Deflation DFA: Remembering History is Adequate

Transcription

1 This full text pper ws peer reviewe t the iretion of IEEE Communitions Soiety subjet mtter experts for publition in the IEEE ICC 21 proeeings Defltion DFA: Remembering History is Aequte Yi Tng 1, Tinfn Xue 2, Junhen Jing 1 n Bin Liu 1 1 Ntionl Lbortory for Informtion Siene n Tehnology, 1 Deprtment of Computer Siene n Tehnology, Tsinghu University, Beijing, PRC 2 Deprtment of Informtion Engineering, The Chinese University of Hong Kong, Hong Kong Emil: tngy5@mils.tsinghu.eu, jimmyxuetinfn@gmil.om, livej@gmil.om, lmyujie@gmil.om ABSTRACT There is n inresing emn for network evies to perform eep pket inspetion (DPI) to enhne network seurity. In DPI the pket pylo is ompre ginst set of preefine ptterns whih n be speifie using regulr expressions (regexes). It is well-known tht mpping regexes to eterministi finite utomt (DFA) will suffer from the stte explosion problem. Through observtion, we ttribute DFA explosion to the neessity of remembering mthing history. In this pper, we investigte how to reor the mthing history effiiently n propose n extene DFA pproh for regex mthing lle fq-fa, whih n mke memory size reution of bout 1 times with fully utomte pproh. In fq-fa, we use pipeline s n ounters to help reoring the mthing history. Hene, stte explosion use by Kleene losure n repetitions n be efinitely voie. Further, it hieves fully utomte signture ompiltion with polynomil running time n spe. Key Wors Deterministi Finite Automt (DFA), Deep Pket Inspetion (DPI), Regulr Expression (Regex) I. INTRODUCTION Nowys, seurity hs beome one of the most serious onerns on urrent Internet. Network Intrusion Detetion Systems (NIDSes) hve been opte by enterprises to efen ginst ll kins of exploits towrs them. In the ommeril worl, regulr expression (regex) hs lrey been the e fto signture stnr for signture-bse NIDSes [7][1], beuse of its expressiveness n mthing effiieny [14]. The fmous open-soure NIDS, Snort [7], hs more thn 11 signtures. To mke the signture hrer to be eve by ttkers, people ten to write more n more omplex regexes s signtures. It use the memory size of nïve DFA-bse regex pprohes uneptble, whih inreses exponentilly in worst se, e.g., the Snort HTTP signture set will result in DFA lrger thn 15GB [4]. Vrious pprohes [1][3][4][5][8][9][13] hve been propose to solve this issue. As is well known regex DFA explosion is result of some funtions suh s Kleene losure (.*, [^]* ) or length restritions ( {1} ). However, few works investigtes tht ifferent losures n restritions hve ifferent impt on the DFA stte explosion. Tble I is n exmple of exponentil infltion use by length restrition. Though the regexes re very simple, the sttes ber for these regexes hnge rmtilly. In this pper, we ttribute the regex DFA explosion to the neessity of remembering mthing history. For regex [ b]{13}, the prefix overlps with length restrition [ b]{13}. To over ll ses, the DFA shoul remember the ounter sttus when prefix is mthe eh time. For regex 'b[^b]{1}', the prefix b oes not overlp with [^b]{1}. So, it is not neessry to remember ny history informtion. For rel wor ses, it is more omplite, we will isuss intensively in setion III.E. TABLE I. INFLATION CAUSED BY LENGTH RESTRICTION Regex # of sttes Regex # of sttes A 2 b 3 [ b]{11} 496 b[^b]{1} 33 [ b]{12} 8192 b[^b]{1} 33 [ b]{13} b[^b]{1} 33 On the purpose of proviing n lterntive regex implementtion rther thn DFA or erous DFA ompression methos, we investigte how to reor the regex mthing history effiiently. In this pper, we introue bit- to remember mthing history n further propose new sheme lle fq-fa. Fq-FA hieves fully utomte signture ompiltion with polynomil running time n spe. In generl, our mjor ontributions n vntges re highlighte below: 1. By introuing bit-s we n remember the history on whih prts of the regulr expressions hve been mthe esily. This enbles us to onvert regex to fq-fa in fully utomte mnner. As fr s we know, our reserh is the first effort to hieve memory reution n mthing effiieny in fully utomti generte regex mthing system in polynomil time n spe 2. Different losures require ifferent mount of uxiliry informtion n we evise generl rule to eie whether losure is frienly (requiring little uxiliry informtion) or not. Therefore, we n istribute less uxiliry informtion to those frienly rules to hieve better ompression effet. 3. Our metho supports inrementl upting for regex rules. It is esy to insert or elete ny regex rule t running time without requiring the mthing system to reompile ll the other rules. Current utomton bse methos n hrly support inrementl upting regex rules. The evlution is bse on 71 rnomly hosen Snort HTTP rules. They require more thn 2GB memory to ombine together, however, in our pproh only nee 53KB DFA plus.3kb register memory for keeping the histori mthing informtion. Further, we hieve suh performne in fully utomte mnner. This pper is orgnize s follows. After relte work presente in setion II, we give the ie of fq-fa n its optimiztion in setion III. The experimentl is provie in setion IV. We will rw the onlusion in setion V /1/$ IEEE

2 This full text pper ws peer reviewe t the iretion of IEEE Communitions Soiety subjet mtter experts for publition in the IEEE ICC 21 proeeings II. RELATED WORK Currently, most pprohes fous on how to moify DFA struture to sve memory without muh mthing overhe. There re two mjor iretions in the reserh of DFA s efltion. One is to eliminte trnsition reunny; the other is to reue stte explosion. For trnsition eliminting, Kumr et l. propose D2FA [9], whih ompresses DFA through the introution of efult trnsition, n it tres off storge requirement with proessing time. CD2FA [8] following D2FA is propose by using reursive ontent lbels to reue the imeter bouns of D2FA to 2 with only one 64-bit wie memory ess. In [13], Behi propose to limit the boun of the ber of efult pths in D2FA, n improve the worst se of it. Essentilly these methos re trgeting t reue the ber of trnsition, whih oes not touh the kernel of regex DFA explosion n fil to obtin goo performne. For efltion stte explosion, in [6], Behi propose n lgorithm to merge sttes, whih reue prtil sttes into lbele trnsitions n n hieve memory reution one orer of mgnitue. However, to buil the ombine DFA is very hr given its size my be 1GB or even 1GB. Currently, the stte of rt work XFA [2][4]. It uses uxiliry informtion to reue spe requirement. To buil DFA with uxiliry informtion, first, NXFA (A NXFA is NFA with noneterministi uxiliry t omin) is onstrute from the prsing tree of regulr expression; Seon, n originl XFA is built from NXFA by ε-elimintion n eterminiztion; Thir, n effiient implementble t omin (EIDD) is foun n mppe to the originl XFA, in orer reue the size of uxiliry informtion. However, the tul performne of this lgorithm remins rguble. First of ll, the originl XFA hs little effet on reuing the spe requirement. In XFA, it first uses noneterministi uxiliry informtion (t omin) to represent rules n then onverts it to eterministi one. However, this will use possible uxiliry memory bloting up, s n possible vlues of uxiliry memory in NXFA my le to 2 n possible ones in XFA, just like n possible stte in NFA my le to 2 n possible sttes in DFA. This t omin explosion in XFA n lso be expline in forml wy. If the originl DFA hs A sttes, n the XFA hs B sttes n C possible vlues of uxiliry informtion, then it must stisfy the following ineqution: A<BC, otherwise XFA nnot emonstrte ll ses of originl DFA. Consequently, the totl memory requirement B+C is no less thn O( A. For the originl DFA with O(2 ) sttes, XFA will hve O(2 /2) sttes, whih is lso n exponentil size. Notie, this is best se boun. Atully, for most rules, the originl XFA hs similr size of the tritionl DFA. To solve this problem, XFA introues EIDD to reue uxiliry informtion requirement. Although EIDD n gretly reue the size of uxiliry memory, it brings nother problem: fining mpping from EIDD to XFA is rther time onsuming job. As no systemti wy to fin goo EIDD, the only wy is to refully exmine the rules n esign EIDD mnully. This my be fesible for simple rule, but for those omplex rules with lrge uxiliry informtion, there is no gurntee tht most effiient EIDD n be foun by mnul-effort, or even if it is foun, it my require muh time n effort. Aoring to [4], these kins of rules oupy the 13.5% in the rule set they hoose. The mjor problem of XFA is the use of noneterministi uxiliry informtion s gngwy to buil XFA. This not only fils to mke the problems simpler, but tully introue gret time n mnul ost in onstruting XFA. In the next setion, we will give n utomt iretly onstrute from regex, whih n voi the problems in XFA. III. THE IDEA OF FCQ-FA As its nme, fq-fa ontins three prts: DFA, flg/ounter n. DFA prt is just norml DFA built from sub-rules resulte from breking rules by eliminting Kleene losure n length restrition. There re some tions tken on sttes, usully on finl sttes. Flg/ounter is use to mrk n rrivl of losure or length restrition respetively. The is use to reor the mthing history of ertin prts of regex. To lerly stte our ie, we strt with simple exmple with losures using fq-fa (without ounter), then followe by nother exmple with length restrition opting q-fa (without flg). A. The Bsi Ie of fq-fa For the smple with two rules: r1=.*b[^]*, r2=.*ef. We first eliminte losures of the regexes, brek them into three sub-rules: s1= b, s2=, s3= ef. Figure 1 shows the orresponing fq-fa struture (some of the trnsitions hve been omitte to keep it reble). In this exmple the orresponing regex of the DFA is (.*s1.*s2.*s3)=(.*b.*.*ef). Sine there is only one losure, we use single flg. The flg represents whether the sub-regex hs mthe up to the losure, b[^]* in this exmple. Eh time when new hrter is re in, the flg n be set or 1, or remin unhnge. Here we set the flg whenever the DFA rehes stte 2 n ler it s long s the input hrter is, otherwise the flg remins unhnge. If [1]=1, mth b[^]* 3 4 e Set flg 1 Mth ef 5 f 6 flg: -If input =, flg <= -If ur_stte = 2, flg <= 1 flg : [] [1] : -For eh input hrter, will shift right & [] <= flg Figure 1. Exmple of fq-fa for Regex (r1=.*b[^]*, r2=.*ef ) The system mintins to store most reent n flg vlues. When input hrter omes, we shift to the right for one step n set [] the flg vlue of lst yle. The length is eie by the length of sub-rule just fter losure. Here length is 2 s the length of s2. The following is smple illustrting the exeution of fq-fa, using bef s n input string. When prsing to

3 This full text pper ws peer reviewe t the iretion of IEEE Communitions Soiety subjet mtter experts for publition in the IEEE ICC 21 proeeings stte 2, it will set flg 1, whih mens b[^]* is mthe. When rriving stte 3, [1] will be heke. As the vlue is 1, it will report tht rule b[^]* hs been mthe. Notie tht lthough flg is t tht time, fq-fa still remembers tht flg ws 1 two hrters go using, n therefore it orretly reports mth. The intuition behin this exmple is tht fq-fa remember the history when b[^]* is mthe. After the is mthe we use the bit- to hek whether the b[^]* hs lrey been mthe before rriving. If yes, it is vli mth of whole expression. The key is to use struture to reor the history informtion. B. The bsi ie of q-fa We tke rule set: r1= b[^]{2}e, r2= ef s n illustrtion. For eliminte length restrition, we brek rules into sub-rules: r1= b, r2= e, r3= ef n then onstrut the orresponing q-fa, s Figure 2 shows. In q-fa we move the rightmost bit of the ounter, rther thn the previous flg vlue, to the leftmost bit of. A ounter is n m+1 -bit- s stte bove. It n be set n reset, n shifte right on every input. When ounter is set, ount[] will be set to 1 ; When the ounter is reset, ll in it will be set to. This ours when the input hrter is onfliting with hrter set of losure (in this se, { }). Besies, ll will shift one step right eh turn, n the leftmost bit is put into the oringly. For input string bbee, notie tht the seon time sub-rule e is mthe, it will not report mth, beuse t tht time [1] is lrey sine the first input of hs reset the whole vlue of ounter. By ombining fq-fa n q-fa, we n get the fq-fa. The following subsetions will show the steps in builing mthing system using fq-fa. C. Rewrite rules n buil DFA Engine The first step of onstruting fq-fa system is to rewrite rules. One originl rule will be broken into severl sub-rules to stisfy following requirements: First, no losure or length restrition ppers t sub-rules; seon, sub-rule shoul hve fixe length, otherwise it shoul be further split. Tble II shows the result of rewriting rule b[^]*(b b)[^b]*e. First two losures [^]* n [^b]* hve been eliminte, then we get three sub-rules ounter[] <= 1 ounter : [] [1] [2] : [] [1] ounter : : -if input =, -eh turn, 3 e 4 f 5 Mth ounter[i] <=, i=,1,2 1. will shift right ef -if ur_stte = 2, ounter[] <= 1 2.[] <= ounter[2] if [1]=1, -eh turn mth b[^]{2} ounter will shift right Figure 2. Exmple of q-fa for Regex(r1= b[^]{2}e, r2= ef ) b, (b b) n e. Sine (b b) oes not hve fixe length, it is further split into b n b. Besies, some tgs re ssigne to show positions of sub-rules in the originl rule. In this se, f1 is use to represent the losure [^]* n f2 is use to represent [^b]*, so (f1,f2) mens tht sub-rule b is lote between [^b]* n [^]*. For eh losure, we use n flg; for eh length restrition, we use n ounter. TABLE II. REWRITTEN RULES Then we buil DFA using these sub-rules. We ombine ll the sub-rules vi opertor, n then buil DFA to represent this regex. The DFA of.*b.*(b b).*e is shown in Figure 3 (Still, some less importnt trnsitions re ignore to mke the figure reble. We lso mrk tions nee to tke n tgs we got bove). Besies, the inex of sub-rules being mthe nee to store on eh finl stte. [^b] b Sub-rule1: (,f1) f1 <= Sub-rule2: (f1,f2) if q1[1] = 1, f2 <= 1 Sub-rule3: (f1,f2) if q1[2] = 1, f2 <= 1 6 e 7 Sub-rule4: (f2,) if q2[1] = 1, f2: report mth - If input = b, flg2 <= Figure 3. fq-fa of b[^]*(b b)[^b]*e f1: - If input =, flg1 <= D. Builing mthing system Here, we use two tbles (tion tble n invlition tble) to store the tions to tke on eh stte. Ation tble tells us when to set flg, ounter or report mth, while invlition tble preserve when to reset flg or ounter. TABLE III. ACTION TABLE OF AB[^A]*(B AB)C[^B]*DE request length tion While Reing (sub-rule) null 2 set f1 b f1 2 set f2 b f1 3 set f2 b f2 2 report mth r1 e

4 This full text pper ws peer reviewe t the iretion of IEEE Communitions Soiety subjet mtter experts for publition in the IEEE ICC 21 proeeings In tion tble, eh row stns for sub-rule. An for eh sub-rule, there re three entries: request, length n tion. The request entry inite whih we nee to hek when this sub-rule is mthe. The length entry shows the length of this sub-rule, n further implies whih bit of tht nees to be heke. An tion entry illustrtes wht we nee to o if the sub-rule is mthe n request is fit. We still use the exmple mentione bove. Sine the requeste entry of sub-rule b is f1 n the length entry is 2 (shown in Tble III), when sub-rule b is mthe, we nee to hek whether q1[2-1] is 1. If yes, we will set flg2. (Here, flg k n q[k] represent kth flg n kth respetively, n we suppose tht kth flg is orrespon with kth ) TABLE IV. INVALIDATION TABLE OF AB[^A]*(B AB)C[^B]*DE input f1 f2 1 b 1 others 1 1 In the invlition tble, eh row represents possible input hrter n eh olumn represents flg or ounter. The vlue of the tble entry my be either or 1. If ertin entry is, for exmple, t[, f1] = (shown in tble IV), it mens tht when the input hrter is, it will reset f1; Otherwise the f1 will remin unhnge. E. Reue uxiliry informtion The fq-fa hs signifintly reue the sttes ber of DFA, but the uxiliry memory lso inurs high ost. In this subsetion, we introue metho to eliminte some of reunnt uxiliry informtion for fq-fa. Different losures n length restritions tully ply ifferent roles in regex, through istinguishing ifferent properties of losures n treting them iversely, we hieve reution memory bout 5% for bit-s. First, for rule like r1[^]*r2, if it stisfies the following two qulities, only one bit is require to represent the losure without introuing ny flse negtive or flse positive (Here enotes for ny hrter or hrter set): 1. For ny string s 1 Lr () 1 ns 2 Lr () 2, suffix of s1 oesn t equl to prefix of s2. Also, s1 itself oesn t pper in s2. 2. For ny string s 2 Lr ( 2 ), ny hrter ' s shoul 2 not pper t (tht is ' ). The onition 1 ensures tht when mthing r2, the flg will not be set to 1 ; the onition 2 gurntees tht when mthing the sub-rule r2, flg will not be set to. In this wy, we n eliminte the from fq-fa, n when r2 is mthe, we nee only hek the orresponing flg. If the regex just stisfies onition 2 but not onition 1, the flg n be reple by n integer ounter of strlen(r2), not just 1 bit. Tking regex b[^]*b s n exmple, the regex stisfies onition 2 but not onition 1. Hene, the bit- for losure [^]* nnot be eliminte. Otherwise, when system is reing b, the flg is set 1, menwhile DFA for b b mthes string b. If using 1-bit flg, rther thn bit-, the system will report flse positive results. Another exmple, for regex b[^]*ef, it stisfies onition 1 but not onition 2. So, while mthing ef, the flg for [^]* will be set to. If using just 1-bit flg, system woul report flse negtive results. As for ounter, we n use n integer ounter rther thn n-bit- in some ses. For rule like r1[^]{n}r2, if the following property is met, the length restrition n be reple by simple integer ounter: 1. For ny string s 1 Lr () 1, there is t lest one hrter ' s1 ppering t (tht is ' ) This onition ensures tht when mthing [^]{n}, r1 will not be mthe n onsequently the ounter will not be set gin. Hene, n integer ounter is enough in this se. This n reue the spe requirement, beuse for length restrition [^]{n}, we nee (n+1) if bit- is use, while only log(n) re is neee if n integer is use. F. A more Complite Exmple Tking regex of protool imesh in L7-filter [12] s exmple, using originl wy to buil DFA, it will hve 3416 sttes n trnsitions. Suh lrge memory requirement will mke the hrwre implementtion impossible if we ombine suh rules together. The regex is: ^(post[\x9-\x\x2-~]*<pssworhsh>...</psswor Hsh><ClientVer> \x34\x8?\x?\xf\xff\x4 get[\x9-\x\x2-~]*host :\x2imsh\.ownlo-pro\.musinet\.om \x2(\x1 \x2)\x83.?.?.?.?.?.?.?.?.?.?.?.?.?.?.?.?.?.?.?.?.?.?.?.?.?.?.?.?\x2(\x1 \x2)\x83) First, we ivie the big rule into smll ones oring to the opertor. The bove regex is split into 4: 1.^(post[\x9-\x\x2-~]*<PssworHsh>...</Psswo rhsh><clientver>) 2.^(\x34\x8?\x?\xf\xff\x4) 3.^(get[\x9-\x -~]*Host: imsh\.ownlo-pro\.musinet\.om) 4.^(\x2(\x1 \x2)\x83.?.?.?.?.?.?.?.?.?.?.?.?.?.?.?.?.?.?.?.?.?.?.?.?.?.?.?.?\x 2(\x1 \x2)\x83) An tion tble is proue by going through the regex. TABLE V. ACTION TABLE OF IMESH REGEX Sub-rule Request Length Ation ^post null set f1 <PssworHsh> f1 14() set q1 </PssworHsh><ClientVer> q mthe ^(\x34\x8?\x?\xf\xff\x4) null mthe ^get null set f2 Host: imsh\.ownlo-pro\.musinet\.om f2 37() mthe ^\x2(\x1 \x2)\x83 null set q2 \x2(\x1 \x2)\x83 q2-24 mth Menwhile, we ombine new generte sub-rules. The DFA for ombine rules hs 1 sttes n 38 trnsitions. Compring with the tritionl DFA whih hs 3416 sttes n trnsitions, fq-fa efltes the DFA gretly by only introuing 4 bit-s, while 2 of them (f1 n f2) n be further eliminte s optimiztion

5 This full text pper ws peer reviewe t the iretion of IEEE Communitions Soiety subjet mtter experts for publition in the IEEE ICC 21 proeeings sheme isusse in setion III.E. Moreover, the whole proess is omplishe utomtilly without ny mnul effort. IV. EXPERIMENTAL EVALUATION A. Experiment on smple rules We rnomly selet 71 rules from Snort s web pre ruleset. The result is shown in tble VI. Sub rules TABLE VI. Flg ount BIT-QUEUES S CONSUMPTION Flg flg ount ounter flg ounter The rule set ontins of 71 regexes, whih proues 174 sub-rules s tble VI shows. The length restrition ppers 28 times in 71 rules. The verge length of them is 266 (7445/28), n the longest is 124. fq-fa n be onstrute regrless the length n. In evlution, 13 of 28 ounter bit-s n be reple. An the totl length of ounter reues from 7445 to In fq-fa, the DFA for the ombintion of 174 sub-rules requires 2862 sttes. For totl memory requirement of fq-fa, we must onsier memory use by DFA s well s bit-. As the bove Tble VI, less thn.6m bytes of stti memory plus.3k bytes ynmi register re neee to represent the ombintion of these 71 Snort rules. B. Experiment on Snort rule We lulte the memory onsumption of our system for Snort-web, Snort-ftp, Snort-smtp n Snort-voip. Notie tht bitmp ompression oes not use to optimize bit- here. set TABLE VII. SNORT RULE S MEMORY INFOMATION Flg Counter flg ounter web ftp smtp voip Mem. Sub Combine Combine in fq-fa set for rule DFA DFA Sttes Sttes Trnsition web 9KB 495 >3.1M ftp 3KB 114 >3.1M smtp 7kB 141 >3.1M voip 1KB 513 >3.1M Tble VII shows the gret effet of fq-fa on eflting the DFA of Snort rules. Espeilly, to buil mthing system of 733 Snort web rules, 9MB stti memory n 2KB ynmi memory is require here, whih the tritionl DFA implementtion my ost lrger thn 1 GB. V.CONCLUSION AND FUTURE WORK In this pper we fin the essene of regex DFA explosion is to remember the mthing history. Bse on this observtion, we propose kin of extene DFA with severl bit-s (fq-fa) to help reoring the mthing history. It elimintes most losures n length restritions in regex, whih re the mjor uses of the explosion. Compre with other lgorithms using uxiliry memory, fq-fa hieves better spe performne n less generting n upting time. The essene of fq-fa is utilizing bit-s to reor mthing history to hieve the efltion of DFA. While, XFA uses instrutions to hnle regexes, whih is generl CPU pproh n requires lots of mnul work to hieve optimiztion n is error-prone. ACKNOWLEDGMENT This work is supporte by NSFC (662521, , ), 973 projet (27CB3171), 863 high-teh projet (27AA1Z216) n Tsinghu University Inititive Sientifi Reserh Progrm VI.REFERENCES [1] F. Yu et lt., Fst n Memory-Effiient Regulr Expression Mthing for Deep Pket Inspetion, in ANCS 26 [2] R. Smith, C. Estn, Somesh Jh, Deflting the Big Bng: fst n slble eep pket inspetion with vrible-extene utomt SIGCOMM, August 2 [3] S. Kumr, Blkrishnn Chnrsekrn, Jonthn Turner, George Vrghese, Curing Regulr Expressions Mthing Algorithms from Insomni, Amnesi, n Aluli, in ANCS 27 [4] R. Smith, C. Estn, Somesh Jh XFAs: Fster signture mthing with extene utomt, IEEE Symposium on Seurity n Privy (Okln), My 28 [5] B.C. Broie, R.K. Cytron, n D.E. Tylor. A Slble Arhiteture for High-Throughput Regulr-Expression Pttern Mthing. In ISCA, Boston, MA, June 26. [6] M. Behi n S. Cmbi. Memory-effiient regulr expression serh using stte merging. INFOCOM, My 27. [7] Snort [8] S. Kumr, J. Turner n J. Willims, Avne Algorithms for Fst n Slble Deep Pket Inspetion, in ANCS 26 [9] S. Kumr et lt., Algorithms to Aelerte Multiple Regulr Expressions Mthing for Deep Pket Inspetion, in ACM SIGCOMM, Sept 26. [1] Bro Intrusion Detetion System. [11] Perl Comptible Regulr Expressions: [12] "Applition Lyer Pket Clssifier for Linux." [13] M. Behi n P. Crowley, An Improve Algorithm to Aelerte Regulr Expression Evlution, ANCS 27. [14] R. Sommer n V. Pxson, Enhning Byte-Level Network Intrusion Detetion Signtures with Context, Pro. ACM CCS 23