mhtirogla
Home
Systems
API
Pricing
About
Log in
← Back
Home
›
Systems
›
Networking and edge
ddos-waf
DDoS mitigation and WAF
Cloudflare, AWS Shield
System
Techniques · 8
Primitives · 39
ddos-waf
Linear-time regular expression matc…
search-sort · medium: Match a regular expression in O(pattern x text) worst case by tracking all live parse positions at once, then cache the state sets as a lazily built DFA for speed.
›
Bot detection
security · medium: Combine declared identity, rate and timing, network, behaviour and integrity signals into one score per client, then map thresholds to allow, log, limit, challenge or block.
›
Time-series anomaly detection
statistics · medium: Predict the expected value from a seasonal baseline, scale the residual by a robust spread (MAD), threshold at a chosen false-alarm rate, then merge flags into incidents.
›
Gradient-boosted decision trees (GB…
machine-learning · medium: Add small regression trees one at a time, each fitted to the loss gradient; histogram splits over 256 bins make it the strongest tabular default.
›
Behavioral biometrics
security · medium: Build a per-user profile of input timing and motion, score each new session by distance to it, and feed the result into a risk score instead of a verdict.
›
Device fingerprinting
security · medium: Collect stable and volatile device signals, hash the stable core for exact lookup, fuzzy-match the rest with drift tolerance, and feed the result into a risk score.
›
Reputation scoring
security · medium: Turn per-entity good/bad event counts into a trust score that forgets old evidence, borrows strength from parent groups for new keys, and maps to allow, challenge or block.
›
Aho-Corasick multi-pattern matching
search-sort · low: Find all occurrences of many fixed patterns in one pass over the text, in time independent of the pattern count, using a trie with failure links.
›
Proof of work challenge
security · low: Client puzzles (hashcash-style) that cost a client CPU to raise abuse cost, with adjustable difficulty
Tls fingerprinting
security · low: JA3/JA4 fingerprints of ClientHello parameters to identify clients
Sliding-window counters
systems · low: Count events in the last W seconds with a ring of sub-bucket counters; the two-bucket weighted estimate gives rate limits in 16 bytes per key.
›
Count-min sketch
data-structures · low: d rows of w counters estimate any item's frequency in a stream, overestimating by at most ε·N with probability 1-δ, in fixed tiny memory.
›
Anycast
networking · low: Announce one IP prefix from many sites over BGP; routing sends each client to its preferred site, and a failed site leaves by withdrawing the route.
›
Ebpf xdp
networking · low: EBPF programs at the XDP/tc hooks for in-kernel packet processing at line rate
Kernel-bypass networking
networking · low: User space (DPDK, AF_XDP) or an in-driver eBPF hook (XDP) handles packets straight from NIC rings, skipping sockets, for 10-40 Mpps per core.
›
Longest prefix match
networking · low: IP prefix lookup structures (DIR-24-8, Poptrie, LC-trie) for routes, ACLs and geo-IP
Syn cookies
networking · low: Stateless SYN handling that encodes connection state in the initial sequence number
Top-k selection
search-sort · low: Keep the k best of n items without sorting all n - bounded min-heap for streams, quickselect for arrays, threshold pruning to skip most items.
›
Input validation and injection
security · low: Keep untrusted data as data: parse it into types at the boundary, and never splice it into code, queries, shells or HTML.
›
Token bucket
systems · low: A bucket of up to b tokens refilled at rate r; requests spend tokens, enforcing an average rate while allowing bursts of b.
›
Recursive-descent parsing
compilers · low: Hand-written top-down parser with one function per grammar rule; simple, fast, with full control over error messages and recovery.
›
SIMD substring search
search-sort · low: Find bytes or substrings by comparing 16-64 haystack positions per instruction against the needle's first and last byte, then verifying the rare candidates.
›
LRU and CLOCK
systems · low: LRU evicts the least recently used entry via hash map plus linked list; CLOCK approximates it with a reference bit, so hits take no lock.
›
+ 1 more techniques
+ 23 more primitives
System
Techniques · 8
Primitives · 39
ddos-waf
Linear-time regular expression matc…
search-sort · medium: Match a regular expression in O(pattern x text) worst case by tracking all live parse positions at once, then cache the state sets as a lazily built DFA for speed.
›
Bot detection
security · medium: Combine declared identity, rate and timing, network, behaviour and integrity signals into one score per client, then map thresholds to allow, log, limit, challenge or block.
›
Time-series anomaly detection
statistics · medium: Predict the expected value from a seasonal baseline, scale the residual by a robust spread (MAD), threshold at a chosen false-alarm rate, then merge flags into incidents.
›
Gradient-boosted decision trees (GB…
machine-learning · medium: Add small regression trees one at a time, each fitted to the loss gradient; histogram splits over 256 bins make it the strongest tabular default.
›
Behavioral biometrics
security · medium: Build a per-user profile of input timing and motion, score each new session by distance to it, and feed the result into a risk score instead of a verdict.
›
Device fingerprinting
security · medium: Collect stable and volatile device signals, hash the stable core for exact lookup, fuzzy-match the rest with drift tolerance, and feed the result into a risk score.
›
Reputation scoring
security · medium: Turn per-entity good/bad event counts into a trust score that forgets old evidence, borrows strength from parent groups for new keys, and maps to allow, challenge or block.
›
Dynamic time warping
signal-processing · medium: DTW alignment of time series and trajectories of different speed
Aho-Corasick multi-pattern matching
search-sort · low: Find all occurrences of many fixed patterns in one pass over the text, in time independent of the pattern count, using a trie with failure links.
›
Proof of work challenge
security · low: Client puzzles (hashcash-style) that cost a client CPU to raise abuse cost, with adjustable difficulty
Tls fingerprinting
security · low: JA3/JA4 fingerprints of ClientHello parameters to identify clients
Sliding-window counters
systems · low: Count events in the last W seconds with a ring of sub-bucket counters; the two-bucket weighted estimate gives rate limits in 16 bytes per key.
›
Count-min sketch
data-structures · low: d rows of w counters estimate any item's frequency in a stream, overestimating by at most ε·N with probability 1-δ, in fixed tiny memory.
›
Anycast
networking · low: Announce one IP prefix from many sites over BGP; routing sends each client to its preferred site, and a failed site leaves by withdrawing the route.
›
Ebpf xdp
networking · low: EBPF programs at the XDP/tc hooks for in-kernel packet processing at line rate
Kernel-bypass networking
networking · low: User space (DPDK, AF_XDP) or an in-driver eBPF hook (XDP) handles packets straight from NIC rings, skipping sockets, for 10-40 Mpps per core.
›
Longest prefix match
networking · low: IP prefix lookup structures (DIR-24-8, Poptrie, LC-trie) for routes, ACLs and geo-IP
Syn cookies
networking · low: Stateless SYN handling that encodes connection state in the initial sequence number
Top-k selection
search-sort · low: Keep the k best of n items without sorting all n - bounded min-heap for streams, quickselect for arrays, threshold pruning to skip most items.
›
Input validation and injection
security · low: Keep untrusted data as data: parse it into types at the boundary, and never splice it into code, queries, shells or HTML.
›
Token bucket
systems · low: A bucket of up to b tokens refilled at rate r; requests spend tokens, enforcing an average rate while allowing bursts of b.
›
Recursive-descent parsing
compilers · low: Hand-written top-down parser with one function per grammar rule; simple, fast, with full control over error messages and recovery.
›
SIMD substring search
search-sort · low: Find bytes or substrings by comparing 16-64 haystack positions per instruction against the needle's first and last byte, then verifying the rare candidates.
›
LRU and CLOCK
systems · low: LRU evicts the least recently used entry via hash map plus linked list; CLOCK approximates it with a reference bit, so hits take no lock.
›
Isolation forest
machine-learning · low: Score each record by how few random axis-aligned splits it takes to isolate it in a small forest of random trees; anomalies are few and different, so they isolate fast.
›
Exponential smoothing (ETS, Holt-Wi…
statistics · low: Forecast by keeping a few running states (level, trend, seasonal) updated by a fraction of each forecast error; O(1) memory per series and a strong baseline.
›
Robust statistics
statistics · low: Location and scale estimates (median, MAD, trimmed mean, Huber M-estimator) that stay correct when a minority of the data is garbage.
›
STL decomposition (seasonal-trend w…
statistics · low: Split a series into trend, seasonal and remainder with iterated loess smoothing; the seasonal shape may drift and robust weights keep outliers out of it.
›
Quantile sketches
data-structures · low: Mergeable quantile sketches: t-digest, DDSketch, HDR histograms
Loss functions
machine-learning · low: The scalar a model minimizes: cross-entropy for classes and tokens, MSE or Huber for values, each with a stable form and simple gradient.
›
Regularization
machine-learning · low: Techniques that trade training fit for generalization: weight decay, dropout, early stopping, label smoothing and data mixing, with the exact update rules and defaults.
›
Fast hash functions
data-structures · low: Non-cryptographic hashes built from 64×64→128-bit multiplies and xor-shifts; pick by key size, trust level and whether the hash is persisted.
›
User agent parsing
search-sort · low: Parse user-agent strings and client hints into browser, OS and device
Fuzzy hashing
security · low: Similarity-preserving file hashes (ssdeep CTPH, TLSH) to find variants of known files
Time decay scoring
search-sort · low: Scoring items by recency with exponential decay or half-life, combined with relevance
Bayesian rate estimation
statistics · low: Estimate a conversion or event rate from few observations with a Beta-Binomial or Gamma-Poisson update: two counters, an honest interval, and P(B beats A) directly.
›
SIMD programming
hardware-os · low: Process 4-16 lanes per instruction with AVX2, AVX-512 or NEON via Rust std::arch, with runtime dispatch and a portable fallback.
›
False sharing
concurrency · low: Independent variables written by different cores on one cache line force the line to bounce between cores; pad or regroup hot data to fix it.
›
Memory ordering
concurrency · low: What Relaxed, Acquire, Release and SeqCst atomics actually guarantee, what they cost on x86 and ARM, and which one each pattern needs.
›
d-ary heap
data-structures · low: Array heap with d children per node (d = 4 typical): half the binary heap's depth, siblings in one cache line, faster priority queues.
›
SPSC ring buffer
data-structures · low: Bounded wait-free queue for exactly one producer and one consumer thread, built from an array and two indices with acquire/release ordering.
›
CPU caches and the memory hierarchy
hardware-os · low: Sizes, line widths and latencies of L1/L2/L3/DRAM on modern x86 and Apple M-series, and the data-layout rules that follow from them.
›
Huge pages
hardware-os · low: 2 MB/1 GB pages to cut TLB misses; THP vs explicit hugetlbfs
Numa aware allocation
hardware-os · low: Allocate memory and pin threads on the local NUMA node; first-touch and interleave policies
Receive side scaling
networking · low: NIC hashing of flows to RX queues (RSS) and symmetric hashing for per-core processing
Html sanitization
security · low: Allowlist-based HTML sanitizing of untrusted markup
JSON Schema validation
security · low: Compile a JSON Schema once, then check every untrusted document against it, within hard size and depth limits, and report failures as JSON Pointers.
›
Copy for AI
Similar systems
Share the most building blocks with this one.
flow-monitoring
24 %
l4-load-balancer
16 %