Thousands Of Rules Research Articles

DRC-SG 2.0: Efficient Design Rule Checking Script Generation via Key Information Extraction

Design Rule Checking (DRC) is a critical step in integrated circuit design. DRC requires formatted scripts as the input to design rule checkers. However, these scripts are manually generated in the foundry, which is tedious and error prone for generation of thousands of rules in advanced technology nodes. To mitigate this issue, we propose the first DRC script generation framework, leveraging a deep learning-based key information extractor to automatically identify essential arguments from rules and a script translator to organize the extracted arguments into executable DRC scripts. We further enhance the performance of the extractor with three specific design rule generation techniques and a multi-task learning-based rule classification module. Experimental results demonstrate that the framework can generate a single rule script in 5.46 ms on average, with the extractor achieving 91.1% precision and 91.8% recall on the key information extraction. Compared with the manual generation, our framework can significantly reduce the turnaround time and speed up process design closure.

An Optimized Machine Learning Based Rule Engine Architecture

Rules are segments of knowledge which are generally conveyed as, “when some conditions are evaluated as true, then perform some tasks". A rule engine is basically an advanced software system responsible for rules evaluation and execution. While it is easy to add rules, problems arise when their numbers tend to explode exponentially over time due to new business scenario needs. It eventually becomes more complex when an enterprise information system, having configuration model powered by a declarative rule engine, needs to be maintained. Performance significantly degrades when there are thousands of rules, since the engine must figure out every time which rule should be fired when large number of facts arrive for processing, thus rapidly choking up the system. Objective of this paper is to use machine learning techniques to optimize declarative business rules system when the number of rules increases creating performance degradation and complexity issues.

RuleHub

Entity-centric knowledge graphs (KGs) are now popular to collect facts about entities. KGs have rich schemas with a large number of different types and predicates to describe the entities and their relationships. On these rich schemas, logical rules are used to represent dependencies between the data elements. While rules are useful in query answering, data curation, and other tasks, they usually do not come with the KGs. Such rules have to be manually defined or discovered with the help of rule mining methods. We believe this rule-collection task should be done collectively to better capitalize our understanding of the data and to avoid redundant work conducted on the same KGs. For this reason, we introduce RuleHub , our extensible corpus of rules for public KGs. RuleHub provides functionalities for the archival and the retrieval of rules to all users, with an extensible architecture that does not constrain the KG or the type of rules supported. We are populating the corpus with thousands of rules from the most popular KGs and report on our experiments on automatically characterizing the quality of a rule with statistical measures.

Automated repair by example for firewalls

Firewalls are widely deployed to manage enterprise networks. Because enterprise-scale firewalls contain hundreds or thousands of rules, ensuring the correctness of firewalls—that the rules in the firewalls meet the specifications of their administrators—is an important but challenging problem. Although existing firewall diagnosis and verification techniques can identify potentially faulty rules, they offer administrators little or no help with automatically fixing faulty rules. This paper presents FireMason, the first effort that offers automated repair by example for firewalls. Once an administrator observes undesired behavior in a firewall, she may provide input/output examples that comply with the intended behaviors. Based on the examples, FireMason automatically synthesizes new firewall rules for the existing firewall. This new firewall correctly handles packets specified by the examples, while maintaining the rest of the behaviors of the original firewall. Through a conversion of the firewalls to SMT formulas, we offer formal guarantees that the change is correct. Our evaluation results from real-world case studies show that FireMason can efficiently find repairs.

Consistency analysis and flow secure enforcement of SELinux policies

SELinux policies used in practice contain tens of thousands of rules, making it hard to comprehend their impact on the security and to verify whether they actually meet the intended security goals. In this paper, we describe an approach for reasoning about the consistency of a given SELinux policy by analyzing the information flows caused by it. For this purpose, we model SELinux policy rules using the Readers-Writers Flow Model (RWFM). We have used this approach to implement a static policy analysis tool as well as a run-time monitor. The static policy analysis tool identifies all the possible indirect flows in a given policy and then filters out those indirect flows that pose a high threat. Given an indirect flow, the tool can also identify the sequences of accesses that cause the indirect flow. The tool also ranks the rules and domains based on the number of policy violations they cause. Thus, the static analysis tool is useful for policy writers to develop flow secure policies. The run-time monitor, on the other hand, keeps track of the information flows in an SELinux system and detects indirect flows dynamically. This helps in ensuring flow secure enforcement of a given SELinux policy as per the specification. The efficiency and efficacy of our implementations are demonstrated through experimental analysis on large, real-life policies.

Cuckoo filter-based many-field packet classification using X-tree

Software-defined networking (SDN) is a new paradigm which emerged in the networking area. Packet classification is an interesting topic that has considered in both traditional and SDN networks. Packet classification involves inspection of multiple fields against a set of thousands of rules called rule-set. With the increasing throughput demands in modern networks and the growing size of rule-sets, performing wire-speed packet classification has become challenging and an important topic in recent years. Packet classification is called as many-field packet classification in the SDN because of increasing the number of header fields. In this paper, a scalable many-field packet classification by employing the extended tree (X-tree) integrated with an efficient probabilistic data structure called Cuckoo filter is proposed. X-tree has high performance from the lookup, insertion, and update aspects. However, X-tree has a high memory requirement, Cuckoo filter as a probabilistic data structure is integrated within each X-tree node to outperform memory requirements and providing more classification throughput. Our experiment results show that the proposed approach achieves high throughput while requiring low memory. In addition, the proposed approach improves latency 2.4 $$\times $$ , 6.15 $$\times $$ and 4.75 $$\times $$ in comparison with DBAMCP, BSOL-RC and BF-AQT for 64 k rule-set, respectively.

Scalable Many-Field Packet Classification for Traffic Steering in SDN Switches

Packet classification is a key function for software-defined networking switches. For example, OpenFlow Switch examines up to 15 required fields, against thousands of rules. With the proliferation of new header fields in a ruleset, it becomes a great challenge to design a high performance packet classification solution. In this paper, we present a scalable many-field packet classification algorithm and its prototype implementation on a graphics processing unit (GPU). By exploiting the sparsity of ruleset, our algorithm uses a few effective bits (EB) to divide a large ruleset into multiple subsets with low rule replication for economic memory usage at the offline stage. These EB are chosen based on our selection metrics: wildcard ratio, independence index, and diversity index. Using these EB, our algorithm can quickly filter out the majority rules which do not need to be full-matched to improve the online system performance. Moreover, the choice of EB is adjustable to meet the implementation requirements of varying environments for good performance scalability. Our prototype on a single NVIDIA K20C GPU achieves more than 160 MPPS throughput for 100K 15-field synthetic ruleset.

Privacy-Preserving Quantification of Cross-Domain Network Reachability

Network reachability is an important characteristic for understanding end-to-end network behavior and helps in detecting violations of security policies across the network. While quantifying network reachability within one administrative domain is a difficult problem in itself, performing the same computation across a network spanning multiple administrative domains presents a novel challenge. The problem of quantifying network reachability across multiple administrative domains is more difficult because the privacy of security policies of individual domains is a serious concern and needs to be protected through this process. In this paper, we propose the first cross-domain privacy-preserving protocol for quantifying network reachability. Our protocol constructs equivalent representations of the Access Control List (ACL) rules and determines network reachability while preserving the privacy of the individual ACLs. This protocol can accurately determine the network reachability along a network path through different administrative domains. We have implemented and evaluated our protocol on both real and synthetic ACLs. The experimental results show that the online processing time of an ACL containing thousands of rules is less than 25 s. Given two ACLs, each containing thousands of rules, the comparison time is less than 6 s, and the total communication cost is less than 2100 kB.

Firewall Policy Diagram: Structures for Firewall Behavior Comprehension

Communication security and regulatory compliance have made the firewall a vital element for networked computers. They provide the protections between parties that only wish to communicate over an explicit set of channels, expressed through protocols, traveling over a network. These explicit set of channels are described and implemented in a firewall using a set of rules. The firewall implements the will of the organization through an ordered list of these rules, collectively referred to as a policy. In small test environments and networks, firewall policies may be easy to comprehend and understand; however, in real world organizations these devices and policies must be capable of handling large amounts of traffic traversing hundreds or thousands of rules in a particular policy. Added to that complexity is the tendency of a policy to grow substantially more complex over time and the result is often unintended mistakes in comprehending what is allowed, possibly leading to security breaches. Therefore, it is imperative that an organization is able to unerringly and deterministically reason about network traffic, while being presented with hundreds or thousands of rules. This work seeks to address this problem using a data structure, the Firewall Policy Diagram, in an effort to advance the state of large network behavior comprehension.

Ultra-High Throughput Low-Power Packet Classification

Packet classification is used by networking equipment to sort packets into flows by comparing their headers to a list of rules, with packets placed in the flow determined by the matched rule. A flow is used to decide a packet's priority and the manner in which it is processed. Packet classification is a difficult task due to the fact that all packets must be processed at wire speed and rulesets can contain tens of thousands of rules. The contribution of this paper is a hardware accelerator that can classify up to 433 million packets per second when using rulesets containing tens of thousands of rules with a peak power consumption of only 9.03 W when using a Stratix III field-programmable gate array (FPGA). The hardware accelerator uses a modified version of the HyperCuts packet classification algorithm, with a new pre-cutting process used to reduce the amount of memory needed to save the search structure for large rulesets so that it is small enough to fit in the on-chip memory of an FPGA. The modified algorithm also removes the need for floating point division to be performed when classifying a packet, allowing higher clock speeds and thus obtaining higher throughputs.

Compressing Network Access Control Lists

An access control list (ACL) provides security for a private network by controlling the flow of incoming and outgoing packets. Specifically, a network policy is created in the form of a sequence of (possibly conflicting) rules. Each packet is compared against this ACL, and the first rule that the packet matches defines the decision for that packet. The size of ACLs has been increasing rapidly due to the explosive growth of Internet-based applications and malicious attacks. This increase in size degrades network performance and increases management complexity. In this paper, we propose ACL Compressor, a framework that can significantly reduce the number of rules in an access control list while maintaining the same semantics. We make three major contributions. First, we propose an optimal solution using dynamic programming techniques for compressing one-dimensional range-based access control lists. Second, we present a systematic approach for compressing multidimensional access control lists. Last, we conducted extensive experiments to evaluate ACL Compressor. In terms of effectiveness, ACL Compressor achieves an average compression ratio of 50.22 percent on real-life rule sets. In terms of efficiency, ACL runs in seconds, even for large ACLs with thousands of rules.

A Rewriting Logic Semantics for ATL.

As the complexity of model transformation (MT) grows, the need to rely on formal semantics of MT languages becomes a critical issue. Formal semantics provide precise specications of the expected behavior of transformations, allowing users to understand them and to use them properly, and MT tool builders to develop correct MT engines, compilers, etc. In addition, formal semantics allow modelers to reason about the MTs and to prove their correctness, something specially important in case of large and complex MTs (with, e.g., hundreds or thousands of rules) for which manual debugging is no longer possible. In this paper we give a formal semantics of the ATL 3.0 model transformation language using rewriting logic and Maude, which allows addressing these issues. Such formalization provides additional benets, such as enabling the simulation of the specications or giving access to the Maude toolkit to reason about them.

From data to knowledge mining

AbstractMost past approaches to data mining have been based on association rules. However, the simple application of association rules usually only changes the user's problem from dealing with millions of data points to dealing with thousands of rules. Although this may somewhat reduce the scale of the problem, it is not a completely satisfactory solution. This paper presents a new data mining technique, called knowledge cohesion (KC), which takes into account a domain ontology and the user's interest in exploring certain data sets to extract knowledge, in the form of semantic nets, from large data sets. The KC method has been successfully applied to mine causal relations from oil platform accident reports. In a comparison with association rule techniques for the same domain, KC has shown a significant improvement in the extraction of relevant knowledge, using processing complexity and knowledge manageability as the evaluation criteria.

Xengine

XACML has become the de facto standard for specifying access control policies for various applications, especially web services. With the explosive growth of web applications deployed on the Internet, XACML policies grow rapidly in size and complexity, which leads to longer request processing time. This paper concerns the performance of request processing, which is a critical issue and so far has been overlooked by the research community. In this paper, we propose XEngine, a scheme for efficient XACML policy evaluation. XEngine first converts a textual XACML policy to a numerical policy. Second, it converts a numerical policy with complex structures to a numerical policy with a normalized structure. Third, it converts the normalized numerical policy to tree data structures for efficient processing of requests. To evaluate the performance of XEngine, we conducted extensive experiments on both real-life and synthetic XACML policies. The experimental results show that XEngine is orders of magnitude more efficient than Sun PDP, and the performance difference between XEngine and Sun PDP grows almost linearly with the number of rules in XACML policies. For XACML policies of small sizes (with hundreds of rules), XEngine is one to two orders of magnitude faster than the widely deployed Sun PDP. For XACML policies of large sizes (with thousands of rules), XEngine is three to four orders of magnitude faster than Sun PDP.

Optimization Models for Training Belief-Rule-Based Systems

A belief rule-base inference methodology using the evidential reasoning approach (RIMER) has been developed recently, where a new belief rule representation scheme is proposed to extend traditional IF-THEN rules. The belief rule expression matrix in RIMER provides a compact framework for representing expert knowledge. However, it is difficult to accurately determine the parameters of a belief rule base (BRB) entirely subjectively, particularly, for a large-scale BRB with hundreds or even thousands of rules. In addition, a change in rule weight or attribute weight may lead to changes in the performance of a BRB. As such, there is a need to develop a supporting mechanism that can be used to train, in a locally optimal way, a BRB that is initially built using expert knowledge. In this paper, several new optimization models for locally training a BRB are developed. The new models are either single- or multiple-objective nonlinear optimization problems. The main feature of these new models is that only partial input and output information is required, which can be either incomplete or vague, either numerical or judgmental, or mixed. The models can be used to fine tune a BRB whose internal structure is initially decided by experts' domain-specific knowledge or common sense judgments. As such, a wide range of knowledge representation schemes can be handled, thereby facilitating the construction of various types of BRB systems. Conclusions drawn from such a trained BRB with partially built-in expert knowledge can simulate real situations in a meaningful, consistent, and locally optimal way. A numerical study for a hierarchical rule base is examined to demonstrate how the new models can be implemented as well as their potential applications.

Evaluating Learning Algorithms to Support Human Rule Evaluation Based on Objective Rule Evaluation Indices

In this paper, we present an evaluation of learning algorithms of a novel rule evaluation support method for post-processing of mined results with rule evaluation models based on objective indices. Post-processing of mined results is one of the key processes in a data mining process. However, it is difficult for human experts to completely evaluate several thousands of rules from a large dataset with noise. To reduce the costs in such rule evaluation task, we have developed a rule evaluation support method with rule evaluation models that learn from a dataset. This dataset comprises objective indices for mined classification rules and evaluation by a human expert for each rule. To evaluate performances of learning algorithms for constructing the rule evaluation models, we have done a case study on the meningitis data mining as an actual problem. Furthermore, we have also evaluated our method with ten rule sets obtained from ten UCI datasets. With regard to these results, we show the availability of our rule evaluation support method for human experts.

Parallel tree search: An algorithmic approach for multi-field packet classification

To support advanced functions such as quality of service provisioning, firewall, and virtual private networks, today’s IP routers need to classify incoming packets into flows. The classification problem becomes extremely difficult when the system needs to process millions of packets per second, matching them against a filter database with tens of thousands of rules. Dynamic updates to the filter database and scalability to IPv6 with 128-bit addresses pose great challenges to the classification methods. We adopt the two-stage classification approach of Baboescu et al. [F. Baboescu, S. Singh, G. Varghese, Packet classification for core routers: is there an alternative to CAMs?, IEEE INFOCOM 2003.] The first stage determines the best matching source and destination prefix pair, and the second stage determines the highest priority matching filter by comparing the remaining fields against a short list of candidate rules in parallel. The first stage 2-D search problem is reduced to a pseudo 1-D problem by a process called filter decomposition. The decomposed filters are organized as a height-balanced search tree. The search operation is speeded up by parallel processing techniques to achieve a throughput of one packet per memory cycle. Our method is scalable to large filter databases and IPv6. It also allows incremental updates to the data structures.

Unsupervised learning of natural languages

We address the problem, fundamental to linguistics, bioinformatics, and certain other disciplines, of using corpora of raw symbolic sequential data to infer underlying rules that govern their production. Given a corpus of strings (such as text, transcribed speech, chromosome or protein sequence data, sheet music, etc.), our unsupervised algorithm recursively distills from it hierarchically structured patterns. The adios (automatic distillation of structure) algorithm relies on a statistical method for pattern extraction and on structured generalization, two processes that have been implicated in language acquisition. It has been evaluated on artificial context-free grammars with thousands of rules, on natural languages as diverse as English and Chinese, and on protein data correlating sequence with function. This unsupervised algorithm is capable of learning complex syntax, generating grammatical novel sentences, and proving useful in other fields that call for structure discovery from raw data, such as bioinformatics.

EFFICIENT DEFEASIBLE REASONING SYSTEMS

For many years, the non-montonic reasoning community has focussed on highly expressive logics. Such logics have turned out to be computationally expensive, and have given little support to the practical use of non-monotonic reasoning. In this work we discuss defeasible logic, a less-expressive but more efficient non-monotonic logic. We report on two new implemented systems for defeasible logic: a query answering system employing a backward-chaining approach, and a forward-chaining implementation that computes all conclusions. Our experimental evaluation demonstrates that the systems can deal with large theories (up to hundreds of thousands of rules). We show that defeasible logic has linear complexity, which contrasts markedly with most other non-monotonic logics and helps to explain the impressive experimental results. We believe that defeasible logic, with its efficiency and simplicity, is a good candidate to be used as a modeling language for practical applications, including modelling of regulations and business rules.

Propositional Plausible Logic: Introduction and Implementation

Plausible Logic allows defeasible deduction with arbitrary propositions, and yet when sufficiently simplified it is very similar to the Defeasible Logics of Billington and Nute. This paper presents Plausible Logic, explains some of the ideas behind the definitions, applies Plausible Logic to an example, and proves a coherence result which indicates that Plausible Logic is well behaved. We also report the first complete implementation of propositional Plausible Logic. The implementation has a web interface which makes it available to researchers and students everywhere. The implementation is evaluated experimentally, and is shown to be capable of handling tens of thousands of rules and sufficiently many disjunctions for realistic problems.