Well we'll get started anyway so thank you for joining us for what in many ways has been a long awaited event. We are gathering today to recognize the end of the longest emergency in the in this community's history 457 days. We are pausing to reflect and honor the terrible grief and loss many in Burlington have suffered over the past year during the worst global pandemic in 100 years. At the same time we are marking a moment of renewal and commemorating the incredible resilience, bravery, and ingenuity exhibited by so many that helped Burlington the Burlington community navigate through the COVID-19 pandemic. Through countless actions made by individuals, businesses, organizations, schools, and neighborhoods Burlington remained one of the safest cities in the nation throughout the past year and a half. Even with these great efforts we still saw many people struggle with the coronavirus, many hospitalized, and most tragically we lost dozens of our neighbors, friends, and loved ones. Each member of our community is irreplaceable and the loss of their life is immeasurable. The impact on many in this city has been terribly hard and dark over the past year and so before going further I would like to pause have us all pause and take a moment of silence to contemplate that loss. Thank you everyone. With the high vaccination rates in our state and our county we are nearing the end of a period in our history that will be marked not only by grief but also by spirit of resilience. We will remember this time not only for the losses we endured but also for the incredible things we've accomplished together. I am so grateful that after 15 months of sacrifice and collective action to suppress the virus we're able to celebrate important events together in person again. Today's Independence Day celebrations. I'll be happy to talk to you later okay we have a moment here. I'm happy to talk to you about it later okay. Today's Independence Day celebrations where we expect thousands from across the state to gather on the waterfront mark a significant accomplishment one that rests on the hard work of our dedicated city team and countless community partners. This year the day the day holds particular special meeting. This year we should celebrate a new independence from a pandemic and lockdowns yes but also from the old ways of doing things. As a nation we have too long allowed systems to remain that perpetuate racism and inequality and allowed ourselves to be bound by inertia and outdated practices. This cannot continue. As with the pandemic I am confident that Burlington will rise to this moment and build a stronger and better future and as with the pandemic I know there are heroes among us who will help push pull and lead us in a new direction. Today it is my and really our whole community's tremendous honor to recognize some of the heroes of the past year. Partners who went above and beyond for extended periods of time who demonstrated an incredible commitment to our community and their partnership to the city and whose actions surely saved lives. Jacob Bougre and Jacob Bougre and Tate Oratzebe are here representing ALV the Association of Africans living in Vermont. In normal times ALV does so much for our community. In a crisis they became an unparalleled source of knowledge advocacy solutions and commitment to this city. ALV is a shining example of our organizations across Burlington transform themselves during this crisis from translation services to vaccine education and outreach to supportive quarantine assistance and more. ALV demonstrated a clear knowledge and compassion for the needs of Burlington's immigrant and refugee community and a strong willingness to partner and collaborate with the city team and countless other organizations and service providers. Jacob and Tato took on significant personal risks to themselves during this pandemic to extend a hand to educate and to console families suffering terrible loss. They are selfless dedicated to assisting their fellow humans kind and far-seeing in their strategy and interventions. There is no doubt that their tireless work saved many lives. It is my great honor to present a key to the city to ALV. Tracy Shamburger is here representing Agewell. Agewell was one member of a senior provider's cohort that provided critical support to the city by sharing their skills and expertise, leveraging their extensive contact lists and the high trust that they have built over many years in this community and by quickly and effectively communicating critical public health and vaccination information to our older neighbors. Agewell is also the largest provider of meals on wheels in the state and from the earliest days of the pandemic they responded quickly absorbing the rapidly growing needs of food insecure and homebound neighbors. Agewell is also a key partner in the city's vaccine distribution efforts setting up a call center deploying volunteers to do vaccine outreach education supporting transportation needs for folks to attend vaccine clinics and working with Garnet Health remarkably to deliver vaccinations for homebound seniors during that critical period this past winter when it was so needed. Today vaccination rates for those over 60 in Chittenden County is over 95 percent. Surely this work saved countless lives and it is my pleasure to award Agewell a key to the city of Burlington. Virginia Finn is here representing a new place. Very early in the pandemic it became clear that folks living in congregate housing would be extremely vulnerable to illness and that we would have to quickly act in order to safely house everyone who is sheltering at a new place. In days literally days a new place supported the opening of a managed campground at the city's north beach first of its kind in this city. The experience of handing over the keys to temporary shelters to a new place staff and late in the evening on move in day is a moment of last year that I will not forget. Then as an amazing second major accomplishment in this pandemic that will long endure a new place was a critical partner in achieving a long held goal of this community which is to open a permanent year round low barrier shelter for those experiencing chronic homelessness. As a result of these actions Burlington did not experience the deadly COVID outbreaks within the chronic homeless community that many other cities did. Today I am pleased to hand over a key again and award another key to a new place. Here's the key to the city of Burlington. From no the deputy director of operations is here representing Garnet. The pandemic challenged businesses and organizations in so many ways especially new startups which Garnet was at the beginning of this pandemic. However Garnet grew, innovated and adapted repeatedly during the course of the pandemic overhauling their operations sometimes literally overnight in the face of evolving needs and challenges our residents faced. When the city's wastewater surveillance program began pinpointing neighborhoods at higher risk within the city Garnet stepped forward to help our community partnering with the city and standing up pop-ups and test sites in the old north end the new north end and elsewhere within 36 hours of the request. When high viral prevalence made rapid indigent tests a viable tool to help contain emerging outbreaks Garnet again stepped forward to organize a rapid test option at the Burlington International Airport for travelers and residents alike. Garnet supported the state's efforts for on-demand testing by standing up the outstanding site at 405 Pine Street in Burlington and stepping forward to provide testing access to prisoners in Vermont jails. When vaccines became available Garnet again reinvented itself to get our most vulnerable residents vaccinated as quickly and safely as possible supporting homebound seniors handling the late night church street marketplace clinics and even staffing major festivals and distribution distribution efforts like Jazz Fest. And Garnet has proved their ingenuity dependability and commitment to the community they become a critical partner for the city and I hope this is right I think they're still working hard do we have a Garnet testing site even right here in the park right a vaccination site where is it oh it's over in north beach so they're still working hard glad you guys could take a few minutes out and be here for this it is a great honor to award a key to the city to Garnet. Elliott Katz is here representing generator makerspace generator is exemplary a Burlington spirit of innovation inclusion and community take yourself back to the moment that the pandemic hit our stockpile of vital resources like masks face shields and other PPE was non-existent healthcare workers and their patients were dying across the country as we struggled to understand the nature of the threat we faced and to equip our healthcare providers with the equipment they needed to fight the virus in this environment the team at generator applied their talents skills and equipment to rapidly prototype and then produce at a substantial scale lifesaving PPE in the form of specifically designed face shields for local healthcare providers and essential workers at a time when we had great uncertainty and doubt whether the national effort to supply PPE and E would ever get going because of their quick and creative thinking Burlingtonians were able to close a gap in the supply chain that airborne pathogens could readily have x exploited without them as our understanding of the virus evolved generator also worked with the city analytics team around questions of ventilation and its relative importance generator asked excellent questions and gave helpful advice and with that input and its own research the city ultimately helped over a hundred businesses and other organizations improve their ventilation and air quality and made dozens of upgrades across city buildings and schools as well we are so fortunate to have such intelligent creative and community spirited people in our midst that have helped us so much already and there will be beside us in the many challenges ahead and I have to add that Elliott and his team they also made this podium several years ago and these keys to the city come from Elliott and his team as well and let me let me just describe I mean I hope people get to pass these around these are really pretty pretty great keys to the city they have the city flag integrated into them they also were done by a program that under stand is a workforce development program is really helping some youth in our in our city get the skills they need these are beautiful and it's you know really my honor to present a key to the city to the to the makers of them generator maker space let's see where is Aaron Aaron great Aaron Aaron Everhart's is here representing Lyric theater company Aaron and her colleagues are the very picture of creativity and action as a community drama company Lyric theater became a critical partner to the city in our early and ambitious mask initiative with good humor grace and a talent for both organizing and problem solving Lyric theater jumped into action and helped lead an effort that included hundreds of communities so us to produce and distribute thousands of masks on May 13th we passed the mask ordinance and on May 15 we begin we began to come out of the first stay home stay safe order as we announced that we had met 25,000 mask distributed goal all of this was months yeah really it was remarkable all of this was months before the statewide mask mandate was implemented on July 24th which was about the time that many public health experts began to really stress mass making in this country we'll never know how many lives were saved because of this early intervention but I'm confident the tireless work of Lyric theater company made Burlington a safer place I'm proud to present a key to the city of Burlington to the Lyric theater company Allison Seager is here representing the multilingual task force the multilingual task force was a community-wide effort within a community-wide effort Allison along with colleagues at ALV and USCRI sorry USCRI and many local translators understood that very quickly translating and rapid the rapidly evolving public health guidance was a life and death endeavor the multilingual task force posted their first round of translated videos in French Dinka Somali and Spanish to YouTube on March 18th 2020 just a couple of days after I announced the emergency order repeatedly and on short notice as situations and circumstances suddenly changed over weekends and holidays and late at night or early in the morning the multilingual task force created dozens and dozens more videos in the languages of Burlington's refugee and immigrant communities including Vietnamese Bosnian, Swahili, Arabic, Nepali, Karundi, Mai Mai and more undoubtedly these translated messages were lifeline not only for Burlingtonians but for countless other immigrant communities and families in untold communities around the country facing the universal challenges of the COVID-19 pandemic I am honored to present a key to the city to the multilingual task force Dr. Steven Leffler is the CEO and president of UVM Medical Center and I am sure that many of you are familiar with the fact that he also joined me on over 30 COVID briefings reaching all the way back to March 15th of 2020 I know that Burlingtonians and Americans will long remember the heroism of our health care workers throughout the COVID-19 pandemic our many nurses, physicians, CNAs, pharmacy technicians and hospital and skill nursing facility staffs who accepted incredible personal risk to care for our most vulnerable and those that were suffering and to deploy testing and vaccinations at a once unimaginable scale separate from his duties as an emergency room physician and leader of Burlington's largest health care provider by far Dr. Leffler went above and beyond accepting every invitation to speak publicly about the risks of the COVID-19 virus providing clear leadership to the entire community and giving Burlingtonians guidance clarity and confidence and otherwise uncertain time I will always be grateful Steve for your counsel and partnership throughout this challenging period I'm very happy to welcome Dr. Leffler once again and to award him a key to the city of Burlington Emila, where is Emila? Right there. Hi, Emila. Emila Merdanzovic is here representing USCRI Vermont USCRI stepped forward in so many ways as well some I've already touched on their work through the multi-lingual task force and with ALV was crucial for Burlington and our outcomes here USCRI Vermont interpreters and translators also staffed our testing sites and vaccination clinics for thousands and thousands of hours alongside dozens of interpreters from ALV they provided accurate interpretation and support for tens of thousands of families navigating the daunting unknowns of COVID testing and then vaccination over these many months USCRI along with ALV also served as incredible advocates knowing what was happening and learning what was not working and providing a clear voice for the needs of a refugee and immigrant neighbors in times of great pressure and stress this advocacy helped change state policy it led to a better contact tracing system it led to better food and quarantine supports a restructuring of the state's health equity response and vital information about impacts at the family level that the city team could weave into larger data pictures to make the case for additional testing sites access issues or vaccination needs this remains vital work I am hopeful that the city will work even more closely with USCRI in the future and I am very proud to resent USCRI Vermont a key to the city of Burlington okay and for our last key to the city here representing the Vermont professionals of color and their second initiative the Vermont health equity initiative our Weiwei Wang, Blaine on Tensei and Luis Calderon this is a special recognition several years ago Pitt Keo Manivan at CEDO started a group called the Vermont professionals of color as a way of creating network opportunities networking opportunities here in Burlington little did we know what this group would go on to do this spring as vaccination rates lagged for BIPOC Vermonters the city joined many advocates in calling for the lifting of limitations on BIPOC vaccinations the state first allowed all households of eligible BIPOC Vermonters and then ultimately removed age banding for BIPOC Vermonters the only state that took that step I believe those were vital steps but to see vaccination rates increase required much more leaders from the Vermont professionals of color network with the support of groups like the racial justice alliance and the black perspective formed a new organization called the Vermont health equity initiative this group is focusing on vaccinations but it will continue to grow and focus on health disparities for for BIPOC Vermonters more generally beyond the end of the pandemic and the Vermont health equity initiative alongside its partners and with the support of the city has made great strides in vaccination rates using the cleared out sanctuary of this Cathedral of Saint Paul which is right across the street if you if you don't know it these leaders alongside the city which initially managed all the registrations and some of the process to allow the group time to form as well as the National Guard and the UVM Medical Center which did the vaccinations this whole team vaccinated thousands of BIPOC Vermonters from Burlington and around the state since March the effort has been huge and the clinic itself has been an enormously welcoming space with music and food and good cheer it is unlike any of the other clinics that I've visited and I think any that are out there anywhere and it is a remarkable testament to the creativity and persistence of these three leaders and their many partners and these efforts have undoubtedly saved lives we know that the disparity in hospitalizations and deaths nationally by race has been stark and the efforts here in Vermont have helped limit those outcomes the efforts of this group are a reminder of why we need to reflect especially on this Independence Day on the better future that is within the grasp of this generation and these efforts are why it is such a deep honor to present to the Vermont professionals of color a key to the city of Burlington all right so in conclusion I would just like to say clearly that without the creative heroic and determined work of these individuals and organizations as well as many others Burlington would have not have had the exceptional outcomes that we're able to enjoy and celebrate today it was interventions like the masking initiative translation efforts by BIPOC vaccination clinics low barrier housing and in-home vaccinations driven by data innovation and a crystal clear commitment to equity that made the Burlington community a shining example of what is possible during the pandemic what I've learned over the last 457 days and what this community I really think should hold on to and long remember is that even in the face of a seemingly insurmountable challenge the people of Burlington are capable of forging incredible progress it is this lesson this optimism and determination that we must carry forward into the the many crises that we still face I have every confidence in the remarkable people of Burlington together we can accomplish great and enduring progress on the remaining challenges of the time now before we conclude and depart there's one more thing that I'm hoping everyone will will join us for and that is to make a short walk over to the new COVID-19 memorial stone where our great parks recs and waterfront team has planted a celebration maple and independent spirit hydrangeas and we're gonna head over there I think it's right around the corner here right great thank you everyone


Hello, welcome to my presentation of our paper on the compactness of flashing modes and efficiency beyond multi-trade. This is a joint work with Elena Andriva from TU Vienna and Ornobroi from Klagenfurt. The general outline of the rest of my talk is as follows. I am going to start with one slight description of our result. To describe things in detail, I shall first state our motivation and recall some background results. Then we jump into our results on the two modes that we present, ABR and ABR+. Finally, I am going to briefly discuss some related extensions of our work. Here is the one slide representation of our work. We introduce two hashing modes, ABR and ABR+. Both the modes are based on two-and-two-n-bit compression functions. The parameter of ABR mode matches TAMS bound from crypto 2008. When compared to popular market tree, ABR mode compresses around 50% more messages by making same number of calls to the underlying compression function. In comparison, ABR+, achieves indifferentiability security notion. The only compromise it makes is it compresses one message block less than ABR mode. Our work has both theoretical and practical motivations. Indeed, achieving TAMS bound for general parameters have been an open problem since 2008. From practical perspective, the problem relates to minimizing multiplicative complexity. As more function calls implies increased multiplicative complexity, the natural question is how to compress more messages by making same number of function calls and thus minimizing the multiplicative complexity. Of course, an efficient hash function has other applications as well, like in archiving, proof systems, etc. Let's start from the background. A hash function takes strings of arbitrary length as input and produces strings of fixed length as output. A cryptographic hash function needs to satisfy some security notions. Two primary requirements are the collision resistance and the pre-image resistance. We say an adversary finds a collision in the hash function if it can produce two distinct messages m and m prime such that hm equal to hm prime. That is, the messages are mapped to the same point. We require that it takes approximately 2 to the power n over two many hash evaluations before the adversary can find a collision. Similarly, for pre-image resistance, the adversary is asked to invert the hash function h on any given point. We expect that an adversary needs to make approximately 2 to the power n many hash computations before finding the pre-image. There are notions like second pre-image resistance or target collision resistance analyzed in the literature. However, they are implied by collision resistance. In the last 15 years, indifferentiability from a random oracle have appeared as major security criteria. It says that the adversary should not be able to distinguish the hash function h from a random function from 01 start to 01 end. I would like to point out that indifferentiability from random oracle is indeed a very strong security notion and in particular it subsumes collision resistance and pre-image resistance. The hash functions are designed in two steps. First, one chooses a suitable function f which is a mu bit to n bit function with mu greater than equal to n. The hash function is implemented via a domain extension algorithm or a mode of operation algorithm which on input m iteratively queries the function f as a subroutine with suitable inputs and computes the hash value based on the responses. In the figure, the blocks GIs are the one which decides the input to query the function f. The security argument for the hash function is established via a reduction from f. It is shown that an attack against h can be converted into an attack against f. Often information theoretic arguments are used where f is modeled as an ideal object like a random function or a random permutation. To classical and yet the state-of-the-art examples are Marklet-Umbard and Marklet-Tree. Marklet-Umbard is a cascade construction where the message is pre-processed via applying a padding. For Marklet-Tree, the tree data structure is used to evaluate the hash. The messages are injected at the leaf level, the functions are evaluated level-wise and output of the root node is given as the hash value. Modern hash designs employing Marklet-Umbard or Marklet-Tree often uses padding to ensure the functions are independent. Blake or MD6 are good examples of such padding. In this work, we ask how can we construct the most efficient domain extension algorithm? In concrete terms, we wish to construct a collision-resistant kn to n-bit hash function, yet making minimum number of calls to the underlying 2n to n-bit function f. Of course, we are not the first to ask this question. In Eurocrypt 2005, Black, Koshan and Schimton proved that to construct a 2n to n-bit collision resistant function from n-bit permutations, more than one call to the permutation is necessary. Rogaway and Steinberger generalized this result to show that any kn to ln-bit function from permutations need to make 2k minus l many queries to the n-bit permutations. In 2008, Stam refined the above bound and conjectured that any collision-resistant t plus s to s-bit function from n plus c to n-bit function requires s plus 2t divided by 2n plus 2c minus s calls. In concrete terms, Stam's bound implies to construct 2n to n-bit function from n to n-bit functions, 3 calls are necessary. Similarly, to construct kn to n-bit function from 2n to n-bit functions, 2k minus 1 by 3 many calls are necessary. The only upper bound achieving n by 2 bits of collision security is the Schimton-Stam construction from 2008. The construction is described in the picture. The construction uses 3n to n-bit functions and compresses 2n-bit message to construct n-bit digest. However, the problem is open for general parameters. In particular, we did not know whether to construct kn to n-bit function from 2n to n-bit functions 2k minus 1 by 3 many calls are sufficient to achieve collision resistance. And to put matters in perspective, we recall that the mercury makes k minus 1 many calls. We show that, yes, indeed such constructions exist. We present an augmented binary tree, ABR hashing mode, which compresses kn-bit message to n-bit digest by making 2k minus 1 by 3 calls to the underline 2n to n-bit functions and achieve n by 2 bit of collision resistance. Compared to Markley tree, this gives almost 50 percent improvement as 50 percent more messages can be compressed. We also present a simple modification of ABR tree that we call ABR plus mode that can achieve indifferentiability from random oracle by making the same 2k minus 1 by 3 calls to the underline functions. The only difference is that in case of ABR plus, we compress one block less. The ABR tree is shown in the picture. Starting with the tree, at each non-lift function call, an additional message block is zored with both the input. Like Schindt and Stam, one previous chaining value is feed forward and zored with the output. I am going to present an overview of the collision resistance output. The main difficulty is in handling the fact that the adversary may query the functions adaptively. For example, the adversary may make some queries to the root say and later make queries at the lower level and try to match with the previous query input. The core idea is to define a bad event if such match happens too many times. We derive an upper bound on the expected number of such match and apply Markov inequality. In more detail, the crucial parameter of our analysis is the notion of the load of a node in the transcript. It is the number of computable messages in the transcript with queries to all the nodes in the subtree of that node. The idea is conditioned on some bad events, the collision probability can be derived in terms of load square by 2 to the n. The main technical task is to find the correct bad events such that the derivation works and the load is suitably bounded. We identify two bad events. The first one happens when a query to a function increases the load of that function by k to the power l for some suitably chosen k that here l is the height of the tree.  What we could prove is that the collision probability of each of the small blocks conditioned on the bad events not happening can be bounded by k to the power 2 l times q square by 2 to the n. We can also bound the bad events individually. For the first one one can imply a previously known technique however for the second one we need our markup track. The ABR plus mode is shown in the picture. Compared to ABR mode the additional message block is not sought at the leaf level. The general idea is that a collision resistant preimage aware function when composed with independent random function gives indifference stability from random work. So in case of ABR plus we take two ABR trees and then envelope them with an independent random function to compute the ABR plus hash value. Now this idea of indifference stability is analogous to the well-known principle that collision resistance followed by PRF gives us a PRF. The same idea works here. The collision resistance of the ABR modes ensure that the query to the root are all fresh and as the root function in itself is a random function the arguments go through. Now I am going to talk about certain corollaries of our result that may not be very apparent. To start with consider the direct extension of shimtan stamp construction in the 2N2N bit setting. Here the function compresses five message blocks with three calls to the function F. This construction in particular has a simpler collision resistance argument. Here it is sufficient to consider level wise adversely. The reason is that the messages are injected that are injected at the leaf node does not affect the transcript as the probabilities are calculated over the randomness of the function F as well as the each of these function F rise are random functions. Thus there are broadly two cases to consider collision at the leaf node and collision at the final output condition done no collision at the leaf nodes. The probability for the collision of the leaf node can be individually bounded by q square by 2 to the N whereas for the third condition we give a new counting argument where we prove for the collision probability condition done no collision at the leaf can be bounded by N square q square by 2 to the N. Once the collision probability is settled then like the previous case we get an intermediate indifferentiability result. We take 2 5N to N betabier construction and add an independent random function as envelope. Like previous case we can argue that the preimage aware collision resistance followed by random function gives indifferentiability. These constructions give an intermediate relatively easier to prove collision resistant hash function where the additional messages are injected at alternate levels. For the proof of this we need to recursively apply our indifferentiability result with the composition theorem. To conclude we presented new design principles for tree hash with almost 50% more efficiency than market tree. This is the first general parameter construction towards achieving stamp spot. Interestingly we get an almost optimal efficiency with indifferentiability from random molecules as well. A natural open problem is to achieve stamp's bound for double length hash functions. This concludes my presentation, thank you.


Okay James P. Madonna Megalife 21 progressive discussion here on the beautiful Edgewater walkway. All right Hudson River is the GW GW Bridge I-95. Okay it's very very quiet. It has a river barge. All right Grant's Tomb Columbia University Upper Manhattan. That's not what this video is about. It's overcast. Looks like rain. Hudson Yards here's Midtown Manhattan. All right now this is not the primary topic of this video. It is the nice old-fashioned street lamps. Now my problem is just like it was years ago when I purchased quite a bit of young Chinese windmill poms to try to sell to landscapers in New Jersey and no no one believed me. Everyone laughed at me when I said they grow 30 feet straight up in the air and they thrive and grow in sub-zero temperatures. That's right the Chinese windmill palm would be excellent for the Jersey Shore, the resorts down in Atlantic City, Cape May, all the way down. Asbury Park, Belmar, Seaside Heights, whatever. And right here along the walkway flanking the Hudson River in Edgewater it would put Edgewater, New Jersey in the media to have these beautiful straight up to 30 feet tall palm trees that flourish in sub-zero temperatures. But no I emailed the borough of Edgewater just like with the landscapers everyone laughed. They thought it was a joke.   I told them to go to Google and research it yourself. Chinese windmill palms will be the sensation it will be in the media if this lovely Hudson River waterway walkway was flanked with these beautiful palm trees that flourish in cold weather. Of course right now it is a very mild not hot but humid and moderately warm early September 2019. But you would think that's someone some politicians in


Everybody forced here up in a box of twenty twenty one generous optic basketball hobby hybrid for Maximilian W Thank You Maximilian and good luck Tyler Bay Devon Vasell Red Jada McDaniels rated rookie the red and blues are not numbered in the H2 red Jada McDaniels and a red PJ Washington, Jr. Daniels, there's a Lamello base color the Vante Graham Reds got Lou Gens d'Orte and raining threes Trey young Richards Josh Green blue Lamello ball nice Lamello there blue Pulsar not numbered Looking card and a Steven Adams Yeah, that's the weird thing is that they're doing like rubbing the passers, which is strange like It should be like an evaluatory thing like that. That's the process. That needs to be Evaluated hope we top-and-rated rookie Holler rated rookie Isaac Corpore Reds bam out of bio and elite dominators Trey young and that will do a pretty good box there Maximilian Thank you again. Get those cards out to you shortly


So I hope you guys really appreciate it. They're gonna be going pretty pretty quickly So give them a round of applause and we'll get started All right.  So yeah, it's gonna go pretty fast So I'm Michael Liebowitz Rukula in the twitters. I'm a principal troublemaker at Oracle cloud infrastructure and you know what we say is not endorsed by our employer or the opinion of our employer in any way and and I'm Taufer Timson. I'll do a lot of a C sharp mower stuff I'm a principal vulnerability enthusiast also on the Oracle cloud infrastructure red team And if it's not obvious from our matching attire, we just really want to write malware and drink coffee But in the other order All right, so let's go through the agenda real quick remember we're going fast What is EDR?  Okay, so what is EDR? so EDR stands for endpoint detective response and basically you can read that but What it means is the blue team is going to roll you up and throw you out and it's just gonna make your life hard Some prominent vendors are mentioned at the bottom of the slide Not going to mention any particular vendors, but if you're wondering does this work on vendor it does If you're not already familiar, this is the mitar attack framework. So This is a set of techniques and basically I Think what we need to think about it is this is bikes basically a behavior chart for bad guys It's just like kindergarten every time you do one of these things you get a little you get a little gold star every time you You know credential dump, etc. And this is how EDR maps what you do to What you do And then you know I think in infosec we talk a lot about risk and we talk about the risk curve and I and we're gonna talk about the other risk curve So basically no nothing good lasts forever You know at this part of the graph and just my pointer show oh it kind of does So, you know, you know that feeling like your initial shell pop But this is like where you're pretty likely to get popped And then and then, you know, basically they haven't caught you by now. They're not gonna catch you and You know you start your persistence phase and it goes and goes but no breach lasts forever and eventually eventually eventually they're gonna catch you and that's you know That's we want to that we want to live for longer and the end result of that is Everyone's having a bad day You you're you're lovingly crafted payload becomes their sample and Months of work are down the drain.  What can we do about this? So we need to we need to make the we need to flatten the risk curve You've heard that before right? We want you know, we can't make the initial shell popped being less likely to get detected But maybe we can flatten out that their net persistence phase give you a little bit longer to enjoy your good time And you know as I said nothing lasts forever. You will somewhere somewhere over there get popped So how are we gonna make that risk curve flattens such that we're no longer being detected after our initial shells popped Well, we're gonna utilize a little thing called UEFI If you're not familiar with UEFI, this is essentially what people refer to as modern-day BIOS. It's a Platform firmware that does all of these things and this chart is included because once upon a time John Luke ades during a black hat talk said if any research was talking about UEFI you have to include this slide So here's the slide Basically, it's if you're not familiar with it. It's platform firmware. It's what essentially Sits it helps boot the processor. So it does all of like your memory training your CPU and it all of those things Is UEFI does all of it. It also boots option ROMs from PCI devices and whatnot. You've likely seen like the low jacks finding that came out earlier last year where it was a Thing called a bootkit. So this is malicious firmware malicious code running in platform firmware. That's where this all happens The interesting thing to take out of this I store of a diagram is this notion of runtime So once the operating system boots and you've been handed off to the operating system bootloader from UEFI You expose runtime services So these are runtime services that are exposed by the platform firmware that are available to the operating system during the runtime of the platform Things that are in this category are like UEFI applications. Nobody really uses those who cares and then UEFI Platform firmware variables. So these are persistent storage variables that are in NV RAM on your platform Aka if you restart your operating system through always there They're persistent in firmware where nothing can see you EDR has no idea what it is No, no AV vendors even know this exists and let's be honest if you didn't know anything about UEFI this chart wouldn't help you So why UEFI variables and why are we gonna focus on platform level? Well Nothing is actually looking at UEFI platform firmware right now from a security vendor perspective like EDR and AV products are kind of starting to They've talked about doing it, but nobody really does it well and we can essentially just stash payloads in Platform firmware in these UEFI variables and evade basically everything. Nope. Nobody nobody looks here So basically what happened is you can take a name So in this case like a test name and then a thing called a GWID and it becomes essentially Tupel that can be looked up by the platform firmware in order to pull that that variable out of NV RAM Which contains a bunch of data and then there is variable attributes in this case a non-volatile Boot service accessible and runtime accessible and you need that in the windows environment in order to have persistent storage and pull it You can read the UEFI spec if you want to know more. I wouldn't recommend it So there's a couple of types of UEFI variables You've probably heard of authenticated variables before these are variables that are backed up with x509 aka secure boot Secure boot everything lives in an authenticated variable. That's where your PK your KEK and your DB keys and whatnot are so the things That actually sign like the boot loader. That's where that's where they're stored But what we care about is unauthenticated variables because there's no verification on right. There's no there's no verification They're not they're not signed And the majority of variables on your platform are actually unauthenticated. So to anybody looking it's benign. Whatever there's things there We nobody knows they exist So we're gonna talk about UEFI stuff on Windows and on Linux because it's platform firmware. It's also platform agnostic So every single operating system is using it and there's other forms of UEFI like we're gonna talk about the UEFI that's Published by Intel, but there's also like core boot which is Google's version of it that runs on like Chromebooks and whatnot But we're focusing on x86 platforms. So it's UEFI So UEFI and Windows is somewhat peculiar So they actually took it away in like early versions of Windows 10 and my background before Leading and doing red teaming stuff was a platform firmware research So when I was reading through some MSDN articles and I saw release notes on Windows 10 1803 They reintroduced the get-and-set firmware variable API And it had this long list of requirements. So it had to be you have to have this special token It has to be an admin app It has to be signed by the Microsoft Store in order to actually execute on a box All these requirements. There's a little URL.  It all works So here's a really quick example, and we're flying through this. It's a lot of gotta talk fast There's get-and-set firmware variable Apis that once you bypass all of that bullshit that Microsoft says you need that you don't need you can do these things So I said that UEFI variable has a name and a grid people So those are the first two arguments basically when you're setting you just say I want to have this name in the squid And then you give it the the payload. We're gonna call it a payload because it's not data It's it's our malicious payload and you just say write that to a firmware variable with the squid and this this name And then when you pull it, it's similar You just give it a memory address over here in the ether that you're going to have like a Zara WX memory page You'll pull that firmware variable out Which is your payload and then you're gonna run it as like a raw memory pointer So you can do that in C++ Hilariously enough the MSDN article is a little bit right when you're talking about C++ and you need some of those Requirements in that long list So that kind of sucks and C++ do if you're at all familiar with how EDR and AV works Obviously if you're doing things like virtual protect virtual alloc and any of those calls to make RWX memory AV typically at this point in time is like whoa, you can't actually do that. That's malicious. Nobody does that. I You know blue team hunch you down and it's already over so in C sharp because of the notion of Like just in time compilation everything's RWX. So sweet free RWX memory for execution Nothing really ever looks at C sharp apps from an AV perspective like they'll look at strings and signatures of P invoke Which I'll get to but you can basically not worry about any of that either Furthermore, there's a bunch more stuff that makes C sharp great like bypassing W DAC is really easy Like sign code and C sharp whatever there's tons of tools that you just compile and run Specter ops guys have a lot of stuff on their blog about that and furthermore like we're red teamers We want to make things easy for a red team friend.  You just have to get a privileged token That's pretty benign a lot of apps do that.  It's it's all in the repo. Basically you you P invoke set privilege You obtain that SE privileged token and now you're privileged app You then get the address of the pin buffer in C sharp. So that's really easy to it's basically a couple of Reflective calls to like interop services. So in this case, I'm just pinning a Payload which I'll show you in the demo. It's basically for examples here. It's just going to be like a meterpreter super exciting and Then you write the UEFI variable. So here I have the variable name and the grid So there's my tuple. I give it the payload and then it just writes it into my UEFI platform So because I was saying UEFI platform NVRAM is persistent across everything so you can erase the operating system and that's still going to be there So you might not actually have the persistence mechanism to execute that payload, but it's still going to be there So that's that's pretty cool. It's nice artifact of this attack So to execute it, it's pretty similar You still need that token and you need a couple of other I'm going to hand wave things to get around So like for example persistence, we're not giving you a new persistence mechanism here.  I know all of you red teamers out there have have fun tools to do this So basically you still need the token in this case We're going to P invoke that RWX memory stuff and then obtain the UEFI variable with get firmware environment variable ex and then execute it But actually I was lying because we can't P invoke. I already told you that you don't do that Hilariously enough. I've done a lot of P invoke stuff and C sharp malware Writing in the past. I actually spoke at devcon 23 on a on a C sharp like malware framework thing that I built So I already knew this but when this came out OJ's tweet He was working on some C alarm interpreter stuff So I had to include it basically if you're writing C sharp malware, don't use P invoke It's the proverbial sin and EDR is going to find you and obviously we're trying to hide our shit and not get found So instead of P invoking what you're going to do now is you're going to reflectively obtain RWX JIT memory because everything in C sharp after it gets just in time compiled is RWX So that's that's a total freebie. I love it We'll still write in the same way But we're going to now write reflectively and then we're going to execute the method So I'll show you what that looks like in code because I know that's a lot So basically if you're not familiar with what C sharp and reflection is C sharp is great in that because it's an intermediate level language It has to get just in time compiled and all of that becomes RWX memory because they don't clean anything up once it's been jitted and If you look at the implementation of how C sharp does this you basically wind up with this huge mesh method table That has these JIT stubs for all of the classes methods So basically with reflection you can you can reflectively obtain and look at the the program Grab all of those methods that you want dereference the JIT stub Force the just in time compilation process to happen on that JIT stub despite the fact it's not going to be executed Grab that as a memory pointer Overwrite that memory pointer and then call it like it's a real method Follow me Okay, I'm going to show you some code So this is now instead of P invoke. This is step two. We're going to reflectively attain RWX chip memory We're going to define a method. We're going to jit it and then we're going to overwrite that pointer So this is real easy. I'm just going to define a method to overwrite. It does nothing overwrite me There's also a blog post on this if you're not following along so take a picture the slides are public Then you're going to jit the method so here I just reflectively get the overwrite me method and then I get the the method handle to it and once I have the method handle I can do runtime helpers prepare method and that forces the just in time compilation process And then I can dereference that method handle to the raw function pointer and that raw function pointer is the assembly code That's going to get executed on by the processor. So that's pointer to method now So then when I write the when I read the UEFI variable that's already been stashed by my writer binary I can now give the variable name and GWID tuple. I can use the pointer to method which is reflective RWX memory that's been jitted and then I can execute the method and I don't have to like use any weird like assembly voodoo here Like you'd have to do in C++ because overwrite me now points because I overwrote it in that reflective stub It up take it actually has the shellcode now from the UEFI variable So EDR and AV doesn't see shit So here's the demo I'm going to obtain a quick shell on the target. This is all hand wavy It's going to go real fast because Mike still has to talk and we have like eight minutes left So here's the demo. I'm going to speed it up So what I just did is I'm on a Windows box. I just ran a thing called chip sec It's a platform security tool that allows you to basically audit firmware variables and audit your UEFI platforms Check it out. It's awesome. So I just ran a module. That's essentially dump all of the UEFI variables You can see them all you can see which ones are authenticated which ones aren't what the attributes of them are I can go through and dump them all you can see that there's you know a variety of different variables and they all have data So like this is a test for example And so what I'm going to do is I'm going to use that right UEFI C sharp executable I'm going to write a new variable. So this is how I'm stashing my payload So I just wrote it. I'm stashing my payload. You can see now. I have a new variable. That's in the platform C sharp UEFI I can go through and actually list what the data is. So like I said, it's just going to be like a meterpreter payload There's the payload. It's just data within UEFI And at this point you might with that writer binary AV and EDR is going to catch you there probably Because like we said, we're just trying to flatten the wrist curve the initial shell pop. That's when they're going to catch you But once that pat payload and persistence is all in UEFI firmware variable space Yeah, they don't they don't see you anymore and that's what we want So here I'm going to come over and you write read C sharp So this is going through all the reflective magic and that's going to execute the UEFI variable with the reflective properties that I just described and then I can come over here and you can see that my shell opened So it gets better. So because this is a platform firmware It's persisting across reboots that variables always going to be living there I'm rebooting the VM just to showcase that that payload still going to be executed once the machine pops back up It's a cooking show. It's baking the VMs booting and there we go. It just reran. It's in platform firmware come at me EDR So that's the demo. What about EDR products? Well, like I said, they don't see any of this They might see the initial write binary, but that's about it No EDR is looking at UEFI variables. No, where's AV the persistence mechanism. Like I said is hand wavy Y'all know how to bypass persistence mechanisms and not get caught Furthermore, like EDR is pretty garbage.  We got a full weaponized payload. So this is gonna go pretty fast Okay, so if we think about the problem space basically we have EDR EDR is looking at your you know looking at your payload which just became their sample the important thing to notice here is that the EDR and your payload because you're running as root, right? Are basically peers. There's a little bit of a kernel interface that the EDR uses to To look at what your sample is doing but basically, you know, this is an even playing field. So what can we do about this? Well, we can show up early and sucker punch the EDR and it becomes our payload and it's looking the other way So how are we gonna show up early? Well, let's let's talk about how your computer boots We know that it boots at the firmware and that's signed by the OEM and we can't infect that. That's a bummer and Then the shim boots which is signed by Microsoft. That's a bummer and Then grub boots and it's signed by the distro. That's a bummer And then the kernel boots which is also signed by the distro bummer The RAM disk though is unsigned and generated on the system So it looks normal to generate a RAM disk on a system and there's no verification. I like it And sometime later EDR shows up. So obviously we want to land where the happy face is so what what techniques do we have to To to control execution of the EDR. Well, we have ptrace and ptrace is great It lets you, you know, read them write memory and control the registers But the problem is that ptrace is usually prohibited by policy. The good news is policy is applied by user space That's great Okay, so let's think about how how this works in context. So first thing is system boots. You have PID 1. It's in the RAM disk space It execs into the root FS land that system D. It's also PID 1 it loads the policy and the EDR The thumbs down is the policy and the eyeballs of the EDR and then you know, you get rolled up and that's no good So what other APIs do we have to use we have FA notify FA notify is like an AV API. So we're just going to use that for evil lets you Intercept file opens and then hold them to decide if it's okay or no And then we have memfd create. We don't want to leave anything running on, you know leave any payload on disk So we'll just make a file descriptor in memory that looks That that looks like a file, but it's not one and then this is like some black magic fuckery That's in the code that you can you can just look in the code for black magic fuckery and you'll find this part Okay, so What we're going to do is we're going to make a demon you can see the little the little demon face in The boot flow and we're going to do that and it's going to span ramdisk land and And root FS land and it's going to open the UEFI firmware It's going to grab out stage two of the payload. So stage one is the demon Then system D is going to exact and it is going to stop the policy load from applying the prevents our malicious action Then we're going to inject into the EDR platform. That's stage three and How are we going to do that we're while we're going to p trace which is going to stop us right on the edge of a system call Then we're going to control eax and we can coerce by single-stepping system calls So we'll make a page That looks like a file. We'll put our we'll put our malicious library in there We'll map another will coerce another page and we'll put our shellcode in there And then we'll return to DL or we'll return to libc with the deal open with libc's internal deal open And then we'll return back to wherever the EDR was great so now The EDR is infected. It can't see us and we load the policy. So everything looks fine But it can't see our payload see the eyeballs are looking the other way This is the Linux demo We have like a minute 30 remaining. So I'm just going to let it rip and you're going to figure out what happened Oh god, how do you computer? See go go go. It's running. Oh god Computers are hard. Okay. I need to do this. I need to do this stuff contour He still doesn't know how to use okay, so we have the analyst on the right the hacker on the left We're going to tune up audit D as our example EDR Whoa So we tuned it up. You can see a bunch of noise there the analyst sees you We're going to exploit to get an enterprise tool to get root. You can see where root You can see like we're making noise. Oh, no, then we're gonna have a bad day now we're gonna overwrite the The RAM disk and infect the UEFI you can see it makes noise you saw that initial part You might get caught everything's infected. Have a nice day Then we reboot cooking show cooking show cooking show go go go go go go go Okay, we tune up audit here and you can see we're back at the analyst on the On the right and the hacker on the left then we set our marker there We set our marker so that our payload knows not to Not to look at us and Then you can see that That we have our marker. It's time or slack namespace and We can exploit things and you can see it's not making any noise in the in the EDR And we are totally silent And we're doing all of our our bad stuff and then ta-da. This is where you clap. It's hard because there's no shell pop It's just nothing happens Okay, so what does this all mean? Oh god. Oh god computers are hard This is this yields a net increase in overall happiness. You're happy the analyst is happy Everyone is going to have a pleasant a pleasant Friday evening All right, we're out of time so mitigations and recommendations like basically you're fucked All right, so there's some future work you talk to us outside about what it is Basically, we now have a net increase in happiness. We've flattened the wrist curve We're not going to get detected once our shells pop We're going to have a UEFI dot party and we're going to plunder aware loot like it's the 90s again There's a lot of code on our github repo. We're perturbed platypus or as every Awesome malware duo needs an apt name and in this case we're apt pp We can talk about that outside So that's all we got. There's some references. Thank you. Thank you very much. All right If anyone has any questions for them, let's let's move it outside and thanks for your time everyone


Isstro Guys I'm hanging out with some Dayhad fans of Kurugensi As you can see they are rocking his Machanda So uh une ito nani bro? Uhh One name, so one name Ehe Ene kandu Done Done Na Rafiki ya kwa naito nani? Billy Garrett Hm No no me Jipanga So in Machanda he is me Baisahi ama muliku wa misha Misha Jipaka badae? Juli baen laika Probabily mantha goivi So you got tickets around one month ago? Ya sure What do you love about Mgrugens? The vibe, the audience you know,the vibe that comes with it What can you say is your biggest expectation tonight? Phenomenal laughter and some good smiles Alright, thank you so much for taking to me So we made sure we had to be here for this event. We are looking forward to it. Are you die-hard fans of Mkuru Genzi? Any day, any time. Let's talk about your outfit. They are very unique. I don't know whether you guys are doing some color coordination. Can I do this? I want to give my lady the spotlight for a minute. This is an original creation. She designed and created this herself. So every detail on all that, this is all her. One of one. It is. I'm dry, so I created this outfit myself. Actually I've just finished it like an hour ago. Just before I left. I studied fashion design and that's what I'm doing currently. Alright, it does look amazing. What about yours? Did she make it for you? No, basically when I saw what my lady had in mind, I said let me do my part so we can at least look somewhat similar. So I threw this one on. I've had it for a bit of time but I said let's come together in style.  So that's the story behind these outfits. So I want you to look inside the camera and tell Mkuru Genzi one word. Oh my goodness. Put on a good show. That's more than one word. It is. I love you. I had fun any day, any time. You're doing a good job. God bless you. Alright, thank you so much for talking to us. I'm going to let you enjoy the events. Alright, thank you.


So, hi again. Welcome everyone. My name is Rada Warbowski and I work at Red Hat as one of the kernel engineers based in Brno. And part of my job as a kernel engineer is to help to deliver new kernel updates to customers. And two years ago, I saw Stav Alter's presentation about cyborg teams and automatization for the project cockpit. And I thought that it's something really cool and I want to do something similar, but for the kernel. So I started experimenting with the data that is available to me. And it's not only patches and kernel source tree, but also various kernel error messages generated by customers and our internal teams. Although Red Hat is not exclusively an OS company anymore, Fedora and Enterprise Linux are important key assets of our ecosystem. And such error messages are sort of a feedback how good we are about doing our job correctly. There's a department in Red Hat that serves as a gateway between kernel engineers and customers. And here in Red Hat, we call it the global support services or GSS for short. And customers are sending their kernel crashes to Red Hat to take a look at what happened under systems. And if the problem cannot be solved by the first line support and trained engineer needs to take a look at the send data using cryptic tools like crash or GDB and compare the customer data with the source code and do a technical analysis by hand. Such engineers are only a handful and there's limited time how much they can invest at a certain case. And when I heard that the kernel crashes and their logs are proceeded manually by hand, I thought I can help here. Because Red Hat has a knowledge base with already solved customer cases and solutions with solutions to problems. And such cases already contain data like the kernel error messages. And I thought if one customer encounters a problem, there's a probability that someone else has the same problem. And there's also a possibility that the problem is already solved and all you have to do is connect such cases or with existing solutions or to a similar problem which can lead to an engineer to the right direction. But there's a small catch regarding Linux kernel and its error messages and why they are analyzed by hand. But first let's take a look at the kernel error message. So here's an example. If you are using Linux for a longer period of time, you have probably seen a similar message. It's usually generated when something went wrong in the kernel and the kernel does not know how to handle the situation and it wants to notify you about its crash. It brings you its late state.  Or if you are a customer, you can at least have something you can report to your support so they have a point of start to help you to solve the problem. There are many parts to such a kernel error message. So let's take a quick overview. The issue line is usually the first line of the message. It tells you what went wrong, what kind of problem you are looking at. In this case, the kernel was triggered after its internal counter was not refreshed for a while because some process was holding the CPU for a long time and the kernel could not schedule other tasks and became unresponsive. The yellow bar points to the list of loaded modules. They are part of the kernel that can be loaded on demand. And you might think of them as hardware drivers for networking cards and sound cards, but they might also contain file systems and even communication protocols and even communication protocols and native language support. It's also a way for third party vendors to deliver their propriety code to the kernel. The orange bar highlights the information about the process that has caused this message. The CPU where it was running, its process ID, information about the kernel version, whether a propriety kernel module was loaded, and of course the hardware and the bio string. The pink bar highlights the content of the CPU registers when the crash happened. The registers might contain immediate results of previous operations, pointers to memory structures, input parameters of functions, but might also contain nonsense and garbage values if the process has gone wrong. The violet bar highlights the top part of the stack. It's a piece of memory privately allocated by the kernel for every process and running tasks in the kernel. And the stack may contain return addresses of functions from the cold trace. It might contain local variables, but also nonsense if the memory was overwritten by a rogue process. Okay, so the blue bar shows the cold trace. It's a simple call graph of functions starting from top where the entry point to the kernel was to the bottom, where the problem happened. And the trace shows the mapping of the functions in the kernel space, but most importantly, the names of those functions and it's usually the first part when an engineer will start analyzing the error message. Do you see the next slide? The blue light. The last is the light blue bar showing the machine code around the place where the problem happened. So there's a lot of information encoded in this text, and depending on the type of the failure, not all of the present information needs to make sense, as it might be random noise. Additionally, there's no single unifying functions or a macro to display such output, because every different subsystem displays different messages and each hardware architecture defines its own set of callbacks for hardware specific information. And to make things more complicated, do you see this slide? I mean, is it okay? Linux kernel is a complex piece of software. It's not an average user space application which can be easily debugged and where errors will show up with the same output. Debugging a running operating system is tricky and although the kernel has ways to tell you something went wrong by printing an error message, there's a catch. In the kernel, there are many asynchronous processes running at the same time, which might influence each other. Also, every system is different, unique by its hardware or a list of loaded modules. And all that might cause that the same problem will manifest with different error messages on different systems. In other words, if you are sitting the cold trace, again, everything that is shown here might change even if you encounter the same problem. So you will get a different content, even if you are encountered the same problem. So if you are using a simple string comparison function to compare kernel messages for an aiding system, this will not work and some kind of fuzziness and comparison is necessary. And you might think, well, that's easy. There is a whole set of string similarity algorithms that are proven to work and we can use and you are right. So I made the list to name a few. I'm not going to go into details how they work as it would take another presentation. However, in practice, they accept two strings on the input and they will give you a number on the output to tell you how much the two strings differ from each other. Since they are proven to work, and there is a list, there's it's a huge list aside from I wanted to make sure I take the best performing one. So in this case, with it, it was the fastest one. So I made a small performance test to see how they hold up. And the test is simple. Find the most similar match from a search space consisting of 63,000 unique kernel error messages. So here's the table showing the result for a single average search. The values are in milliseconds sorted from worst on the left to the best on the right. And it took more than 63 seconds for a single search for the worst performing algorithm. And the best one was 3.3 seconds. So, yeah. Yeah, the worst one was 36 milliseconds. The best one was 3.3.  And this, this might be good for a small research project, but it's not imaginable that an employee will in best case log a server CPU for three seconds to get one result and the search time will expand with new cases. But maybe there's a way to make it faster. For example, if we take one of the algorithms and do some tweaking and optimizations we could achieve a faster result. So let's take some two random search algorithms and let's see if we can make them faster. And to be honest, I, if you see the how about I will probably ask for a notification every time the slide switch. So I'm sure I'm on the right. I'll stay here. How about we can see how about with two algorithms in both. Okay. I'm just, I have not chosen those randomly because they are already used in red hat for specific projects. Yes, that was to string similarity, and then jump again. Okay. But you should see like J W star and star. Okay, because I won't know I won't name those projects. Instead, I will use substitutes J W star and LCS star. And before I talk about the specific optimizations. Those projects have taken let's, let's like, let's take a look how fast they have become compared to their unoptimized counterparts. So there's a huge drop in search time in both projects. J W star down to a half a second and LCS star down to 39 milliseconds. And although I'll see a star seems to be the clear winner year. Let's talk about it. J W stars optimization first. The J W star project takes the cult race part of the error message that was the blue portion of the message, but throws away the whole cult race and keeps on the three bottom frames. They are then concatenated to a single string and compared against its internal database. And you might ask, are three frames enough to decide about string similarity of two different messages. That would probably depend how long is an average carol cult race anyhow. So there should be a graph now. So the graph was generated from the sample search space and it shows the distribution of the current cult races by language frames. Reading from the graph it's highly probable that and call graph cult race will be between 18 to 25 frames. And if we keep only the last three frames people throw away 83 to 88% of the information from the cult race or more. And we can still argue if those thrown away frames have any value, but I would say depends from case to case. So how about the RCS star optimization. The RCS star compares the whole cult race. And it was the most successful after optimization dropping from almost 13 seconds per search to 39 milliseconds. And the secret behind the RCS star improvement is that it compares only the last 200 entries in its database. In this specific case where we have 63,000 entries, it throws away 99.7% of the data to speed up, and only 0.3% is kept for comparison. The results with optimization are much better, but at what cost, either by limiting the search space or by throwing away the content. And I wanted to scale up for speed but without any compromise and possibly by keeping all the data. So the string similarity functions are dead end here. It looks like computers were not really designed to do fast operations on large quantities of human text. Although kernel error messages contain technical information about the CPU and the state of the operating system. It is presented in a form that is readable primary for humans, not for computers. Luckily, there's a field of computer and of computer science and linguistics that specialize just on that. It allows computers to process human readable text in a fast way, and the name of the field is natural language processing, also known as NLP. The one feature I borrowed from NLP are word embeddings. What would Wikipedia for definition word embedding is a collective name for a set of language modeling and feature learning techniques in natural language processing where words or phrases from the vocabulary are mapped to vector of real numbers. In other words word embedding is a representation of words or phrases using numbers and high dimensional vectors, explaining how to turn words into vectors would be for another presentation but you can look it up on the Wikipedia. After some initial test with my own implementations. I chose an existing library named work to make which was written by Thomas Mikhailov, former Bruno universe university student in 2013. Here's a picture from the original work to make paper, what they used a method named PCA or principle component analysis to squash the high dimensional vectors to a two dimensional representation. And it's easy to see the relationship between countries and their capitals, although work to make is a statistical model which does not understand the text that is transforming to numbers. The integrated vectors capture, surprisingly, a lot of syntactic and semantic information from the source text. Here's another example. There are multiple degrees of similarity among words, for example, King is similar to Queen as man is similar to woman. So you can think of work to make as an analogy detection, but how is this applicable to Linux error messages. So the work to make model on the 63,000 messages from the search sets, search test, search test, each string that means all the function names, all the modules, kernel versions issues drinks and hardware strings are turned into large vectors. And I chose some random functions and module names and search for the most similar ones. And remember, the, the found similarities are based on the content of the other messages, not from the source source that source code. Here is a picture that uses dimensionality reduction to draw kernel functions as dots, and why the color of the dots was added by me, depending on where the each of the symbol was defined in the Linux source tree. The structure and the clustering of the points was learned by the NLP model, not from the source code but from the error messages. Although information is lost when you are transforming a vector from hundreds of dimensions into just two. It's clearly visible that the frames from the same subsystems are grouped together. So it seems to work. Let's take a look at the searching actually works. We don't have to deal with characters anymore. The strings are turned into something that the computers are good at into numbers. In this case vectors, and you probably still remember from high school or university years. What is the easiest way how to find distance between two vectors. And for those of us who are guest L2 or Euclidean distance, then you guessed wrong. Because we are working with vectors, not points. The easiest way to measure how similar two vectors are is to find out the angle those two vectors are holding. So on the right should be the formula. In the numerator, we multiply vectors element wise and divide the result by their magnitudes computed in the denominator. To make sure the denominator is always equal to one, there's no need for division. The question is, when is the denominator equal to one. The answer is, but if both vectors are normalized and their magnitude equals to one. The wall distance measuring becomes a simple multiply multiplication of two vectors, or in our case of a vector and a matrix where the matrix contains the vectors from the search space. There are two lines of Python codes to implement the search. The first line of the code is the multiplication of the search space matrix and a sample, and the second line source the result and results the three causes matches. So we have seen how to turn individual words into vectors we have seen how to search for the closest vectors or analogy. The next piece to the puzzle is to figure out how to transform individual individual vectors into a single vector that can represent the whole kernel error message. And there are several ways how to do it. However, the simplest one that worked for me is to sum all the vectors and normalize the final product. Though it might seem to be illogical, it's proven to work for, for example for sentiment analysis on human text. And so there are all the steps needed for a simple editing system. We have a have an LP model that can translate strings into vectors. Take an error message split it in the into individual words words or tokens translate those tokens into vectors using an LP sum them up and make sure the result is a unit vector. So you probably would like to know how fast it is single search on the 63,000 samples in my configuration is below 10 milliseconds. And there are no compromises. That means no data is thrown away for speed or optimization. You may ask, does it really work is that a proof of it. So mathematical proof would be difficult. And therefore I made a small test application that collects data from various parts of our internal network. New error messages from testing infrastructure new customer cases and their solutions, and the more data are available to the model the more accurate it is in searching. The application is accessible through a web interface where you can upload your query as a file, or you can copy and paste your query into a web forum, and the application will give you three best results that have that is that are stored in its database. So here in this picture I'm entering the example from the start of the representation into the web form. And the application will give you three best matches for every unit kernel error message that you have uploaded. How close are the matches to the original query is displayed by colored cubes seen here on the left upper corner in the picture with color gradually changing from green as the best result, the red as the absolute first one. So here in this example it found the perfect match as it was already in the database. So you can match that the application found the match is not the same but very similar one. The hardware is different the kernel is different the code phrase is different, but the problem seems to be the same. Watchdog barking about a stock process that is network file system related. Also this match is pointing to an already solved case, which might be used as an inspiration for solving the new problem. For example, there wasn't an exact match, and you might might be asking, why am I talking for 17 minutes about something that could be explained in just two sentences. Here is a picture of all the error messages as word embeddings from the sample said the vectors are gathered into groups of clusters and there's an underlying structure. Because unlike previous mentioned algorithms which work directly with strings and their only output is a single number. This one works with vectors. And just to the help of NLP we can find analogies between individual individual messages, but more importantly, such vectors can be fed into more advanced machine learning models that can do more work in the future than just searching. Well, it could take a look at new previously unseen problems and help them classify with growing number of automated tests and more complex infrastructures this would be a huge help to those who are taking care of the infrastructure and also to those who are writing and running the tests. And with the help of large language models like transformers, machine learning model might become one day your coworker that will help you with customer requests with time computers will be will become less the source of frustration and error messages by the more valuable to a partner that will help us be more productive in the future.