Efficient Regular Expression Pattern Matching for Network Intrusion Detection Systems using Modified Word-based Automata

Network Intrusion Detection Systems (NIDS) intercept the traffic at an organization's network periphery to thwart intrusion attempts. Signature-based NIDS compares the intercepted packets against its database of known vulnerabilities and malware signatures to detect such cyber attacks. These signatures are represented using Regular Expressions (REs) and strings. Regular Expressions, because of their higher expressive power, are preferred over simple strings to write these signatures. We present Cascaded Automata Architecture to perform memory efficient Regular Expression pattern matching using existing string matching solutions. The proposed architecture performs two stage Regular Expression pattern matching. We replace the substring and character class components of the Regular Expression with new symbols. We address the challenges involved in this approach. We augment the Word-based Automata, obtained from the re-written Regular Expressions, with counter-based states and length bound transitions to perform Regular Expression pattern matching. We evaluated our architecture on Regular Expressions taken from Snort rulesets. We were able to reduce the number of automata states between 50% to 85%. Additionally, we could reduce the number of transitions by a factor of 3 leading to further reduction in the memory requirements.

Dynamically Reconfigurable Regular Expression Matching Architecture

Regular Expressions are generic representations for a string or a collection of strings. This paper focuses on implementation of a regular expression matching architecture on reconfigurable fabric like FPGA. We present a Nondeterministic Finite Automata based implementation with extended regular expression syntax set compared to previous approaches. We also describe a dynamically reconfigurable generic block that implements the supported regular expression syntax. This enables formation of the regular expression hardware by a simple cascade of generic blocks as well as a possibility for reconfiguring the generic blocks to change the regular expression being matched. Further,we have developed an HDL code generator to obtain the VHDL description of the hardware for any regular expression set. Our optimized regular expression engine achieves a throughput of 2.45 Gbps. Our dynamically reconfigurable regular expression engine achieves a throughput of 0.8 Gbps using 12 FPGA slices per generic block on Xilinx Virtex2Pro FPGA.

Hybrid stiff-string-polynomial basis functions for vibration analysis of high speed rotating beams

A new finite element is developed for free vibration analysis of high speed rotating beams using basis functions which use a linear combination of the solution of the governing static differential equation of a stiff-string and a cubic polynomial. These new shape functions depend on rotation speed and element position along the beam and account for the centrifugal stiffening effect. The natural frequencies predicted by the proposed element are compared with an element with stiff-string, cubic polynomial and quintic polynomial shape functions. It is found that the new element exhibits superior convergence compared to the other basis functions.

Negative resistance mode of forced oscillations of a string

A new mode of driven nonlinear vibrations of a stretched string is investigated with reference to conditions of existence, properties, and regions of stability. It is shown that this mode exhibits negative resistance properties at all frequencies and driving force amplitudes. Discovery of this mode helps to fill certain gaps in the theory of forced nonlinear vibrations of strings.

An Optimal Mechanism for Sponsored Search Auctions on the Web and Comparison With Other Mechanisms

In this paper, we first describe a framework to model the sponsored search auction on the web as a mechanism design problem. Using this framework, we describe two well-known mechanisms for sponsored search auction-Generalized Second Price (GSP) and Vickrey-Clarke-Groves (VCG). We then derive a new mechanism for sponsored search auction which we call optimal (OPT) mechanism. The OPT mechanism maximizes the search engine's expected revenue, while achieving Bayesian incentive compatibility and individual rationality of the advertisers. We then undertake a detailed comparative study of the mechanisms GSP, VCG, and OPT. We compute and compare the expected revenue earned by the search engine under the three mechanisms when the advertisers are symmetric and some special conditions are satisfied. We also compare the three mechanisms in terms of incentive compatibility, individual rationality, and computational complexity. Note to Practitioners-The advertiser-supported web site is one of the successful business models in the emerging web landscape. When an Internet user enters a keyword (i.e., a search phrase) into a search engine, the user gets back a page with results, containing the links most relevant to the query and also sponsored links, (also called paid advertisement links). When a sponsored link is clicked, the user is directed to the corresponding advertiser's web page. The advertiser pays the search engine in some appropriate manner for sending the user to its web page. Against every search performed by any user on any keyword, the search engine faces the problem of matching a set of advertisers to the sponsored slots. In addition, the search engine also needs to decide on a price to be charged to each advertiser. Due to increasing demands for Internet advertising space, most search engines currently use auction mechanisms for this purpose. These are called sponsored search auctions. A significant percentage of the revenue of Internet giants such as Google, Yahoo!, MSN, etc., comes from sponsored search auctions. In this paper, we study two auction mechanisms, GSP and VCG, which are quite popular in the sponsored auction context, and pursue the objective of designing a mechanism that is superior to these two mechanisms. In particular, we propose a new mechanism which we call the OPT mechanism. This mechanism maximizes the search engine's expected revenue subject to achieving Bayesian incentive compatibility and individual rationality. Bayesian incentive compatibility guarantees that it is optimal for each advertiser to bid his/her true value provided that all other agents also bid their respective true values. Individual rationality ensures that the agents participate voluntarily in the auction since they are assured of gaining a non-negative payoff by doing so.

On walls of marginal stability in N=2 string theories

We study the properties of walls of marginal stability for BPS decays in a class of N = 2 theories. These theories arise in N = 2 string compactifications obtained as freely acting orbifolds of N = 4 theories, such theories include the STU model and the FHSV model. The cross sections of these walls for a generic decay in the axion-dilaton plane reduce to lines or circles. From the continuity properties of walls of marginal stability we show that central charges of BPS states do not vanish in the interior of the moduli space. Given a charge vector of a BPS state corresponding to a large black hole in these theories, we show that all walls of marginal stability intersect at the same point in the lower half of the axion-dilaton plane. We isolate a class of decays whose walls of marginal stability always lie in a region bounded by walls formed by decays to small black holes. This enables us to isolate a region in moduli space for which no decays occur within this class. We then study entropy enigma decays for such models and show that for generic values of the moduli, that is when moduli are of order one compared to the charges, entropy enigma decays do not occur in these models.

Deuterium-carbon correlation in static oriented systems using DAPT - A windowless multiple pulse sequence

We present a new method for establishing correlation between deuterium and its attached carbon in a deuterated liquid crystal. The method is based on transfer of polarization using the DAPT pulse sequence proposed originally for two spin half nuclei, now extended to a spin-1 and a spin-1/2 nuclei. DAPT utilizes the evolution of magnetization of the spin pair under two blocks of phase shifted BLEW-12 pulses on one of the spins separated by a 90 degree pulse on the other spin. The method is easy to implement and does not need to satisfy matching conditions unlike the Hartmann-Hahn cross-polarization. Experimental results presented demonstrate the efficacy of the method.

Block-based feature detection and matching for mosaicing of camera-captured document images

In this paper, we present a new feature-based approach for mosaicing of camera-captured document images. A novel block-based scheme is employed to ensure that corners can be reliably detected over a wide range of images. 2-D discrete cosine transform is computed for image blocks defined around each of the detected corners and a small subset of the coefficients is used as a feature vector A 2-pass feature matching is performed to establish point correspondences from which the homography relating the input images could be computed. The algorithm is tested on a number of complex document images casually taken from a hand-held camera yielding convincing results.

Stiff-String Basis Functions for Vibration Analysis of High Speed Rotating Beams

A new rotating beam finite element is developed in which the basis functions are obtained by the exact solution of the governing static homogenous differential equation of a stiff string, which results from an approximation in the rotating beam equation. These shape functions depend on rotation speed and element position along the beam and account for the centrifugal stiffening effect. Using this new element and the Hermite cubic finite element, a convergence study of natural frequencies is performed, and it is found that the new element converges much more rapidly than the conventional Hermite cubic element for the first two modes at higher rotation speeds. The new element is also applied for uniform and tapered rotating beams to determine the natural frequencies, and the results compare very well with the published results given in the literature.

Non-Linear vibration of an elastic string

Equations proposed in previous work on the non-linear motion of a string show a basic disagreement, which is here traced to an assumption about the longitudinal displacement u. It is shown that it is neither necessary nor justifiable to assume that u is zero; and also that the velocity of propagation of u disturbances in a string is different from that in an infinite medium, although this difference is usually negligible. After formulating the exact equations of motion for the string, a systematic procedure is described for obtaining approximations to these equations to any order, making only the assumption that the strain in the material of the string is small. The lowest order equations in this scheme are non-linear, and are used to describe the response of a string near resonance. Finally, it is shown that in the absence of damping, planar motion of a string is always unstable at sufficiently high amplitudes, the critical amplitude falling to zero at the natural frequency and its subharmonics. The effect of slight damping on this instability is also discussed.

Probability Distribution of the Eigenvalues of the Random String Equation

The probability distribution of the eigenvalues of a second-order stochastic boundary value problem is considered. The solution is characterized in terms of the zeros of an associated initial value problem. It is further shown that the probability distribution is related to the solution of a first-order nonlinear stochastic differential equation. Solutions of this equation based on the theory of Markov processes and also on the closure approximation are presented. A string with stochastic mass distribution is considered as an example for numerical work. The theoretical probability distribution functions are compared with digital simulation results. The comparison is found to be reasonably good.

Radio interference measurements on a ceramic disc insulator string with field reduction electrode

This paper presents a laboratory study of the discharge radio noise generated by ceramic insulator strings under normal conditions. In the course of study, a comparison on the performance of two types of insulator strings under two different conditions was studied namely (a) normal disc insulators in a string and (b) disc insulators integrated with a newly developed field reduction electrode fixed to the disc insulator at the pin junction. The results obtained during the study are discussed and presented.

A Case Study in Matching Service Descriptions to Implementations in an Existing System

A number of companies are trying to migrate large monolithic software systems to Service Oriented Architectures. A common approach to do this is to first identify and describe desired services (i.e., create a model), and then to locate portions of code within the existing system that implement the described services. In this paper we describe a detailed case study we undertook to match a model to an open-source business application. We describe the systematic methodology we used, the results of the exercise, as well as several observations that throw light on the nature of this problem. We also suggest and validate heuristics that are likely to be useful in partially automating the process of matching service descriptions to implementations.