Visualizing Security via LANGSEC
summary
Claim: pattern matching (regular expressions) loses to fuzzers so LANGSEC treats data as code and inspects it with lexers/parsers. Implementation: a hand‑rolled Java HTML lexer/parser (~300 lines), an open‑source toolchain plus Processing for 3D DOM visualizations. Benchmark: JMH workloads with payloads from 70B to >1MB show the parser runs roughly 30x faster than running dozens to hundreds of regexes (tens of thousands vs ~300k ops/sec) on a naive single‑threaded implementation.
AI-written summary · about
chapters (12)
- 0:00Start
- 0:23Visualizing Security
- 10:08General Theory of Lang Sec
- 13:13Lexical and Syntactic Analysis
- 14:19Lexical Analysis
- 14:49Cogeneration
- 17:57Parsing
- 18:46Bottom-Up Approach
- 19:31Parser Generator
- 29:12Compile Regular Expressions
- 45:13Machine Translation
- 45:58Html Parser
related talks
42mBuilding Hardened IoT Implementations With LangSec
44mTL;DR: Applying AI to Security
50mUsing language-theoretics and runtime visibility to align AppSec with DevOps
52mStructure aware fuzzing
34mKernel-Resident Regex and Jails: DFA-powered eBPF filtering and certificate...
16mELFuzz: Efficient Input Generation via LLM-driven Synthesis Over Fuzzer Space
17mTowards Better Semantics Exploration for Browser Fuzzing
47mA New Era of SSRF - Exploiting URL Parser in Trending Programming Languages!