• 主题
高级搜索  >
历史搜索 清空历史
首页> 外文学位 >Programming Languages Techniques for Stream Data Processing Applied in Security.
【24h】

Programming Languages Techniques for Stream Data Processing Applied in Security.

机译：用于安全性的流数据处理的编程语言技术。

获取原文
获取原文并翻译 | 示例
页面导航
  • 摘要
  • 著录项
  • 相似文献
  • 相关主题

摘要

Signature based Network Intrusion Detection and Prevention Systems (NIDPS) and format aware encryption use at their core finite-automata structures or algorithms to match against regular expressions and respectively to rank elements in a language.They also need to process data streams at increasingly high line speeds, which is a major challenge considering some limitations imposed by classical language and automata theory. For generic programs, these limitations are merely a matter of performance, but for security critical applications, these limitations affect their functionality and finding domain specific optimizations become a necessity.;In this thesis, I rely on domain specific insight to devise alternative methods that speculate about system state in order to go beyond the limits imposed by classic automata and language theory.;To address the problem of regular expression matching performed by NIDPS, I exploit the state locality of finite automata and low frequency of matches in two ways. First, I use speculation about the unknown future states to efficiently parallelize pattern matching. Second, I use speculation about how often the automata states will be traversed, to approximate and compress automata and to build new matching structures with better trade-off in terms of memory usage and matching speed.;To accelerate string ranking used by formatted encryption, I exploit the fact that in practice, even if a language representation is potentially ambiguous, for instance allowing strings with multiple accepting NFA paths or multiple context free grammar derivations, the degree of ambiguity is limited. When efficient ranking algorithms are not known or possible for certain language representations, I turn to ambiguous representations and create robust iterative algorithms that speculate that a non-ambiguous string is quickly encountered. This extends the application domain of formatted encryption from regular languages to context free and beyond.;I obtain new algorithms, data structures and even propose hardware to accelerate the scanning or encryption of data streams. My experiments and simulations show that the new algorithms have very good performance in the common case, and have bounded and well understood worst case performance. Therefore, they limit the potential power of algorithmic attacks.
机译：基于签名的网络入侵检测和防御系统（NIDPS）和格式感知加密在其核心有限自动机结构或算法处使用以匹配正则表达式并分别对一种语言中的元素进行排名，并且还需要以越来越高的行处理数据流考虑到古典语言和自动机理论所施加的某些限制，这是一个重大挑战。对于通用程序，这些限制仅仅是性能的问题，但是对于安全性至关重要的应用程序，这些限制会影响其功能，因此必须找到特定于领域的优化。;在本文中，我依靠特定于领域的见识来设计可推测的替代方法。为了超越经典自动机和语言理论的局限性，我们讨论了系统状态。为了解决NIDPS执行的正则表达式匹配的问题，我以两种方式利用有限自动机的状态局部性和低匹配频率。首先，我使用有关未知未来状态的推测来有效地并行化模式匹配。其次，我猜测将遍历自动机状态的频率，以近似和压缩自动机并建立新的匹配结构，从而在内存使用和匹配速度方面取得更好的权衡。为了加快格式化加密使用的字符串排序，我利用这样一个事实：即使在实践中，即使语言表示形式可能是模棱两可的（例如，允许具有多个接受NFA路径的字符串或具有多个上下文无关的语法派生的字符串），歧义度也受到限制。当对于某些语言表示形式未知或不可能使用有效的排名算法时，我将转向模棱两可的表示形式，并创建健壮的迭代算法，以推测会很快遇到非歧义的字符串。这将格式化加密的应用范围从常规语言扩展到了上下文无关的范围。我获得了新的算法，数据结构，甚至提出了硬件来加速数据流的扫描或加密。我的实验和仿真表明，新算法在普通情况下具有非常好的性能，并且在有限的情况下具有局限性并广为人知。因此，它们限制了算法攻击的潜在威力。

著录项

  • 作者

    Luchaup, Daniel.;

  • 作者单位

    The University of Wisconsin - Madison.;

  • 授予单位 The University of Wisconsin - Madison.;
  • 学科 Computer science.
  • 学位 Ph.D.
  • 年度 2015
  • 页码 159 p.
  • 总页数 159
  • 原文格式 PDF
  • 正文语种 eng
  • 中图分类
  • 关键词

相似文献

  • 外文文献
  • 中文文献
  • 专利
获取原文

客服邮箱：kefu@zhangqiaokeyan.com

京公网安备：11010802029741号 ICP备案号：京ICP备15016152号-6 六维联合信息科技 (北京) 有限公司©版权所有

  • 客服微信

  • 服务号