Deterministic Finite-Automata Abstractions of Time-Variant Sequential Behaviours

This Paper presents a multimodal spectral metrics and Deterministic Finite Automata (DFA) in a manner to enhance the detection of spikes and seizures in epileptiform activity from Electroencephalograms (EEG). To develop robust classification rules for identifying epileptiform activity in the human brain the authors present a new methodology to connect their previous work where successful prediction of epileptiform activity was achieved through the use of DFA. The link between DFA seizure detection operating in the time-domain and frequency domain seizure detection has been a non-trivial task and this paper presents a means to link four power spectra metrics of rat EEG experiencing epilepsy seizures and previous work by the authors where the same rats experience seizures that the authors DFA algorithm identified the seizures. We propose a system that links 1) four power spectra metrics capable of detecting seizure activity with 2) Deterministic Finite Automata (DFA). It is a common goal for those skilled in the art of epilepsy prediction to create classifiers that are used to make rules and isolate characteristic events leading to an epileptic seizure. Herein, we present a means to link time and frequency domains using various spectral metrics and DFA to identify the electrographic onset of a seizure.

In this paper, the similarity between a pair of text documents is measured by identifying three sets of words: words that exist in the first but not in the second, in the second but not in the first and those words that exist in both. Two deterministic finite automata are built to recognize the words of the two documents. These finite state automata are used to identify these three sets of words. An experimental study was conducted to present the proposed approach and to compare it with other peer text similarity measures: Jaccard and cosine distance. The proposed approach gave more reasonable results than Jaccard but more inflated than cosine distance approach.

Many difficult open problems in theoretical computer science center around nondeterminism. We study the fundamental problem of converting a given deterministic finite automaton (DFA) to a minimal nondeterministic finite automaton (NFA). Despite extensive work on finite automata, this fundamental problem has remained open. Recently, in [Ji91] we studied this problem and showed that this (and related) problems are computationally hard. Here we study the restriction of this problem to the case when the input DFA is over a one-letter alphabet. Even in this restricted case the problem is computationally hard even though our evidence of hardness is different from (and is weaker than) the standard ones such as NP-hardness. Let A → B denote the problem of converting a finite automaton of type A to a minimal finite automaton of type B. Our main result is that DFA → NFA, when the input is a unary cyclic DFA (a DFA whose graph is a simple cycle), is in NP but not in P unless NP ⊑ DTIME(nO(log n)). Our work was also motivated by the problem of finding structurally simple ‘normal forms’ of NFA's over a unary alphabet. We present some normal forms for minimal NFA's over a unary alphabet and present an application to lower bounds on the size complexity of an NFA. In fact, the normal form result is used in a nontrivial manner to show the NP membership result stated above.

Angluin's L$^*$ algorithm learns the minimal deterministic finite automaton (DFA) of a regular language using membership and equivalence queries. Its probabilistic approximatively correct (PAC) version substitutes an equivalence query by numerous random membership queries to get a high level confidence to the answer. Thus it can be applied to any kind of device and may be viewed as an algorithm for synthesizing an automaton abstracting the behavior of the device based on observations. Here we are interested on how Angluin's PAC learning algorithm behaves for devices which are obtained from a DFA by introducing some noise. More precisely we study whether Angluin's algorithm reduces the noise and produces a DFA closer to the original one than the noisy device. We propose several ways to introduce the noise: (1) the noisy device inverts the classification of words w.r.t. the DFA with a small probability, (2) the noisy device modifies with a small probability the letters of the word before asking its classification w.r.t. the DFA, (3) the noisy device combines the classification of a word w.r.t. the DFA and its classification w.r.t. a counter automaton, and (4) the noisy DFA is obtained by a random process from two DFA such that the language of the first one is included in the second one. Then when a word is accepted (resp. rejected) by the first (resp. second) one, it is also accepted (resp. rejected) and in the remaining cases, it is accepted with probability 0.5. Our main experimental contributions consist in showing that: (1) Angluin's algorithm behaves well whenever the noisy device is produced by a random process, (2) but poorly with a structured noise, and, that (3) is able to eliminate pathological behaviours specified in a regular way. Theoretically, we show that randomness almost surely yields systems with non-recursively enumerable languages.

There is an increasing demand for network devices to perform deep packet inspection (DPI) in order to enhance network security. In DPI, the packet payload is compared against a set of predefined patterns that can be specified using regular expressions (regexes). It is well-known that mapping regexes to deterministic finite automaton (DFA) may suffer from the state explosion problem. Through observation, we attribute DFA explosion to the necessity of remembering matching history. In this paper, we investigate how to manage matching history efficiently and propose an extended DFA approach for regex matching called fcq-FA, which can make a memory size reduction of about 1,000 times with a fully automated approach. In fcq-FA, we use pipeline queues and counters to help record the matching history. Hence, state explosion caused by Kleene closure and length restriction can be completely avoided. Furthermore, it achieves a fully automated signature compilation with polynomial running time and space. The equivalence between fcq-FA and the traditional DFA is guaranteed by a strict theoretical proof, which means fcq-FA can process all the regexes supported by the traditional DFA.

This paper is a continuation of the goal to connect power spectra and Deterministic Finite Automata (DFA) in a manner to enhance the detection of spikes and seizures in epileptiform activity from Electroencephalograms (EEG). The goal is to develop robust classification rules for identifying epileptiform activity in the human brain. This paper presents advancement using the author’s proprietary developed spectral analysis to link power spectra of rat EEGs experiencing epilepsy seizures with the authors DFA algorithm and their MATLAB spectral analysis. We present a system that links 1) power spectra of seizures, in sleep, spike and seizure states with 2) Deterministic Finite Automata (DFA). Combining power spectra with DFA to correctly predict and identify epileptiform activity (spikes) and epileptic seizures opens the door to creating classifiers for seizures. It is a common goal for those skilled in the art of epilepsy prediction to create classifiers to make rules and discretize events leading to an epileptic seizure. Herein we present a means to link time and frequency domain components from MATLAB and proprietary software to clinical epileptiform activity.

In this paper, we propose a new approach for off-line intelligent word recognition. Firstly, we segment a word into its single characters. Then, we tag every pixel of a character as vertical or horizontal and group them into vertical and horizontal strokes. We propose as main features the locations of the joints between a vertical stroke and each of their adjacent horizontal ones. These features can easily be obtained by dynamic zoning. After that, a Deterministic Finite Automaton (DFA) along with a regular grammar, let us generate a representative string of the above mentioned features. For the experiments we constructed sets of synthetic words from real characters written by two different authors to generate a knowledge base for each of the writers with the strings provided by the DFA. To achieve the recognition, we use an Inference Engine that matches representative strings of characters from unknown test words with those characters stored in the Knowledge Base. The experiments provide promising results.

In this paper, we analyze the problem of state minimization in a class of Finite State Automata called Two Start State Deterministic Finite State Automata (2-MDFAs). A 2-MDFA is similar to a deterministic finite state automaton (DFA), in that on a given input, each state has precisely one destination state; however, it differs from a DFA in that there are two start states. A string is accepted by a 2-MDFA if and only if there exists a transitional path from either start state to a finish state, on that string . Observe that 2-MDFAs provide a limited amount of non-determinism and hence investigating their properties from the perspective of state minimization is a worthwhile pursuit. In case of unbounded non-determinism, i.e., Non-deterministic finite state automata (NFAs), it is well-known that the state minimization problem is PSPACE-complete [Jiang and Ravikumar in Proceedings of the 18th International Colloquium on Automata, Languages and Programming, ICALP’91, Madrid, Spain, July 8–12, 1991] and further that such automata can be exponentially more succinct than DFAs [Meyer and Fischer in Proceedings of the 12th SWAT(Annual Symposium on switching and automata theory), pp 188-191, 1971]. Even in the case of 2-MDFAs, the minimization problem remains non-trivial; indeed, Malcher in Theor Comput Sci 327(3):375–390, 2004 shows that the corresponding decision problem is NP-complete. We focus on deriving approximability bounds for the state minimization problem in 2-MDFAs. Our main contribution in the current paper, is the design of an n -approximation algorithm for state minimization in 2-MDFAs, where n denotes the minimum number of states required to represent the input language as a 2-MDFA. We also present a proof that this bound is tight for our algorithm.

Many network security applications in today's networks are based on deep packet inspection, checking not only the header portion but also the payload portion of a packet. For example, traffic monitoring, layer-7 filtering, and network intrusion detection all require an accurate analysis of packet content in search for predefined patterns to identify specific classes of applications, viruses, attack signatures, etc. Regular expressions are often used to represent such patterns. They are implemented using finite automata, which take the payload of a packet as an input string. However, existing approaches, both non-deterministic finite automata (NFA) and deterministic finite automata (DFA), do not deal with compressed traffic, which becomes more and more popular in HTTP applications. In this paper, we propose an efficient algorithm for regular expression matching to implement deep packet inspection on compressed traffic. Based on the observations of DFA, we design a scheme to skip most of the matching process in the compressed parts of traffic. To the best of our knowledge, this is the first effort to design an efficient regular expression matching on compressed traffic. We evaluate our algorithm using rule sets provided by Snort, a popular open-source intrusion detection system. The evaluation results show that our approach can reduce the number of state access in the DFA significantly.

Deep Packet Inspection (DPI) technology has been widely deployed in Network Intrusion Detection System (NIDS) to detect attacks and viruses. State-of-the-art NIDS uses Deterministic Finite Automata (DFA) to perform regular expression matching for its stable matching speed. However, traditional DFA algorithm’s throughput is limited by the input character’s width (usually one character per time). In this paper, we present an architecture named Parallel-DFA to accelerate regular expression matching by scanning multiple characters per time. Experimental results show that, our architecture can achieve as high as 1200 Gbps (1.17 Tbps) rate on current single Field-Programmable Gate Array (FPGA) chip. This makes it a very practical solution for NIDS in 100G Ethernet standard network, which is currently the fastest approved standard of Ethernet. To the best of our knowledge, this is the fastest matching performance architecture on a single FPGA chip. Besides, the throughput is nearly 3 orders of magnitude (916\(\times \)) than that of original DFA implemented on software. Our architecture is about 183.2\(\times \) efficiency than that of original DFA.

The finite automata are mathematical models for finite state systems. More general finite automaton is the nondeterministic finite automaton (NFA) that cannot be directly used. It is usually transformed to the deterministic finite automaton (DFA) that then runs in time O(n), where n is the size of the input text. We present two main approaches to practical implementation of DFA considering CPU cache. The first approach (represented by Table Driven and Hard Coded implementations) is suitable forautomata being run very frequently, typically having cycles. The other approach is suitable for a collection of automata from which various automata are retrieved and then run. This second kind of automata are expected to be cycle-free.

Modern network devices need to perform deep packet inspection at high speed for security and application- specific services. For this purpose, regular expressions are used, due to their high expressive power, and Deterministic Finite Automata (DFAs) are adopted to match them. Many works have been proposed to improve DFAs, especially in terms of memory consumption and speed. Instead, we address another issue: the scalability of DFAs to parallel systems and their buffer requirements. To our knowledge, a single attempt to parallelize DFA walk on regular multicore systems (which ex- ploits speculation with limited efficiency) has been proposed in literature. We propose a solution in which a number of processing units are committed to walk in parallel a DFA for the same packet; at this aim, sampling techniques on both text and regular expressions are adopted. This scheme is the first in literature that proposes effective parallelization of DFA walk, hence allowing for packet processing time reduction and less memory for reordering buffers. The result is that speed scales as the number of processing units.

The authors present a method to prove equivalence of a pair of FSMs, described at the gate level with D-type flip-flops and a reset signal available to bring them into the all-zero initial state. This method restricts investigation to that minimum subset of states that can be reached from the reset condition and are necessary to reach the goal. The equivalence condition is expressed in theoretical terms within the framework of the product machine. Without any loss of information, it is possible to reduce the product machine to a deterministic finite automaton (DFA). considerably reducing the number of states. The DFA is dynamically built by an explicit enumeration algorithm and, in general, only a very small part of the automaton is actually considered. The equivalence condition becomes a proof of the reachability of the DFA's final state. Search is performed in breadth-first. Experimental results on some pairs of ISCAS'89 circuits are reported.< <ETX xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">&gt;</ETX>

Deterministic finite automata with recursive calls and DPDAs

Deep Packet Inspection (DPI) systems have been becoming an important element in traffic measurement ever since port-based classification was deemed no longer appropriate, due to protocol tunneling and misuses of well-defined ports. Current DPI systems express application signatures using regular expressions and it is usual to perform pattern matching through the use of Finite Automaton (FA). Although DPI systems are essentially more accurate, they are also resource-intensive and do not scale well with link speeds. Looking to this area of interest, this paper proposes a novel Deterministic Finite Automaton, called Ranged Compressed Deterministic Finite Automaton (RCDFA), that compresses transitions without additional memory lookups. Experimental results show that RCDFA yields space savings of 97% over the original DFA and up to 93% better compression when compared to the DFA's state-of-the-art compression techniques.