof.2026.108133_b16","doi-asserted-by":"crossref","first-page":"1511","DOI":"10.1007\/s10270-022-01000-5","article-title":"Consistency management in industrial continuous model-based development settings: a reality check","volume":"21","author":"Jongeling","year":"2022","journal-title":"Softw. Syst. Model."},{"key":"10.1016\/j.infsof.2026.108133_b17","series-title":"Proceedings of the 21st ACM\/IEEE International Conference on Model Driven Engineering Languages and Systems: Companion Proceedings","first-page":"192","article-title":"Tolerant consistency management in model-driven engineering","author":"Weidmann","year":"2018"},{"key":"10.1016\/j.infsof.2026.108133_b18","series-title":"2019 ACM\/IEEE 22nd International Conference on Model Driven Engineering Languages and Systems Companion (MODELS-C)","first-page":"278","article-title":"Multifaceted consistency checking of collaborative engineering artifacts","author":"Tr\u00f6ls","year":"2019"},{"key":"10.1016\/j.infsof.2026.108133_b19","doi-asserted-by":"crossref","DOI":"10.1007\/s41060-025-00796-x","article-title":"Chasing Unknown Unknowns with the Available Data","author":"Sinclair-Desgagn\u00e9","year":"2025","journal-title":"Int. J. Data Sci. Anal."},{"issue":"1","key":"10.1016\/j.infsof.2026.108133_b20","doi-asserted-by":"crossref","first-page":"80","DOI":"10.1109\/TSE.2011.124","article-title":"On Fault Representativeness of Software Fault Injection","volume":"39","author":"Natella","year":"2013","journal-title":"IEEE Trans. Softw. Eng."},{"key":"10.1016\/j.infsof.2026.108133_b21","series-title":"The Proceedings of the 2023 Conference on Systems Engineering Research","first-page":"691","article-title":"Literature Review and Research Design for Systems Integration: Case Study in Defense Systems","author":"Tetlie","year":"2024"},{"key":"10.1016\/j.infsof.2026.108133_b22","series-title":"2024 IEEE Aerospace Conference","first-page":"1","article-title":"Historical Aerospace Software Errors Categorized to Influence Fault Tolerance","author":"Prokop","year":"2024"},{"key":"10.1016\/j.infsof.2026.108133_b23","doi-asserted-by":"crossref","first-page":"826","DOI":"10.1109\/TSMC.2016.2521840","article-title":"Fuzzy Rule-Based Approach for Software Fault Prediction","volume":"47","author":"Singh","year":"2017","journal-title":"IEEE Trans. Syst. Man, Cybern.: Syst."},{"key":"10.1016\/j.infsof.2026.108133_b24","series-title":"Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security","first-page":"1285","article-title":"DeepLog: Anomaly Detection and Diagnosis from System Logs through Deep Learning","author":"Du","year":"2017"},{"key":"10.1016\/j.infsof.2026.108133_b25","doi-asserted-by":"crossref","first-page":"5139","DOI":"10.1109\/TSE.2023.3327583","article-title":"Prevent: An Unsupervised Approach to Predict Software Failures in Production","volume":"49","author":"Denaro","year":"2023","journal-title":"IEEE Trans. Softw. Eng."},{"key":"10.1016\/j.infsof.2026.108133_b26","series-title":"2023 IEEE International Conference on Big Data (BigData)","first-page":"1117","article-title":"LogGPT: Log Anomaly Detection via GPT","author":"Han","year":"2023"},{"key":"10.1016\/j.infsof.2026.108133_b27","doi-asserted-by":"crossref","first-page":"2745","DOI":"10.1109\/TKDE.2023.3322411","article-title":"WAKE: A Weakly Supervised Business Process Anomaly Detection Framework via a Pre-Trained Autoencoder","volume":"36","author":"Guan","year":"2024","journal-title":"IEEE Trans. Knowl. Data Eng."},{"key":"10.1016\/j.infsof.2026.108133_b28","doi-asserted-by":"crossref","DOI":"10.1016\/j.knosys.2025.114064","article-title":"LLM-LADE: Large language model-based log anomaly detection with explanation","volume":"326","author":"Zhang","year":"2025","journal-title":"Knowl.-Based Syst."},{"key":"10.1016\/j.infsof.2026.108133_b29","doi-asserted-by":"crossref","first-page":"852","DOI":"10.1109\/TAI.2021.3133846","article-title":"Recent Advances in Trustworthy Explainable Artificial Intelligence: Status, Challenges, and Perspectives","volume":"3","author":"Rawal","year":"2022","journal-title":"IEEE Trans. Artif. Intell."},{"key":"10.1016\/j.infsof.2026.108133_b30","series-title":"A Code Comprehension Benchmark for Large Language Models for Code","author":"Havare","year":"2025"},{"key":"10.1016\/j.infsof.2026.108133_b31","doi-asserted-by":"crossref","first-page":"511","DOI":"10.1007\/s12599-021-00720-0","article-title":"Opportunities and challenges for process mining in organizations: results of a Delphi study","volume":"63","author":"Martin","year":"2021","journal-title":"Bus. Inf. Syst. Eng."},{"key":"10.1016\/j.infsof.2026.108133_b32","first-page":"1","article-title":"What makes life for process mining analysts difficult? A reflection of challenges","author":"Zimmermann","year":"2023","journal-title":"Softw. Syst. Model."},{"key":"10.1016\/j.infsof.2026.108133_b33","first-page":"1","article-title":"Process Mining Success Factors and Their Interrelationships","author":"Mamudu","year":"2024","journal-title":"Bus. Inf. Syst. Eng."},{"key":"10.1016\/j.infsof.2026.108133_b34","first-page":"81","article-title":"European Rail Traffic Management System (ERTMS): Supporting competition on the European rail network?","volume":"6","author":"Laroche","year":"2013","journal-title":"Res. Transp. Bus. Manag."},{"key":"10.1016\/j.infsof.2026.108133_b35","series-title":"Report on Railway Safety and Interoperability in the EU 2024","author":"European Union Agency for Railways","year":"2024"},{"key":"10.1016\/j.infsof.2026.108133_b36","series-title":"Proceedings of the 22nd International Systems and Software Product Line Conference - Volume 1","first-page":"208","article-title":"Product line models of large cyber-physical systems: the case of ERTMS\/ETCS","author":"Beek","year":"2018"},{"key":"10.1016\/j.infsof.2026.108133_b37","doi-asserted-by":"crossref","first-page":"642","DOI":"10.1109\/TSE.2006.96","article-title":"Toward the Reverse Engineering of UML Sequence Diagrams for Distributed Java Software","volume":"32","author":"Briand","year":"2006","journal-title":"IEEE Trans. Softw. Eng."},{"key":"10.1016\/j.infsof.2026.108133_b38","doi-asserted-by":"crossref","first-page":"143","DOI":"10.1007\/s11219-013-9220-4","article-title":"A declarative approach for Java code instrumentation","volume":"23","author":"Zhang","year":"2015","journal-title":"Softw. Qual. J."},{"key":"10.1016\/j.infsof.2026.108133_b39","series-title":"2018 IEEE 25th International Conference on Software Analysis, Evolution and Reengineering","first-page":"61","article-title":"SMARTLOG: Place error log statement by deep understanding of log intention","author":"Jia","year":"2018"},{"key":"10.1016\/j.infsof.2026.108133_b40","series-title":"2019 15th European Dependable Computing Conference","first-page":"137","article-title":"Discovering Hidden Errors from Application Log Traces with Process Mining","author":"Cinque","year":"2019"},{"key":"10.1016\/j.infsof.2026.108133_b41","doi-asserted-by":"crossref","DOI":"10.1016\/j.knosys.2019.105054","article-title":"Discovering process models for the analysis of application failures under uncertainty of event logs","volume":"189","author":"Pecchia","year":"2020","journal-title":"Knowl.-Based Syst."},{"key":"10.1016\/j.infsof.2026.108133_b42","series-title":"Proceedings of the 16th ACM SIGPLAN\/SIGOPS International Conference on Virtual Execution Environments","first-page":"172","article-title":"Instrew: leveraging LLVM for high performance dynamic binary instrumentation","author":"Engelke","year":"2020"},{"key":"10.1016\/j.infsof.2026.108133_b43","doi-asserted-by":"crossref","DOI":"10.1016\/j.jss.2023.111947","article-title":"Log statements generation via deep learning: Widening the support provided to developers","volume":"210","author":"Mastropaolo","year":"2024","journal-title":"J. Syst. Softw."},{"key":"10.1016\/j.infsof.2026.108133_b44","doi-asserted-by":"crossref","first-page":"213260","DOI":"10.1109\/ACCESS.2025.3645237","article-title":"Automated Logging With Large Language Models: Eliminating Task-Specific Pretraining","volume":"13","author":"Wang","year":"2025","journal-title":"IEEE Access"},{"key":"10.1016\/j.infsof.2026.108133_b45","doi-asserted-by":"crossref","DOI":"10.1016\/j.jss.2025.112739","article-title":"FlexInstru: A flexible instrumentation framework for tracing long-running native workloads","volume":"234","author":"Mu","year":"2026","journal-title":"J. Syst. Softw."},{"key":"10.1016\/j.infsof.2026.108133_b46","series-title":"Process Mining Handbook","author":"van der Aalst","year":"2022"},{"key":"10.1016\/j.infsof.2026.108133_b47","doi-asserted-by":"crossref","DOI":"10.1145\/3441140","article-title":"Unsupervised Anomaly Detectors to Detect Intrusions in the Current Threat Landscape","volume":"2","author":"Zoppi","year":"2021","journal-title":"ACM\/IMS Trans. Data Sci."},{"key":"10.1016\/j.infsof.2026.108133_b48","series-title":"International Conference on Service-Oriented Computing","first-page":"379","article-title":"Scalable online conformance checking using incremental prefix-alignment computation","author":"Schuster","year":"2020"},{"key":"10.1016\/j.infsof.2026.108133_b49","series-title":"Software and Systems Engineering \u2013 Software Testing","author":"ISO\/IEC\/IEEE","year":"2022"},{"issue":"4","key":"10.1016\/j.infsof.2026.108133_b50","doi-asserted-by":"crossref","first-page":"3431","DOI":"10.1109\/TDSC.2025.3532340","article-title":"FaultFlow: An MDE Library for Dependability Evaluation of Component-Based Systems","volume":"22","author":"Carnevali","year":"2025","journal-title":"IEEE Trans. Dependable Secur. Comput."},{"key":"10.1016\/j.infsof.2026.108133_b51","series-title":"Implicit Chain of Thought Reasoning via Knowledge Distillation","author":"Deng","year":"2023"},{"key":"10.1016\/j.infsof.2026.108133_b52","series-title":"Chain-of-Thought Reasoning Without Prompting","author":"Wang","year":"2024"},{"key":"10.1016\/j.infsof.2026.108133_b53","unstructured":"Google DeepMind, Gemini 3 Pro Model Card, Google Deep Mind Technical Reports, 2025, URL https:\/\/storage.googleapis.com\/deepmind-media\/Model-Cards\/Gemini-3-Pro-Model-Card.pdf. (Accessed on 24 March 2026)."},{"key":"10.1016\/j.infsof.2026.108133_b54","series-title":"Claude Sonnet 4.5 System Card","author":"Anthropic","year":"2025"},{"key":"10.1016\/j.infsof.2026.108133_b55","series-title":"International Conference on Learning Representations","article-title":"SWE-bench: Can Language Models Resolve Real-world Github Issues?","author":"Jimenez","year":"2024"},{"key":"10.1016\/j.infsof.2026.108133_b56","doi-asserted-by":"crossref","first-page":"242","DOI":"10.1016\/j.procs.2025.07.135","article-title":"Exploring the Impact of Temperature on Large Language Models: Hot or Cold?","volume":"264","author":"Li","year":"2025","journal-title":"Procedia Comput. Sci."},{"key":"10.1016\/j.infsof.2026.108133_b57","series-title":"Findings of the Association for Computational Linguistics: EMNLP 2024","first-page":"7346","article-title":"The Effect of Sampling Temperature on Problem Solving in Large Language Models","author":"Renze","year":"2024"},{"issue":"11","key":"10.1016\/j.infsof.2026.108133_b58","doi-asserted-by":"crossref","first-page":"849","DOI":"10.1109\/TSE.2006.113","article-title":"Emulation of Software Faults: A Field Data Study and a Practical Approach","volume":"32","author":"Dur\u00e3es","year":"2006","journal-title":"IEEE Trans. Softw. Eng."},{"key":"10.1016\/j.infsof.2026.108133_b59","doi-asserted-by":"crossref","DOI":"10.1145\/3068335","article-title":"DBSCAN Revisited, Revisited: Why and How You Should (Still) Use DBSCAN","volume":"42","author":"Schubert","year":"2017","journal-title":"ACM Trans. Database Syst."},{"key":"10.1016\/j.infsof.2026.108133_b60","series-title":"Proceedings of the MLSDA 2014 2nd Workshop on Machine Learning for Sensory Data Analysis","first-page":"4","article-title":"Anomaly Detection Using Autoencoders with Nonlinear Dimensionality Reduction","author":"Sakurada","year":"2014"},{"key":"10.1016\/j.infsof.2026.108133_b61","series-title":"Experimentation in Software Engineering","author":"Wohlin","year":"2012"},{"issue":"2207","key":"10.1016\/j.infsof.2026.108133_b62","doi-asserted-by":"crossref","DOI":"10.1098\/rsta.2020.0369","article-title":"Digital twins as run-time predictive models for the resilience of cyber-physical systems: a conceptual framework","volume":"379","author":"Flammini","year":"2021","journal-title":"Phil. Trans. R. Soc. A"},{"issue":"12","key":"10.1016\/j.infsof.2026.108133_b63","doi-asserted-by":"crossref","first-page":"11553","DOI":"10.1109\/TII.2023.3246983","article-title":"Digital Twins for Anomaly Detection in the Industrial Internet of Things: Conceptual Architecture and Proof-of-Concept","volume":"19","author":"De Benedictis","year":"2023","journal-title":"IEEE Trans. Ind. Inform."}],"container-title":["Information and Software Technology"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S0950584926001229?httpAccept=text\/xml","content-type":"text\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S0950584926001229?httpAccept=text\/plain","content-type":"text\/plain","content-version":"vor","intended-application":"text-mining"}],"deposited":{"date-parts":[[2026,4,19]],"date-time":"2026-04-19T05:46:04Z","timestamp":1776577564000},"score":1,"resource":{"primary":{"URL":"https:\/\/linkinghub.elsevier.com\/retrieve\/pii\/S0950584926001229"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,7]]},"references-count":63,"alternative-id":["S0950584926001229"],"URL":"https:\/\/doi.org\/10.1016\/j.infsof.2026.108133","relation":{},"ISSN":["0950-5849"],"issn-type":[{"value":"0950-5849","type":"print"}],"subject":[],"published":{"date-parts":[[2026,7]]},"assertion":[{"value":"Elsevier","name":"publisher","label":"This article is maintained by"},{"value":"Architecting software monitors for control-flow anomaly detection through large language models and conformance checking","name":"articletitle","label":"Article Title"},{"value":"Information and Software Technology","name":"journaltitle","label":"Journal Title"},{"value":"https:\/\/doi.org\/10.1016\/j.infsof.2026.108133","name":"articlelink","label":"CrossRef DOI link to publisher maintained version"},{"value":"article","name":"content_type","label":"Content Type"},{"value":"\u00a9 2026 The Authors. Published by Elsevier B.V.","name":"copyright","label":"Copyright"}],"article-number":"108133"}}