Efficiency Issues of Rete-Based Expert Systems for Misuse Detection

Meier, Michael; Flegel, Ulrich; Schmerl, Sebastian

doi:10.1109/acsac.2007.4412985

Cited by 1 publication

(2 citation statements)

References 7 publications

(16 reference statements)

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In [45], an in-depth analysis is presented why Rete's performance is lacking in the area of misuse detection. Its critiques on Rete coincide precisely with the principal rationale behind lazy matching algorithms (see Section 6).…”

Section: Case Study: Misuse Detectionmentioning

confidence: 99%

“…Its critiques on Rete coincide precisely with the principal rationale behind lazy matching algorithms (see Section 6). We therefore repeated their experiments, and measured the following timings when processing 10,900 events: SAM is a special-purpose misuse detection algorithm [45]. We used CCHR [29] because it was easier to link with the pre-existing C++ code.…”

Section: Case Study: Misuse Detectionmentioning

confidence: 99%

See 1 more Smart Citation

Efficient Lazy Evaluation of Rule-Based Programs

Weert

2010

IEEE Trans. Knowl. Data Eng.

View full text Add to dashboard Cite

Thirty years after Forgy's seminal dissertation, Rete remains the de facto standard matching algorithm. Despite promising research results, alternative algorithms such as TREAT and LEAPS have had little impact on modern production rule engines. Constraint Handling Rules (CHR) is a high-level, declarative programming language, similar to production rules. In recent years, CHR has increasingly been used in a wide range of general-purpose applications. State-of-the-art CHR systems use LEAPS-like lazy matching, and implement a large body of novel program analyses and optimization techniques to further improve performance. While obviously related, CHR and production rules research have mostly evolved independently from each other. With this article, we aim to foster cross-fertilization of implementation techniques. We provide a lucid, comprehensive overview of CHR's rule evaluation methodology, and survey recent contributions to the field of lazy matching. Our empirical evaluation confirms Rete-based engines would surely benefit from incorporating similar techniques and optimizations.

show abstract

Section: Case Study: Misuse Detectionmentioning

confidence: 99%

Section: Case Study: Misuse Detectionmentioning

confidence: 99%