A Formal Technique for Composing Cloud Services

Recent cloud search engines lack a formal method in their service composition mechanisms to automatically build composite services realizing user requirements. This paper prescribes behavior composition framework as a formal tools for the search engines. The framework automatically synthesizes a controller that delegates the service operations requested by a cloud user to the proper available cloud services whose operations satisfy the request. Since most cloud search engines support semantic and ontology to discover similar service operations, the paper extends the framework to be more adaptable with such search engines through the use of resource reasoning. Several experiments are provided to demonstrate how the extended framework outperforms the original one in terms of realizing users’ requirements.


Introduction
The tremendous increase in the number of cloud customers demanding their numerous requirements stimulates cloud providers to publish services with a great diversity of functional and non-functional properties.In many cases, a single service may not necessarily realize the requirements.Hence, the combination of several services as a composite service is created to fulfil them.
The architecture of cloud search engines recently benefit from the notions of semantic and ontology in order to offer a set of composite services being similar to customers' requirements.For instance, a dis-tributed architecture was designed for cloud service discovery in [26].The architecture benefits from a semantic Web technology using the Infrastructure and Network Description Language (INDL) and Standard Protocol and RDF Query Language (SPARQL) to exchange information among providers.In [13], a semantic based search engine architecture-called Cloudle-was proposed.It utilized a cloud ontology to measure the degree of similarity between customers' requirements and cloud services.The search engine leveraged an agent-based paradigm to build a test bed for service management.Furthermore, in light of de-veloping cloud search engine architectures, a model using semantic Web and quality of service (QoS) was presented in [20].It matches and composes cloud services for realizing customers' requirements.Although these approaches discover matchable or similar composites services for cloud customers, they integrate cloud services in an ad-hoc way and suffer from the lack of a formal method to automatically construct composite services.
Automatic service composition has lately become an interesting research area in both industrial and academic centres.Its purpose is the automatically determination of a strategy in order to compose available services realizing a desired service seen as user requirements [1,24].Current automated service composition approaches not only consider the functional specification of services, but also take into account the conversation specification of them through which the behavior of a service is described [8,15].Behavioral description of services consists of describing the order of invocation of service operations.To support such descriptions, services are represented by finite state machines, which in turn, facilitate their verification and lay a basis for their composition in an automatic way.
A promising automatic composition approach that acts as a formal tool for web or cloud service integration is behavior composition [9].This approach, first, constructs a framework in which both customer requirements, called target service, and available services are abstracted as finite state machines.Then, it provides a sound and complete technique for synthesizing a controller that delegates the operations of the target service to the proper available services being able to realize the target.The behavior composition framework generates composite services automatically.Its synthesis technique guarantees that all possible composite services realizing the target service are obtained.One of the shortcomings of this framework, however, is that its synthesized controller does not delegate the target service operations to the available services that their operations are similar to those in target.Hence, the framework only builds composite services whose operations have a fully match with the target service operations.Note that, two operations can be similar if they have different names but the same functionalities.This paper introduces a semantic-based framework for behavior composition in which similar operations to user requests can appear in composite services.The framework benefits from ontology and resource reasoning to semantically define service operations.Three kinds of reasoning methods, namely similarity, compatibility, and numerical reasoning are taken into account for calculating the degrees of match among operations.For the aim of providing a match making mechanism in the semantic-based framework, such degrees are used as references in the controller synthesis method proposed by the framework.The paper also gives come clues about the implementation of framework via model checking tools at hand: Symbolic Model Verifier (SMV) and Temporal Logic Verifier (TLV).
The rest of this paper is structured as follows.Section 2 reviews the related work.Section 3 briefly presents a background about the original behavior composition framework and the notion of resource reasoning.Section 4 proposes a semantic-based framework for behavior composition.The section also implements the framework by the model checking tools.Section 5 provides some experimental results to show the effects of resource reasoning on the realization of user requirements in the semantic-based behavior composition framework.Finally, Section 6 concludes the paper and gives some indications about future work.

Literature Review
In recent years, many contributions have been proposed for the problems of service composition and service discovery in the cloud and web.The strategies applied for such kind of problems can be classified into informal, semi-formal, and formal.
A brief review of some research using an informal strategy can be found in [42], which introduces the description of a Cloud-based Middleware for Service Composition, called CM4SC.In this approach, the middleware appears as a new layer between the application layer and the platform layer in the conventional cloud architecture to permit automatic composition planning and accelerate dynamic service composition.A flexible open source middleware has been proposed to support adaptive enactment of complex service composition in the cloud [16].It facilitates the deployment of a large number of composite services and provides the capability of runtime support for monitoring how they have been built.A semantic-based search engine, called Cloudle, that takes advantage of a cloud ontology to determine the measure of similarity between the user requirements and the available services, was devised for service composition and discovery [13].Consequently, an agent-based architecture showing how the Cloudle search engine is organized was put forward in [31].
Generally speaking, regardless of the advantages that such contributions may bring about, the correctness of service composition cannot be verified.
Usually the solutions exploiting a semi-formal strategy are subcategorized into syntactic-based and semantic-based methods.The methods in the first category are also decoupled with respect to the methods that integrate services with the aid of an orchestrator or a choreographer.For service orchestration, Business Process Execution Language (BPEL) is used to define an interoperable integration model [37,38].
For instance, a management-based adaptive and configurable service composition method was proposed in [37] with the aid of a development in BPEL, called as VxBPEL, to support variability in service compositions.For service choreography, Web Service Choreography Description Language (WS-CDL), 1 being an XML-based specification language is used for composing peer-to-peer, interoperable collaborations among participants.The methods in the second category include Ontology Language for Web Services (OWL-S) to define an ontology for the semantic markup of web services to enable service invocation and composition through supplying the proper semantic descriptions [12,19].Furthermore, Web Service Modelling Ontology (WSMO) 2 explicitly defines a conceptual model and also provides an ontology graph for the description of different aspects that are related to the semantic web services to solve the problem of service integration.A framework for automatic discovery, selection and composition of RESTful Web services which utilized linked open data was presented in [21].The framework applied RDF (Resource Description Framework) to represent the state of linked data services through which SPARQL (Standard Protocol and RDF Query Language) queries has been used to compose RESTful services.In general, there is no standard or a universal interfacing language that facilitates the composition of services written in different languages.
There are several solutions based on a formal strategy with theoretical models.Four of them, respectively based on transition systems with formal verification, proof system, process calculus, and AI planning are briefly presented.Such approaches ensure soundness, completeness or correctness of service composition.The first one aims to be applied in the domain of grid computing.A resource discovery approach to address multi-attribute queries is introduced [36].
The technique to get replies to queries are very fast and decreases the number of nodes examined during the resource discovery process.The proposed model for resource discovery has been decoupled into data gathering, discovery, and control to simplify the formal verification of properties expressed by CTL (computational tree logic) and LTL (linear temporal logic) formulas.The second one suggests to exploit the X-UNITY language for representing services in the cloud and a proof theory for proving temporal properties over service specifications needed for cloud applications [10].Moreover, a compositional proof-system was extended in [39] with a number of inference rules and proven system properties.The approach proposed a semantic formalization using SWSpec language in which the complexity of composing workflows was reduced.The third one includes a formal definition of composition in terms of a process calculus and also provides an implementation through the extension of the Jolie language [7].This approach was applied in the context of service-oriented architectures (SOAs).In the same spirit, a new model and verification mechanism that relies on a process calculus for orchestration of web services, which combined with UML, provides a solution for the problem of formal verification of cloud manufacturing services composition [43].Following that, a new extended process calculus for cloud manufacturing service composition was proposed [44].Through this contribution, six elements of quality of service have been evaluated.Furthermore, a formal schema of service composition and a BPEL code generation method have been provided.The fourth one proposes to exploit planning to optimize both composition and the underlying collection of information in order to obtain high-quality composite services in-line [34].In this solution, irrelevant actions, based on the user preferences, are eliminated to reduce the search space.An automatic service composition by using a HTN (Hierarchical Task Network) planner JSHOP2 (Java Simple Hierarchical Ordered Planner) was proposed in [35] which considered both functional and non-functional properties of services.
Although the correctness of service composition is guaranteed in the contributions based on a formal strategy, they still suffer from the lack of exploiting controller synthesis techniques for service composition.To this end, behavior composition can provide a sound and complete technique.More precisely, the problem of behavior composition has been widely studied in the areas of web services [5], verification [18], and even multi-agent systems [29].Among recent studies which are able to be applied in service-oriented computing, an automatic behavior composition synthesis framework is quite significant [9], as the authors have extensively investigated a particular type of behavior composition.In this framework, a specific controller is generated to coordinate the parallel execution of available services, so as to simulate a given target service with respect to constraints imposed on operations by an environment.A model without environment constraints, called Roman, was also introduced latter by the same research team [8].Furthermore, an effective procedure, computing realizable target fragment, has been developed in the case that a behavior composition problem is unsolvable [28,40].

Preliminaries
This section devotes a brief review to the original behavior composition framework and resource reasoning.

Behavior Composition
The main elements of behavior composition framework are available services 1 ,, n   , a target service t  , an environment  , and controller generator CG [9]. 3 The asynchronous product of available services makes a system S. Formally, the target service is defined as a tuple AA  is defined to indicate all available opera- tions in the system such that ts AA ⊆ .Given the target and system, an algorithm called as largest Nondeterministic-simulation (ND-simulation for short) is introduced to trigger the process of controller synthesis.Through the algorithm, at each step, a state from the system does not simulate the one in the target service is eliminated.This algorithm leads to an ND-simulation relation R in which the relation of σσ  →  →, where σ ∈Σ, and a CG history is a finite prefix of a CG trace.
Let CG  be the set of all histories on CG.A selection function is defined from the output function ω in order to select one service among those that are able to execute the current operation with respect to the last state of a given history.If CG contains the initial state 0 00 =, ts bs σ 〈〉 , and b t0 ≼ s s0 , then a set of controllers-called generated controllers, which are compositions of t  -can be extracted from CG.
For the purpose of controller synthesis with the aid of an available model checking tool, the approach based on the largest ND-simulation is replaced by the calculation of a winning strategy of a corresponding two players in a safety game [9].As depicted in Fig. 1, in such a game structure, one plays the role of the system and the other plays the role of the controller.The former keeps the information about the current state of the target service, available services, and environment, and at each step, releases an operation that must be ex-Information Technology and Control 2020/1/49

Figure 1
Two players of a safety game ecuted.The latter returns an index indicating which available service in the system is able to perform the requested operation.These data appear in two lines inside each state of the transition system in Fig. 1.The state init indicates an initial state.In this state, all available services and the target service are in their initial states, the current operation is empty and there is no controller reply, namely the index is zero.
The transition relations s ρ and c ρ represent system moves and controller replies, respectively.More precisely, ,, ,, , , , ,, ,,, , The reader is referred to [9] for the detailed proce-dure that shows how to derive a safety-game structure from a behavior composition problem.

Reasoning Based on Semantics
To provide a more flexible framework for behavior composition, a compatibility relation ≪ ⊆ A × A over the set of operations can be introduced.The relation substitutes for the present equality between operations in the definition of the largest ND-simulation relation proposed in [9] and the underlying algorithm that computes it.An operation a' can now be carried out by an available service, if it is compatible with the delegated operation a, that is, a≪a'.No more details were given about this issue by the authors.
The use of resource reasoning metrics constitutes a first appealing solution [2,31].It evaluates the degree Information Technology and Control 2020/1/49 10 of match between any two service operations.Generally, such metrics fit with a domain ontology graph, which has a well-formed structure to determine the multipaths connecting two concepts.Hence, the main effort must be concentrated on building ontologies.

Ontology and Resource Reasoning
Ontology is a representational artifact whose purpose is the exhibition of entities, defined classes, and relations between them [3].An ontology can offer meta-information to describe semantics of data and allows for building knowledge bases.Furthermore, it is a formal structure that supports the communication between a user and a computer agent [2].
The kinds of ontology are classified into domain ontology, reference ontology, top-level ontology, and application ontology [3].The intended class of ontology for better representation and classification of resources included in a specific system is the domain one.It provides a taxonomy with a hierarchical structure for such resources, considered as concepts, together with a set of axioms identifying several rules to show how the concepts and relations can be comprehended [3].A typical example is a cloud ontology which supplies a taxonomy for its computing resources [31].
Different kinds of relations can be defined between the concepts in a domain ontology.For instance, "isa", "part-of", "is-subtype-of", "is-member-of", "participates-in", "has-output", and "precedes" are some examples of such relations.A domain ontology is formally defined as follows.
Definition 1 [11].An ontology in a specific domain O is a tuple of ,, ,, C cR rA 〈≤ ≤ 〉 , where C is a set of con- cepts, R is a set of relations, ≤ c is a partial order on C that is called the concept hierarchy, ≤ r is a partial order on R that is called the relation hierarchy, and A is a set of axioms including rules in the logical forms to describe the relationships among the concepts. 4ased on a domain ontology, a graph, called an ontology graph, is drawn to demonstrate a taxonomy [2].In this graph, each concept is represented as a node and each edge indicates a relationship between two concepts.More precisely, each edge illustrates a relation such as "is-a" or "part-of".For example, Fig. 2 depicts a simple ontology graph for an online agency providing travel services.In this graph, the Travel agency services is considered as the root node having subnodes including Accommodation reservation, Transportation reservation, and Meal reservation.
In cloud computing, where service operations are defined semantically, the notion of resource reasoning is put forward, which includes similarity, compatibility, and numerical reasoning [31].In similarity reasoning, to measure the degree of similarity between two different concepts, several semantic similarity functions have been introduced.Among those proposed in [2,25,30], there is one that defines a function being compatible with a hierarchical structure of well-formed concepts that can be found in a domain ontology graph [2].In comparison to Jaccard [23], cosine [41], and Slimani [33] similarity measures' functions, Knappe in [2] defined a function that better considers path length, depth, and local density of an ontology graph [32].This function takes into account specialization or generalization of one concept with respect to another.
Definition 2 [2].The semantic similarity function where the constant determines the degree of influence of generalization 5 that depends on a hierarchical ontology; the parameter ρ permits to tai- lor the similarity function, and hence can conform to the generalization property.The term () x α is considered as the set of upward nodes reachable from x (including the node labeled by x), and the expression () () xy αα ∩ is the reachable common nodes between x and y.For instance, in Fig. 2 As indicated in Eq. 1, the semantic similarity function maps two concepts into the unit interval, and its output shows the degree of similarity between x and y.So, the value 0 means no similarity and 1 means full similarity.
Given the ontology graph and semantic similarity function, a square matrix (similarity matrix) of order n of similarities among concepts is constructed: where n is the number of concepts.It is important to note that each element in this matrix indicates a real number in [0,1] giving the degree of similarity between related concepts.Moreover, a threshold in the interval (0,1] is defined to accept the minimum measure of similarity between two concepts. The similarity reasoning was introduced to measure the degree of similarity for functional requirements with the aid of a semantic similarity function (see Def. 2).To calculate the degree of match for technical requirements in computing systems, both the compatibility and numerical reasoning were proposed.
The compatibility reasoning is appropriate for comparing two sibling nodes in a domain ontology graph, for example, the compatibility between two different /10 is a fine-grain measurement, because x and y have a small degree of difference.
In [31], the compatibility reasoning function was generalized as follows.More precisely, the term (, ) sim x y in Eq. 3 is comput- ed based on Eq. 1 and the main significant value comes from the expression || xy cc − .When this value is large, it means that x and y are less compatible; otherwise, they are more compatible.Appendix B provides an example to show how compatibility reasoning is calculated.
The numerical reasoning is about the similarity between two numeric values of a concept such as CPU speed or RAM size.
Definition 4 [31].Let a and b be numeric values and c a concept.The numerical reasoning function is defined as: Placing concepts inside an ontology graph is manually performed and the degree of similarity between two concepts can be retrieved from a similarity matrix.For locating concepts in an automatic way, a hierarchy matching method proposed in [22] can be suggested.The details of such a method is, however, out of the scope of this paper.

Semantic-Based Behavior Composition
Given the notion of ontology and reasoning, each operation handled by an available service is considered as a concept [4].To have a matchmaking between the operation requested by a target and those available in the system, two sets of operations are defined in the framework.One set, denoted by t A , contains the re- quested operations, and the other set, denoted by s A , includes all operations handled by available services in the system.Given such sets, the target service t  , available services (1 ) i in ≤≤  , and the system  are as defined in Sect.3.1, while ts AA ⊆ .
Example 1.Consider requirements expressed as a target service and depicted in Fig. 3.The requested operations belong to the set: Many of them are not available in the cloud.Moreover, there are three available services able to meet the target.For instance, the service 1  is able to offer the operation set: Though such resources do not have the same name as those of the requested resources, they can be similar or have the same functionality.In this end, a part of cloud ontology graph is illustrated in Fig. 4 to indicate the relations among service operations.
Taking into account the three types of resource reasoning, the definition of largest ND-simulation relation must be revisited to support them.Let s v and t v be the numeric values for s a and t a , respectively, and c is a concept carried by both t a and s a .Moreover, as- suming that 1 τ , 2 τ , and 3 τ be thresholds.An ND-simu- For each type of reasoning, a condition is provided to ensure that at each step of operation execution, the degree of match between a requested operation and an available operation is equal to or greater than a predefined threshold.A part of an ontology for the cloud service operations [14] Information  4. Notably, the graph is a part of a cloud ontology graph represented in [14].
The compatibility reasoning is used for both Windows and , whereas a numerical reasoning is used for StorageSpace .Given the simulation relation:  Given the possible generated controllers that can be extracted from the controller generator, the transition relations of two of them are: , respectively.Moreover, let ρ in Eq. 1 be set to 0.5, and µ and θ in Eq. 3 be set to 0.8 and 10, respec- tively.Given the following amounts, separately computed for each transition in the generated controllers, the average degree of match for the generated controllers 1 P and 2 P are 0.68 and 0.79, respectively.For in- stance, the average degree of match for 1 P is calculated as (0.33+0.88+0.83)/3.

Implementation of Semantic-Based Behavior Composition in SMV/TLV
Once behavior composition has been translated into the safety-game structure, it can be implemented with a model checking tool like TLV [27].TLV (Temporal Logic Verifier) is a tool for the purpose of verifi-cation of LTL specifications.It uses Boolean Decision Diagrams (BDDs) for indicating state valuations and transitions.The inputs of TLV are an LTL specification written in SMV and a synthesis procedure.The latter is based on the safety-game structure and its output represents a controller generator.The procedure of controller synthesis based on a winning strategy has been implemented in TLV [9].SMV (Symbolic Model Verifier) is a symbolic model checking tool supporting the verification of temporal logic (LTL and CTL) properties of finite-state machines.In SMV, each element of the safety-game players, nameavailable services, target service, and controller, is implemented as a module [9]. Figure 6   the system Sys.The former returns the index of an available service executing the requested operation of the target service.The latter chooses the next operation that must be executed.Figure 7 gives the SMV modules of target service t  and the available service More precisely, the submodules indicating the two players of the game structure are detailed.For ctr, being an instance of controller or orchestrator (Ctr), the transition relation defined via the constraints in the INIT and TRANS parts encodes an unconstrained orchestrator, assigning at each step, one operation to each available service, by assigning values to the state variables state, operation, and threshold.The goal of synthesis is to restrict such a relation in order to obtain a winning strategy.More specifically, the constraints enforced on the controller player's state are as follows.Given the INIT part, in its initial state (where variable initial holds true) the controller must instruct every service to initialize itself by performing the dummy operation start (all services initialize simultaneously).As for non-initial states, the TRANS part defines the following constraints: (i) no initialization operation can be assigned to any service; (ii)  the current operation request must match at least one of the service operation (by regarding the similarity between operations); (iii) a service can be instructed to execute an operation only if that operation is the one currently requested; and (iv) at most one service can be instructed to operate at a time.
Given the module Sys, being an instance of system, it contains all the aspects of the system player.More precisely, Sys is the synchronous product of available services (submodule Service1, Service2, Service3) and the target service (submodule Target).Some abbreviations are used to define, in the DEFINE part, namely final and failure states.In fact, the system fails (failure) when any of the available service is instructed to perform an operation that it cannot run based on its current state.Prohibiting such situations, by properly constraining sys transition relation, is the synthesis procedure goal.Furthermore, the entire system does not respect the final-state condition (final) when the target is in a state where it terminates its execution but the available services do not.
For providing a matchmaking between operations of a target service and those of available services, a variable, named threshold, is declared for each type of resource reasoning in the system module of SMV.Through this variable, target service is able to assign its acceptable threshold for the degree of match between its requested operation and the one in system .The type of this variable must be integer, since real numbers are not supported in SMV.For instance, a real number 0.7 is considered as an integer number 7. Given the ranges of resource reasoning functions, the domain of threshold for both similarity and numerical reasonings is integer numbers in an interval [0,10] and for compatibility reasoning is integer number in an interval (0,20).Such domains are appropriate if only one digit of decimal precision is taken into account for thresholds.Note that, the values returned from reasoning functions defined from Def. 2 to 4 cannot be computed through SMV/TLV.The variable threshold is considered as an argument in both target module and available service modules.In the former, it is regarded as an output argument in which at each step of an operation request, its threshold, denoting the acceptable degree of match between the operation and the ones in available services, is released.In contrast, this variable is an input argument in the latter through which the precomputed degree of match between a requested operation and similar ones in the current state of an available service is compared with the released threshold.In the transition part of the available service module, the condifor the threshold is associated with an operation handled by the service and the one requested by the target.Hence, in each transition of the module, a set is provided to encompass both operations.
Example 3. Given the transitions in the target service module depicted in Fig. 7 , it is supposed that: _ the threshold 1 τ for the degree of match between SQL-Server2005 the similar operation in the system is 7, _ the threshold 2 τ for the degree of match between Windows7 and the similar operation in the system is 8, _ the threshold 3 τ for the degree of match between StorageSpace210GB and the similar operation in the system is 3.
For simplification, although three different variables should be declared for 1 τ , 2 τ and 3 τ in the implementa- tion of this example, only one variable threshold is declared.Given the transition part of the target service module, this variable is assigned with three values of 3, 8, and 7 to consider the acceptable thresholds for numerical, compatibility, and similarity reasonings, respectively.These values are inputs in the module of available services.For instance, the requested resource SQL-Server2008 can be matched with the operation SQL-Server2005 in the module Service1, since the current input of threshold in this module has the value of 7, and the degree of similarity between the operations is 8 ().
Appendix A provides the details about the rest of SMV modules of Example 1 along with a part of TLV output indicating controller generator.

Experimental Results
Through the implementation of resource reasoning in SMV, three different experiments have been provided.Given a fixed number of target services, the first one is related to the effects of similarity reasoning on the number of realized target services.The second one is calculating the average time that it takes for the realization of target services.Finally, the third one evaluates the relationship between similarity reasoning and Information Technology and Control 2020/1/49 the synthesized generated controllers for a target service under different rates of available services' failures.

Effect of Similarity Reasoning on Realized Target Services
The assumption is that there is one available service, carrying 16 different operations.Furthermore, it is supposed that number of target services varies from 2 to 12.Each target service requests four different operations so that from those, one operation is randomly chosen to be possibly matched with a similar one in the available service.The predefined threshold in the target service can be 2, 4, 6, or 8.Moreover, in the available service, the degree of match between an operation and the one requested by target service is randomly selected between 1 and 10.Given the graphs illustrated in Fig. 8, the horizontal axes represent number of target services, and the vertical axes indicate the average number of realized target services, where for each datum (point in a curve), it is calculated after 10 times execution of TLV program.To investigate the average number of realized target services in the larger scale of operations, the graphs depicted in Fig. 8(b) and Fig. 8(c) have been provided.In the former, the available service carries 32 different operations, and in the latter, the number of operations is extended to 48.Note that, in both graphs, the scenario for the requested operations of target services is similar to the one assumed for Fig. 8(a).It can be comprehended from the graphs that when the rate of threshold increases, the average number of realized target services decreases sharply.Furthermore, the growth in the number of operations leads to an increase in the average number of realized target services.Besides, a compare between the curves and the threshold rates indicates that curves, having lower rates of threshold, are closer to each other, and such curves are mapped onto each other when the number of operations increases.For instance in Fig. 8(c), when the amount of thresholds were 2, 4, and 6, the curves were mapped onto each other and all released services were realized.The reason of such fully realizable target services is that the probability of finding an operation whose degree of match with a requested operation of target service is high when target requests lower rates of thresholds and we have larger scale of operations.Notably, the fluctuations in the curves of the graphs are simply due to the random selection of degree of match between operations.To have a compare between our semantic-based framework and the original automatic behavior composition synthesis (ABCS) framework 6 proposed in [9], the graph depicted in Fig. 9 is represented.In the experiment, the assumption is that we have one available service handling 32 operations and the rate of threshold released by target service is 7 in the semantic-based framework.Moreover, the number of released target services ranges from 2 to 12 and the degree of match between an operation of each target service and the one in available service is randomly selected between 1 and 10.As seen from Fig. the chance of realization of target services in our approach is much more than the original framework proposed in [9], since our approach considers the operations which are similar to those requested by target service during building composite services.

Realization Time of Target Services
This experiment evaluates the average of time taken for the realization of services in both semantic-based and original behavior composition frameworks.It is assumed that there is one available service carrying 32 different operations and the number of target services varies from 2 to 12, each of which requests four different operations.Furthermore, in the available service, the degree of match between an operation and the one demanded by target service is randomly selected between 1 and 10.Target service requests only one similar operation along with a threshold randomly selected between one and ten. 7 which is taken for the realization of target services.The calculation of the average realization time was obtained after ten times execution of TLV program.As seen from the table, by increasing the number of target services, the realization time rises drastically.Moreover, the realization time in the original behavior composition is totally shorter than our semantic-based framework.This is due to the fact that the number of realized targets in the semantic-supported framework is much more than those realized by the original framework (see Fig. 9).The assumption is that a target service requests 5 different operations.Some requested operations are randomly chosen to be possibly matched with the similar ones in the system.The number of requested similar operations varies from 1 to 5, and the predefined threshold can be 2, 4, 6, 8, or 10.There are 10 available services in the system handling totally 25 different operations, and for each operation, there exat least two instances.More precisely, in this ex- _ the group with two services each of which has three states and handles 15 different operations.
In each available service, the degree of match between an operation and the similar one requested by target service is randomly chosen between 1 and 10.
Given the graphs illustrated in Fig. 10, the horizontal axes represent the number of similar operations requested by target service, and the vertical axes indicate the average number of synthesized controllers (generated controllers).For each datum (point in a curve), the average is calculated after 10 times execution of TLV program.To evaluate the average number of controllers when some available services randomly encounter with failures, the depicted graphs in Fig. 10  The relationships between controller synthesis and similarity reasoning under different rates of failure As seen from the figures, there is a significant decrease in the number of synthesized controllers when the rate of failures increases.Although the average number of controllers is nearly zero for the threshold one, the chance of synthesis rises when lower thresholds are requested.As another result, the increase in the number of requested similar operations leads to the increase in the number of controllers.

Conclusion
This paper introduced a semantic-based framework for the problem of behavior composition whereby service operations that have different names but the same functionality are taken into account during building composite services.Our semantic-based framework extended the original behavior composition framework [9] by developing synthesis procedure, leveraging three types of resource reasoning, namely similarity, compatibility, and numerical reasoning.Such an extension not only provided a more flexible framework for the behavior composition framework to match similar service operations, but also enabled semantic-supported cloud ecosystems to compose their services in an automatic way.Moreover, the paper gave some clues about the implementation of our framework via model checking tools in hand: SMV and TLV.
The kind of control exercised in our framework is a control by delegation.Other formal methods have been proposed for service composition when supervision (i.e., disabling controllable events) is adopted as kind of control (e.g., [6]), but the theoretical framework behind them do not consider resource reasoning behind their synthesis mechanism.Some formal methods for service composition, very different from the aforementioned ones, use a probabilistic (e.g., [17]), preferences-based planning (e.g., [34]) or process calculus(e.g., [7]) approach.These sorts of methods, however, did not synthesize automatic controllers to orchestrate a community of services.
The experiments showed that the possibility of realuser requirements in our semantic-based version is much more than the original framework due to the flexible match between similar operations in the former.However, the realization time of specifi-cations in our framework was fairly longer than the original one.Given possible failures of some available services, our framework indicated that has a higher rate of fault tolerance compared to the original one in terms of building composite services.
Although our framework prescribed a promising formal tools for composing cloud services in an automatic way, it still requires further work or investigations to be readily applied in a real cloud environment.In our present approach, the values returned from the resource reasoning functions, showing the degree of between service operations, were not automatically computed by SMV/TLV.In fact, these values were manually calculated and inserted as integer numbers in the SMV module skeletons extended for the implementation of our framework.Hence, this problem may raise a question about how to establish a link between SMV/TLV and the available ontological engineering tools for building ontology graphs and knowledge-based solutions.As another potential research for future work, the integration of real-time constraints in our framework can be examined.By supporting such constraints, manufacturing cloud and Internet of Things (IoT) industries, often determining deadlines for the use of their services, can benefit from our proposed formal method to integrate objects or services.Furthermore, investigating the scalability of our semantic-based framework in terms of orchestrators synthesis will be another possible research direction.A simple ontology graph [31]

where
The terms c x and c y indicate the chronological orderings of different versions of a software program.
θ ∞ can be assigned by an arbitrary value.The terms x c and y c indicate the chronological orderings of different versions of a software program.The most important component in || cc xy µ θ − is the term || xy cc − .
minimum and maximum   values being available for c.As an example, consider the concept RAM with three different instances whose sizes are 1GB, 4GB, and 8GB.Given Eq. 4, of calculating numerical reasoning between RAM 1GB and RAM 4GB (i.e., =1 a and =4 b ), it is:

_
Figure 4A part of an ontology for the cloud service operations[14]

Figure 5
Figure 5The controller generator

Figure 6
Figure 6Modules of system and controller in SMV

1 
. The transitions part (TRANS) of target module indicates how desired operations are released.Such operations are inputs in the available service module.

Figure 7
Figure 7Modules of target service and an available service

Figure 8
Figure 8The relationships between realized target services and similarity reasoning under different scale of operations

Figure 9 A 1 .
Figure 9 A comparison between realization time in semantic-based framework and original behavior composition framework (b)-(d) are provided.The results after the failures of 2, 4, and 6 available services are illustrated by the graphs, respectively.

Figure 10
Figure 10The relationships between controller synthesis and similarity reasoning under different rates of failure Figure 12TLV output (controller generator) , the concept of Meal reservation has two reachable upward nodes from itself, whereas this is four for Cliff hotel reservation.Hence, In addition, the number of common nodes for Cliff hotel reservation and Transit hotel reservation is more than Cliff hotel reservation and Bus reservation, which are calculated as follows: includes the main modules of services in Example 1.The module main contains two submodules: the controller Ctr and Table 1 represents the average time (in seconds) 6 It is called also as original behavior composition framework.

Table 1
A comparison between semantic-based framework and original behavior composition framework (ABCS)