Re: [cti-stix] Cyber Security Protection for Front Line Real-Time Systems RFI

["Jason Keirstead" <Jason.Keirstead@ca.ibm.com>]

Somehow my reply yesterday only went to Eric, adding the list back...

--

I disagree. You underestimate how long big this difference gets when dealing with "big data".

Here is a simple example (python below) comparing the parsing of a million "slow" timestamps (iso8601 variable format) to a million "fast" timestamps (fixed format that can be handled by the strptime syscall). Here is the output when I run this locally on my 2.2 Ghz Core I7 laptop

python ts_test.py
Fast took 15.0440979004 ms

Slow took 32.2207949162 ms

As you can see.. it is an over 2x difference in parsing. The time involved (15 seconds) isn't relevant as this is only on a million timestamps. In real world use case we will be talking hundreds of billions to trillions of timestamps.

Small numbers when applied to big data problems always add up to big numbers. We shouldn't be baking inefficiency into a standard out of the box when said things can be *easily* avoided.

-
Jason Keirstead
Product Architect, Security Intelligence, IBM Security Systems
www.ibm.com/security | www.securityintelligence.com

Without data, all you are is just another person with an opinion - Unknown

Eric Burger ---12/15/2015 01:58:42 PM---Shoot me if we ever produce a three page document that requires nine pages of boilerplate! > On Dec

From:        Eric Burger <Eric.Burger@georgetown.edu>
To:        "cti-stix@lists.oasis-open.org" <cti-stix@lists.oasis-open.org>
Date:        12/15/2015 01:58 PM
Subject:        Re: [cti-stix] Cyber Security Protection for Front Line Real-Time Systems RFI
Sent by:        <cti-stix@lists.oasis-open.org>

---

Shoot me if we ever produce a three page document that requires nine pages of boilerplate!

On Dec 15, 2015, at 11:41 AM, Cory Casanave <cory-c@MODELDRIVEN.COM> wrote:

A “Request for information” (RFI) has been issued by the OMG in the domain of CTI. CTI and/or CTI participants may want to respond.
RFIs are informal and anyone may respond.

The RFI is here: http://www.omg.org/cgi-bin/doc?c4i/15-12-04