Liang Hu

A faster algorithm for matching a set of patterns with variable length don't cares

We present a simple and faster solution to the problem of matching a set of patterns with variable length dont cares. Given an alphabet @S, a pattern p is a word p[emailxa0protected][emailxa0protected]m, where pi is a string over @S called a keyword and @@[emailxa0protected] is a symbol called a variable length dont care (VLDC) symbol. Pattern p matches a text t if t=u0p1u1...um-1pmum for some u0,...,u[emailxa0protected][emailxa0protected]^*. The problem addressed in this paper is: given a set of patterns P and a text t, determine whether one of the patterns of P matches t. Kucherov and Rusinowitch (1997) [9] presented an algorithm that solves the problem in time O((|t|+|P|)log|P|), where |P| is the total length of keywords in every pattern of P. We give a new algorithm based on Aho-Corasick automaton. It uses the solutions of Dynamic Marked Ancestor Problem of Chan et al. (2007) [5]. The algorithm takes O((|t|[emailxa0protected][emailxa0protected]?)[emailxa0protected]/[emailxa0protected]) time, where @[emailxa0protected]? is the total number of keywords in every pattern of P, and @k is the number of distinct keywords in P. The algorithm is faster and simpler than the previous approach.

Improvement on rules matching algorithm of snort based on dynamic adjustment

With the increasing network security accidents, intrusion detection systems (IDS) have been an indispensable part of information system. As a popular light network intrusion detection system, Snort has been a focus in research field. In this paper, dynamic adjustment algorithm is applied to the improvement of rule matching based on the analysis of original mechanism of Snort. Additionally, further optimization is discussed against the problem of simple dynamic adjustment, and improved two step dynamic rule adjustment algorithm is provided. Experiment results show that this method increases the speed of rules matching and improve the detection efficiency of Snort.

LDLB: A light intrusion prevention system in data link layer

Intrusion detection systems (IDS) are fundamentally passive and fail-open. Because their primary task is classification, they do nothing to prevent an attack from succeeding. An intrusion prevention system (IPS) is deployed in-line with its capability to provide real-time and active defense. It makes attempts to stop attacks. This paper presents the design and implementation of LDLB: a light intrusion prevention system in data link layer, which is composed of packet filter module, intrusion detection module and intrusion prevention module. It doesnpsilat perform any modification on the passing packets as well as bridge so it is transparent for intruders. Additionally, its configuration and deployment strategy are also discussed. In short, LDLB provides synthesis security prevention in data link layer.

Data Collection for Intrusion Detection System Based on Stratified Random Sampling

Data collection mechanism is a crucial factor of the performance of intrusion detection system (IDS). Stratified random sampling technique of statistics is introduced to the procedure of data collection of IDS, and a new data collection model and its implementation for IDS are provided in this paper. The issue of sample size allocation in strata is discussed, and formulas used to calculate the sample size of packets based on proportional allocation are presented. Experimental results show this method is able to improve the efficiency of data collection for IDS with little devaluation of detection precision, and exceedingly strengthen the processing performance of IDS especially in the large-scale high-speed network.

Denial of Service Attack Simulation Based-on CASL

Since the first denial of service (DoS) attack appears, DoS attacks cause significant financial damage every year. The majority researchers focus on detection and respond mechanism of DoS, whereas limited progress has been made in the details of DoS attacks. In this paper, we introduce custom audit scripting language (CASL) applied to write simulation program for DoS attacks. Then we take a deep research in the methodology of DoS attacks and simulate two typical DoS attacks in CASL. Additionally, recent trends of DoS attacks and problems associated with defending against DoS attacks are also discussed. In short, our simulation attack programs can help examine the nature of DoS attacks and find the corresponding countermeasures.

Pattern matching with wildcards using words of shorter length

The problem of pattern matching with wildcards is to find all the occurrences of a pattern of length m in a text of length n over a finite alphabet @S (both the text and the pattern are allowed to contain wildcards). Based on the prime number encoding scheme (Chaim Linhart, Ron Shamir, Faster pattern matching with character classes using prime number encoding, J. Comput. Syst. Sci. 75 (3) (2009) 155-162), we present a new integer encoding and an efficient fast Fourier transforms based algorithm for this problem. The algorithm takes O(nlogm) time to search the pattern in the text by computing one convolution. For matching with wildcards, our encoding uses fewer prime numbers and has shorter code words comparing with the prime number encoding. We use at most 2lg|@S| prime numbers to encode the symbols while in the prime number encoding |@S| prime numbers are required. This number reduces to 1.5lg|@S| when |@S|>40. The code word used in the algorithm is at most [emailxa0protected]?lg|@S|@[emailxa0protected]?lg(5m)@? bits while in the prime encoding it is at least |@S|lgm bits. We also show that the length of words can be further reduced by increasing the number of convolutions computed.

LABEL-GUIDED GRAPH EXPLORATION WITH ADJUSTABLE RATIO OF LABELS

The graph exploration problem is to visit all the nodes of a connected graph by a mobile entity, e.g., a robot. The robot has no a priori knowledge of the topology of the graph or of its size. Cohen et al. cite{Ilcinkas08} introduced label guided graph exploration which allows the system designer to add short labels to the graph nodes in a preprocessing stage; these labels can guide the robot in the exploration of the graph. In this paper, we address the problem of adjustable 1-bit label guided graph exploration. We focus on the labeling schemes that not only enable a robot to explore the graph but also allow the system designer to adjust the ratio of the number of different labels. This flexibility is necessary when maintaining different labels may have different costs or when the ratio is pre-specified. We present 1-bit labeling (two colors, namely black and white) schemes for this problem along with a labeling algorithm for generating the required labels. Given an

WEIGHTED AUTOMATA FOR FULL-TEXT INDEXING

n

On the Structure of Consistent Partitions of Substring Set of a Word

-node graph and a rational number

Automata for Weak Factor Recognition

rho