Sylvain Hallé's Homepage

An "event stream" is anything that is formed of a sequence of data elements; for example, it can be produced from sensors, through logging instructions inserted inside a running program, or by many other kinds of systems. I develop theory and software related to the processing of these streams. This can be used for automated testing, realtime analytics, pattern detection. Most of my work is accomplished through BeepBeep, an open source Java library that I have been developing for many years, and which has been applied to dozens of use cases. I even published a (free) textbook on the subject.

I am interested in two elements of Computer Security. The first is the detection of suspicious behavior or attacks, which can be done by observing events produced by the system; for example, I have applied stream processing to detect policy violations in Java programs. The second element is the protection of a log (or any other document) from retroactive manipulations of its history --that is, preventing someone from rewriting the past. I have developed Artichoke-X, a system that uses blockchains (yes, blockchains) to do so. I applied this theory to enforce lifecycle constraints on PDF documents without the need for a centralized trusted authority (EDOC 2016 Best Paper Award).

Testing a piece of software is often seen as a manual task. There are two ways one can help testers automate part of their work. First, one can develop what are called "oracles", which can determine by themselves whether a system passes or fails a test; for example, I developed a system called Cornipickle that can automatically spot UI bugs in web pages (ICST 2015 Best Tool Award). Second, one can develop tools that generate test cases by themselves. On this side, I am interested in techniques to generate sequences of interactions; this is supported by the SealTest library, on which lots of works remains to be done.

I call "traceability" the process of relating the outputs produced by a computation to the inputs that were given to it. For example, if one processes a file to produce a series of values, traceability would allow to determine what part of the file has contributed to what part of the output. It can prove an excellent way to understand how a piece of software produces its results. One application of this concept is to scientific reproducibility. My main contribution in this topic is the development of LabPal, a library that helps researchers design, process and package experiments that run on a computer. One feature of LabPal is precisely its built-in "provenance" constructs, as is illustrated in this YouTube video.