Lom: Discovering logic flaws within MongoDB-based web applications

Logic flaws within web applications will allow malicious operations to be triggered towards back-end database. Existing approaches to identifying logic flaws of database accesses are strongly tied to structured query language (SQL) statement construction and cannot be applied to the new generation of web applications that use not only structured query language (NoSQL) databases as the storage tier. In this paper, we present Lom, a black-box approach for discovering many categories of logic flaws within MongoDBbased web applications. Our approach introduces a MongoDB operation model to support new features of MongoDB and models the application logic as a mealy finite state machine. During the testing phase, test inputs which emulate state violation attacks are constructed for identifying logic flaws at each application state. We apply Lom to several MongoDB-based web applications and demonstrate its effectiveness.     

Simulated performance of a data-driven database machine

One of the main limitations to high parallelism in database processing is the available 1/O bandwidth of the storage devices comprising the machine. One way to increase this bandwidth is to use multiple parallel disk units. The main problem with this approach is the lack of a computational model capable of utilizing any significant number of such devices. In this paper we present a different model, referred to as the Active Graph Model, which is based on the principles of asynchronous data-driven computation. To demonstrate the viability of this approach, we have implemented the model on a simulated multiprocessor architecture. By varying the speed of processors, memory units, communication links, and the types of queries processed, we demonstrate that the resulting database machine is capable of exploiting the I/O bandwidth of a large number of disk units as well as the computational power of the associated processors.     

DIALOG — A dataflow model for parallel execution of logic programs

The paper presents a dataflow execution model, DIALOG, for logic programs which operates on an intermediate virtual machine. The virtual machine is granulated at clause argument level to exploit argument parallelism through unification. The model utilises a new variable binding scheme that eliminates dereference operations for accessing variables, and therefore supports OR-parallelism in the highly distributed dataflow environment. The model has been implemented in Occam. A conventional dataflow architecture in support of the model has been simulated as a testbed for the evaluation. The simulation indicates some encouraging results and suggests future improvements.     

An execution model for exploiting AND-parallelism in logic programs

This paper presents a parallel execution model for exploiting AND-parallelism in Horn Clause logic programs. The model is based upon the generator-consumer approach, and can be implemented efficiently with small run-time overhead. Other related models that have been proposed to minimize the run-time overhead are unable to exploit the full parallelism inherent in the generator-consumer approach. Furthermore, our model performs backtracking more intelligently than these models. We also present two implementation schemes to realize our model: one has a coordinator to control the activities of processes solving different literals in the same clause; and the other achieves synchronization by letting processes pass messages to each other in a distributed fashion. Trade-offs between these two schemes are then discussed. This work was supported by Army Research Office grant #DAAG29-84-K-0060 to the Artificial Intelligence Laboratory at the University of Texas at Austin.     

Multiparadigm distributed computing with TPVM

Distributed concurrent computing based on lightweight processes can potentially address performance and functionality limits in heterogeneous systems. The TPVM framework, based on the notion of ‘exportable services’, is an extension to the PVM message-passing system, but uses threads as units of computing, scheduling, and parallelism. TPVM facilitates and supports three different distributed concurrent programming paradigms: (a) the traditional, task based, explicit message-passing model; (b) a data-driven instantiation model that enables straightforward specification of computation based on data dependencies; and (c) a partial shared-address space model via remote memory access, with naming and typing of distributed data areas. The latter models offer significantly different computing paradigms for network-based computing, while maintaining a close resemblance to, and building upon, the conventional PVM infrastructure in the interest of compatibility and ease of transition. The TPVM system comprises three basic modules: a library interface that provides access to thread-based distributed concurrent computing facilities, a portable thread interface module which abstracts the required thread-related services, and a thread server module which performs scheduling and system data management. System implementation as well as applications experiences have been very encouraging, indicating the viability of the proposed models, the feasibility of portable and efficient threads systems for distributed computing, and the performance improvements that result from multithreaded concurrent computing. © 1998 John Wiley & Sons, Ltd.     

R树家族的演变和发展

近年来,针对空间数据库索引的研究引起了人们越来越多的兴趣和关注．为了快速、有效地处理存储于空间数据库中的海量空间数据,专家学者提出了大量的基于磁盘的空间索引方法．其中,1984年由Guttman提出的R树是目前最流行的动态空间索引结构,广泛应用于原型研究和商业应用中．其后,人们在此基础上针对不同空间运算提出了不同改进,经过20年的发展,不断产生的R树变体逐渐形成了一个枝繁叶茂的空间索引R树家族．该文回顾了R树及其各种主要变体;描述了基于R树的各种批量操作、空间查询处理算法、查询代价模型及查询优化过程;介绍了基于R树的并行处理、并发控制与锁定策略等方面的进展;并且分析了R树的未来研究方向．     

Context-aware sequence labeling for condition information extraction from historical bridge inspection reports

Effective upkeep of aging infrastructure systems with limited funding and resources calls for efficient bridge management systems. Although data-driven models have been extensively studied in the last decade for extracting knowledge from past experience to guide future maintenance decision making, their performance and usefulness have been limited by the level of detail and accuracy of currently available bridge condition databases. This paper leverages an untapped resource for bridge condition data and proposes a new method to extract condition information from it at a high level of detail. To that end, a natural language processing approach was developed to formalize structural condition knowledge by formulating a sequence labeling task and modeling inspection narratives as a combination of words representing defects, their severity and location, while accounting for the context of each word. The proposed framework employs a deep-learning-based approach and incorporates context-aware components including a bi-directional Long Short Term Memory (LSTM) neural network architecture and a Conditional Random Field (CRF) classifier to account for the context of words when assigning labels. A dependency-based word embedding model was also used to represent the raw text while incorporating both semantic and contextual information. The sequence labeling model was trained using bridge inspection reports collected from the Virginia Department of Transportation bridge inspection database and achieved an F1 score of 94.12% during testing. The proposed model also demonstrated improvements compared with baseline sequence labeling models, and was further used to demonstrate the capability of detecting condition changes with respect to previous inspection records. Results of this study show that the proposed method can be used to extract and create a condition information database that can further assist in developing data-driven bridge management and condition forecasting models, as well as automated bridge inspection systems.     

隐喻理解的计算模型综述

国际上,隐喻在思维及语言中所处的中心地位正逐渐引起人工智能研究者的重视。但在国内学术界,还鲜有开展隐喻计算化这方面研究的;实际上,作为异常用法的隐喻现象是自然语言中的普遍情况,因此隐喻问题若得不到很好的解决,将成为制约自然语言理解和机器翻译的瓶颈问题。本文结合相关的隐喻理论基础,根据不同的计算路线对已有隐喻理解计算模型进行分类,包括基于语义优先方法、基于知识表示的方法、基于逻辑的方法和基于统计语料库的方法,并在分析这些方法的适用范围和优缺点的基础上,对隐喻的计算理解方法以及面向汉语的隐喻理解计算模型研究提出了展望和建议。     

Multi-block synchronous prediction of concrete dam displacements using MIMO machine learning paradigm

The integration of numerous monitoring points poses a significant challenge to the efficient modeling of dam displacement behavior, and multi-point synchronous prediction is an effective solution. However, traditional approaches usually construct site-specific data-driven models for each monitoring point individually, which focus on single-target regression and discard the underlying spatial correlation among different displacement monitoring points. This study therefore proposes a multi-input multi-output (MIMO) machine learning (ML) paradigm based on support vector machine (SVM) for synchronous modeling and prediction of multi-point displacements from various dam blocks. In this method, a novel multi-output data-driven model, termed as multi-target SVM (MSVM), is formulated through a deep hybridization of classical SVM architecture and multi-target regression. During the initialization of MSVM, the intercorrelation of multiple target variables is fully exploited by decomposing and regulating the weight vectors. The proposed MSVM is designed to capture the complex MIMO mapping from influential factors to multi-block displacements, while taking into account the correlation between multi-block displacement outputs. Additionally, in order to avoid obtaining the unreliable prediction results due to the empirical selection of parameters, an efficient optimization strategy based on the parallel multi-population Jaya (PMP-Jaya) algorithm is used to adaptively tune the hyperparameters involved in MSVM, which contains no algorithm-specific parameters and is easy to implement. The effectiveness of the proposed model is verified using monitoring data collected from a real concrete gravity dam, where its performance is compared with conventional single-target SVM (SSVM)-based models and state-of-the-art ML-based models. The results indicate that our proposed MSVM is much more promising than the SSVM-based models because only one prediction model is required, rather than constructing multiple site-specific SSVM-based models for different dam blocks. Moreover, MSVM can achieve better performance than other ML-based models in most cases, which provides an innovative modeling tool for dam multi-block behavior monitoring.     

Introduction of dosim predicate to Prolog

This paper proposes a predicate nameddosim which provides a new function for parallel execution of logic programs. The parallelism achieved by this predicate is a simultaneous mapping operation such as bagof and setof predicates. However, the degree of parallelism can be easily decided by arranging the arguments of the dosim goal. The parallel processing system with dosim was realized on a tight-coupled multiprocessor machine. To control the degree of parallelism and reduce the amount of memory required for execution, we introduce the grouping method for the goals executed in parallel and some variations of the dosim predicate. The effectiveness of the proposed method is demonstrated by the results of the execution of several applications.     

Volcano-an extensible and parallel query evaluation system

To investigate the interactions of extensibility and parallelism in database query processing, we have developed a new dataflow query execution system called Volcano. The Volcano effort provides a rich environment for research and education in database systems design, heuristics for query optimization, parallel query execution, and resource allocation. Volcano uses a standard interface between algebra operators, allowing easy addition of new operators and operator implementations. Operations on individual items, e.g., predicates, are imported into the query processing operators using support functions. The semantics of support functions is not prescribed; any data type including complex objects and any operation can be realized. Thus, Volcano is extensible with new operators, algorithms, data types, and type-specific methods. Volcano includes two novel meta-operators. The choose-plan meta-operator supports dynamic query evaluation plans that allow delaying selected optimization decisions until run-time, e.g., for embedded queries with free variables. The exchange meta-operator supports intra-operator parallelism on partitioned datasets and both vertical and horizontal inter-operator parallelism, translating between demand-driven dataflow within processes and data-driven dataflow between processes. All operators, with the exception of the exchange operator, have been designed and implemented in a single-process environment, and parallelized using the exchange operator. Even operators not yet designed can be parallelized using this new operator if they use and provide the interator interface. Thus, the issues of data manipulation and parallelism have become orthogonal, making Volcano the first implemented query execution engine that effectively combines extensibility and parallelism     

A constraint-based approach to shape management in multimedia databases

Shape management is an important functionality in multimedia databases. Shape information can be used in both image acquisition and image retrieval. Several approaches have been proposed to deal with shape representation and matching. Among them, the data-driven approach supports searches for shapes based on indexing techniques. Unfortunately, efficient data-driven approaches are often defined only for specific types of shape. This is not sufficient in contexts in which arbitrary shapes should be represented. Constraint databases use mathematical theories to finitely represent infinite sets of relational tuples. They have been proved to be very useful in modeling spatial objects. In this paper, we apply constraint-based data models to the problem of shape management in multimedia databases. We first present the constraint model and some constraint languages. Then, we show how constraints can be used to model general shapes. The use of a constraint language as an internal specification and execution language for querying shapes is also discussed. Finally, we show how a constraint database system can be used to efficiently retrieve shapes, retaining the advantages of the already defined approaches.     

Maintaining data-driven rules in databases

A new model with invariant-based language effectively handles data-driven rules in databases and uses the rules' inherent semantic properties and supporting mechanisms to meet high-level language requirements. It is an extension of the basic PARDES model developed by Opher Etzion in 1990 to support derivations and integrity constraints in databases. The model's invariant-based language, unlike other programming languages, can follow data-driven rules' semantic properties. Such rules are activated by modifications of data items in a database, and they play an important role in many applications that maintain complex relationships between data items or interdependencies between parts of the database. Applications include expert systems, real-time databases, simulations, and decision-support systems. The authors present requirements for choosing an adequate programming style that uses data-driven rules. These requirements are based on software-engineering criteria such as compatibility with a high-level language and verifiability of the rule language. The authors show that contemporary database programming styles fail to meet these requirements, and they present the invariant-based language as a viable solution     

Parallel Logic Programming for Problem Solving

We present a new model for parallel evaluation of logic programs. This model can exploit the main sources of parallelism that the language of logic expresses: Independent AND parallelism and OR parallelism, together with a secondary source emerging as a consequence of the Independent AND Parallelism: the producer/consumer parallelism. The efficiency is derived from the use of ordered structures for managing the information generated throughout the search process. The model is suitable for evaluating programs with a high degree of non-determinism because it never generates two processes for solving the same subgoal and hence it can exploit the same real parallelism generating a lower number of processes than other models. As an application example, we consider the Job Shop Scheduling problem. We report experimental results showing that logic programs can be designed that exhibit parallelism, and that the use of heuristic information translates into speedup in obtaining answers.     

Knowledge-based versus data-driven fuzzy habitat suitability models for river management

Aquatic habitat suitability models have increasingly received attention due to their wide management applications. Ecological expert knowledge has been frequently incorporated in such models to link environmental conditions to the quantitative habitat suitability of aquatic species. Since the formalisation of problem-specific human expert knowledge is often difficult and tedious, data-driven machine learning techniques may be helpful to extract knowledge from ecological datasets. In this paper, both expert knowledge-based and data-driven fuzzy habitat suitability models were developed and the performance of these models was compared. For the data-driven models, a hill-climbing optimisation algorithm was applied to derive ecological knowledge from the available data. Based on the available ecological expert knowledge and on biological samples from the Zwalm river basin (Belgium), habitat suitability models were generated for the mayfly Baetis rhodani (Pictet 1843). Data-driven models appeared to outperform expert knowledge-based models substantially, while a step-forward model selection procedure indicated that physical habitat variables adequately described the mayfly habitat suitability in the studied area. This study has important implications on the application of expert knowledge in ecological studies, especially if this knowledge is extrapolated to other areas. The results suggest that data-driven models can complement expert knowledge-based approaches and hence improve model reliability.     

Web/HTTP协议性能分析和改进的研究

Ｗｅｂ客户端和服务器间信息交换属于典型的事务处理类型,许多研究表明这种通信模式不能被ＴＣＰ所有效地支持（特别是在高速网络的环境）。文中从优化通信模式、降低协议负担和细化并行粒度的角度出发,研究运输层协议支持Ｗｅｂ应用的机制优化和策略改进,并分析快捷运输协议（ＸＴＰ）支持Ｗｅｂ应用的功能和性能优势,考虑上述方法与其它改进措施（如层次Ｃａｃｈｅ等）的关系及现有协议体系的向后兼容性。     

Parallel Execution of Nested Parallel Expressions

This paper describes an implementation of P L for a massively parallel SIMD machine, the M P MP-1. The system is based on a byte code interpreter which can emulate as many virtual processors on each physical processor as desired (within the limits of memory). The implementation makes it possible to activate more virtual processors once execution has begun and this feature can be used to support nested parallelism. Nested parallelism describes the ability to nest data parallel constructs, a feature of P L , C M L , and N ; however, the outer parallel forms usually have to be sequentialized, with only the innermost forms being executed in parallel. N and a subset of P L have been implemented to fully support nested parallelism by flattening nested structures at compile time. To do this the languages must impose various restrictions on both the data and control structures. There is an overhead associated with the runtime technique described here, but it is very versatile and can execute code in parallel that cannot be “flattened.” Hence this technique can be used to effectively support many of the moredifficultaspects of P L .     

一种离-在线混合数据驱动控制方法及其在直流电动机中的应用

针对离线和在线数据驱动控制方法各自存在的不足,提出一种离-在线混合数据驱动控制方法。首先给出一种基于最小二乘支持向量机和虚拟目标值反馈整定的离线数据驱动控制方法;其次在二自由度控制系统框架下,结合无模型自适应控制,给出一种离-在线混合数据驱动控制方法的结构和设计步骤。该方法跳过被控对象建模过程,大大降低了控制器设计成本,且可避免引入模型误差。将该方法应用于直流电动机离-在线数据驱动控制中,并进行了仿真实验,结果表明,离-在线混合数据驱动控制方法可以有效地实现目标信号跟踪和电动机系统的不确定(外部扰动)抑制。