Incremental generation of lexical scanners

Heering, Jan; Klint, Paul; Rekers, J.G.

doi:10.1145/133233.133240

Cited by 15 publications

(9 citation statements)

References 6 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The implementation of SDF is beyond the scope of this article. Suffice it to say, its implementation supports interactive syntax development and fully general context-free parsing by means of scanner and parser generators that are both lazy (just-in-time) and incremental [Heering et al 1990;Heering et al 1992;Heering et al 1994]. SDF is currently being superseded by SDF2 [Visser 1997], whose main feature is a very close integration of lexical and context-free syntax.…”

Section: Introductionmentioning

confidence: 99%

Compiling language definitions

Brand

Heering

Klint

et al. 2002

ACM Trans. Program. Lang. Syst.

Self Cite

149

View full text Add to dashboard Cite

The ASF+SDF Meta-Environment is an interactive language development environment whose main application areas are definition of domain-specific languages, generation of program analysis and transformation tools, production of software renovation tools, and general specification and prototyping. It uses conditional rewrite rules to define the dynamic semantics and other tooloriented aspects of languages, so the effectiveness of the generated tools is critically dependent on the quality of the rewrite rule implementation.The ASF+SDF rewrite rule compiler generates C code, thus taking advantage of C's portability and the sophisticated optimization capabilities of current C compilers as well as avoiding potential abstract machine interface bottlenecks. It can handle large (10 000+ rule) language definitions and uses an efficient run-time storage scheme capable of handling large (1 000 000+ node) terms. Term storage uses maximal subterm sharing (hash-consing), which turns out to be more effective in the case of ASF+SDF than in Lisp or SML. Extensive benchmarking has shown the time and space performance of the generated code to be as good as or better than that of the best current rewrite rule and functional language compilers.

show abstract

Section: Introductionmentioning

confidence: 99%

Compiling language definitions

Brand

Heering

Klint

et al. 2002

ACM Trans. Program. Lang. Syst.

Self Cite

149

View full text Add to dashboard Cite

show abstract

“…In [34], a technique for lazy and incremental generation of lexical analyzers is presented. A lexical analyzer is devoted to the recognition of several regular expressions and, as pointed out earlier, it is based on a minimized DFA, which is used to perform the actual matching of the input string.…”

Section: Definition 2 (Incremental Determinization and Minimization Pmentioning

confidence: 99%

Determinization and minimization of finite acyclic automata by incremental techniques

Lamperti

Scandale

Zanella

2015

Softw. Pract. Exper.

View full text Add to dashboard Cite

The determinization of a nondeterministic finite automaton (FA) N is the process of generating a deterministic FA (DFA) D equivalent to (sharing the same regular language of) N. The minimization of D is the process of generating the minimal DFA M equivalent to D. Classical algorithms for determinization and minimization are available in the literature for several decades. However, they operate monolithically, assuming that the FA to be either determinized or minimized is given once and for all. By contrast, we consider determinization and minimization in a dynamic context, where N augments over time: after each augmentation, determinization and minimization of N into M is required. Using classical monolithic algorithms to solve this problem is bound to poor performance. An algorithm for incremental determinization and minimization of acyclic finite automata, called IDMA, is proposed. Despite being conceived within the narrow domain of model-based diagnosis and monitoring of active systems, the algorithm is general-purpose in nature. Experimental evidence indicates that IDMA is far more efficient than classical algorithms in solving incremental determinization and minimization problems

show abstract

“…They give us both flexibility and efficiency. [17] presents a method to incrementally build the underlying DFA, which we can use to avoid the potentially enormous memory and computation required to generate the complete DFA for thousands of signatures. An extended form of regular expressions has been used in intrusion detection for defining sequences of events [30], but to our knowledge no NIDS uses them for actually matching multiple byte patterns against the payload of packets.…”

Section: Related Workmentioning

confidence: 99%

“…Instead of pre-computing the DFA, we build the DFA "on-thefly" during the actual matching [17]. Each time the DFA needs to transit into a state that is not already constructed, we compute the new state and record it for future reuse.…”

Section: Regular Expressionsmentioning

confidence: 99%

Enhancing byte-level network intrusion detection signatures with context

Sommer¹,

Paxson

2003

Proceedings of the 10th ACM Conference on Computer and Communications Security

190

View full text Add to dashboard Cite

Many network intrusion detection systems (NIDS) use byte sequences as signatures to detect malicious activity. While being highly efficient, they tend to suffer from a high false-positive rate. We develop the concept of contextual signatures as an improvement of string-based signature-matching. Rather than matching fixed strings in isolation, we augment the matching process with additional context. When designing an efficient signature engine for the NIDS Bro, we provide low-level context by using regular expressions for matching, and high-level context by taking advantage of the semantic information made available by Bro's protocol analysis and scripting language. Therewith, we greatly enhance the signature's expressiveness and hence the ability to reduce false positives. We present several examples such as matching requests with replies, using knowledge of the environment, defining dependencies between signatures to model step-wise attacks, and recognizing exploit scans.To leverage existing efforts, we convert the comprehensive signature set of the popular freeware NIDS Snort into Bro's language. While this does not provide us with improved signatures by itself, we reap an established base to build upon. Consequently, we evaluate our work by comparing to Snort, discussing in the process several general problems of comparing different NIDSs.

show abstract

Incremental generation of lexical scanners

Cited by 15 publications

References 6 publications

Compiling language definitions

Compiling language definitions

Determinization and minimization of finite acyclic automata by incremental techniques

Enhancing byte-level network intrusion detection signatures with context

Contact Info

Product

Resources

About