BIFER： a biphasic trace filter approach to scalable prediction of concurrency errors

Predictive trace analysis （PTA）, a static trace analysis technique for concurrent programs, can offer power- ful capability support for finding concurrency errors unseen in a previous program execution. Existing PTA techniques always face considerable challenges in scaling to large traces which contain numerous critical events. One main reason is that an analyzed trace includes not only redundant memory accessing events and threads that cannot contribute to dis- covering any additional errors different from the found can- didate ones, but also many residual synchronization events which still affect PTA to check whether these candidate ones are feasible or not even after removing the redundant events. Removing them from the trace can significantly improve the scalability of PTA without affecting the quality of the PTA results. In this paper, we propose a biphasic trace filter ap- proach, BIFER in short, to filter these redundant events and residual events for improving the scalability of PTA to expose general concurrency errors. In addition, we design a model which indicates the lock history and the happens-before his- tory of each thread with two kinds of ways to achieve the efficient filtering. We implement a prototypical tool BIFER for Java programs on the basis of a predictive trace analysis framework. Experiments show that BIFER can improve the scalability of PTA during the process of analyzing all of the traces.

基于时空主成分分析的恶意加密流量检测技术

恶意加密流量检测对关键信息基础设施的可靠运行至关重要,也是应对DDoS攻击等网络威胁的有效手段。利用时空主成分分析技术,构建了时间维度和空间维度的网络流量变化模型,实现恶意加密流量的实时检测和追踪溯源。在时间维度,利用历史积累的网络流量监测信息进行主成分分析,构建瞬时流量预测模型与实际监测流量之间的平方预测误差,判定网络中出现恶意加密流量的时刻。在空间维度,利用历史积累的各国家和地区的网络流量监测数据,构建区域流量预测模型与实际监测流量之间的平方预测误差,对恶意加密流量的来源地进行追踪溯源。最后,设计了一种可用于现网部署的算法实现流程,并分析了相比其他已有算法带来的能力提升。