California State University, Northridge Pattern

Total Page:16

File Type:pdf, Size:1020Kb

California State University, Northridge Pattern CALIFORNIA STATE UNIVERSITY, NORTHRIDGE PATTERN MATCHING ALGORITHMS FOR INTRUSION DETECTION SYSTEMS A Thesis submitted in partial fulfillment of the requirements For the degree of Master of Science In Computer Science By Stanimir Bogomilov Belchev August 2012 The thesis of Stanimir Bogomilov Belchev is approved: _____________________________________ _________________ Prof. John Noga Date _____________________________________ _________________ Prof. Robert McIlhenny Date _____________________________________ _________________ Prof. Jeff Wiegley, Chair Date California State University, Northridge ii DEDICATION I dedicate this paper to my parents, family, and friends for their continuous support throughout the years. I am grateful they continuously prompted me to go back to school and continue to educate myself – this has helped me a lot in life. I also want to thank my girlfriend (and future wife) Nadia for always staying by my side and supporting me every step of the way. Her passions for science has had a great impact on me and prompted me to explore subjects that I wouldn’t think would be interesting to me anyways. Thank you!!! iii ACKNOWLEDGEMENTS I would like to thank the Computer Science department at California State University Northridge for their help and support. Especially I would like to thank my committee members – Prof. Jeff Wiegley (chair), Prof. Robert McIlhenny, and Prof. John Noga. I admire their passion to computing and their dedication to teaching their students. My stay at California State University Northridge was an invaluable experience that gave me inspiration, knowledge, and love towards computing. Every class was fun and exciting, even when I had to do my homework late at night. The staff and faculty and the Computer Science department was professional and very knowledgeable and they certainly helped me grow as an individual. Thank you all! iv TABLE OF CONTENTS Signature Page .......................................................................................................................... ii Dedication ................................................................................................................................ iii Acknowledgements .................................................................................................................. iv List of Tables ........................................................................................................................... vi List of Figures ......................................................................................................................... vii List of Algorithms .................................................................................................................. viii Glossary of Acronyms ............................................................................................................. ix Abstract .................................................................................................................................... xi Chapter 1: Introduction ..............................................................................................................1 Chapter 2: Overview of Intrusion Detection Systems ...............................................................4 2.1 Firewall versus IDS........................................................................................................5 2.2 Passive versus Reactive IDSs ........................................................................................6 2.3 Network-based versus Host-based IDSs ........................................................................7 2.4 Distributed IDSs...........................................................................................................10 2.5 Signature-based versus Anomaly-based Detection ......................................................12 2.6 Wireless IDSs...............................................................................................................14 2.7 IDSs Software Implementations ..................................................................................16 Chapter 3: Snort Intrusion Detection System ..........................................................................18 3.1 Overview of Snort IDS ................................................................................................19 3.2 Snort Architecture ........................................................................................................22 v 3.3 Snort Rules ...................................................................................................................21 Chapter 4: Traits of Pattern Matching Algorithms ..................................................................28 4.1 Overview of Pattern Matching .....................................................................................28 4.2 Signature Set Size ........................................................................................................30 4.3 Alphabet Size ...............................................................................................................31 4.4 Keywords Length .........................................................................................................32 4.5 Computational Complexity ..........................................................................................34 Chapter 5: Single-Keyword Pattern Matching Algorithms .....................................................38 5.1 Brute Force (BF) Algorithm ........................................................................................39 5.2 Knuth-Morris-Prath (KMP) Algorithm........................................................................42 5.3 Boyer-Moore (BM) Algorithm ....................................................................................47 5.4 Karp and Rabin Algorithm...........................................................................................55 Chapter 6: Multiple-Keyword Pattern Matching Algorithms ..................................................60 6.1 Aho-Corasick (AC) Algorithm ....................................................................................60 6.2 Wu-Manber (WB) Algorithm ......................................................................................66 6.3 Commentz-Walter (CW) Algorithm ............................................................................69 Chapter 7: Conclusion..............................................................................................................57 Bibliography ............................................................................................................................58 vi LIST OF TABLES 5.2 Pre-computational table of the next function in the KMP algorithm.................................36 5.3 Pre-computation of the SHIFT table in the Boyer-Moore algorithm ................................42 6.2 Calculation of the min function in the Wu-Manber algorithm ..........................................57 6.2 SHIFT and HASH tables in the Wu-Manber algorithm ....................................................60 vii LIST OF FIGURES 2.3 A typical deployment of a Network Intrusion Detection System ........................................9 2.4 Distributed Intrusion Setection System .............................................................................11 3.2 Architecture of Snort IDS ..................................................................................................19 3.3 Sample Snort rule detecting attempts from a telnet session ..............................................21 4.4 Distribution of the string length in the Snort default database ..........................................28 4.5 Normal and worst-case operation of a hash table. .............................................................30 5.3 Example of Moyer Moore Pattern Matching Algorithm. ..................................................44 6.1 Keyword tree for P = {he, she, his, hers}. .........................................................................52 6.1 Example of Aho-Corasick automation ...............................................................................54 6.2 Relation between search time and the length of patterns in Wu-Manber algorithm .........62 6.3 Commentz-Walter keyword trie including both shift functions ........................................66 viii LIST OF ALGORITHMS 5.1 Java implementation of Brute Force algorithm .................................................................34 5.2 Knuth-Morris-Pratt Next Function ....................................................................................35 5.2 Knuth-Morris-Pratt Matching Algorithm ..........................................................................39 5.3 Boyer-Moore bad character pre-processing .......................................................................44 5.3 Pseudo Code of Boyer-Moore Algorithm. .........................................................................45 5.4 Pseudo code for Karp-Rabin string matching algorithm ...................................................49 6.1 Aho Corasick Goto Function. ............................................................................................54 6.1 Aho-Corasick Multiple Pattern Matching Algorithm. .......................................................55 6.2 Pseudo-code of Wu-Manber algorithm. .............................................................................63 6.3 Commentz-Walter multiple pattern-matching algorithm pseudo-code.
Recommended publications
  • Algorithms for Approximate String Matching Petro Protsyk (28 October 2016) Agenda
    Algorithms for approximate string matching Petro Protsyk (28 October 2016) Agenda • About ZyLAB • Overview • Algorithms • Brute-force recursive Algorithm • Wagner and Fischer Algorithm • Algorithms based on Automaton • Bitap • Q&A About ZyLAB ZyLAB is a software company headquartered in Amsterdam. In 1983 ZyLAB was the first company providing a full-text search program for MS-DOS called ZyINDEX In 1991 ZyLAB released ZyIMAGE software bundle that included a fuzzy string search algorithm to overcome scanning and OCR errors. Currently ZyLAB develops eDiscovery and Information Governance solutions for On Premises, SaaS and Cloud installations. ZyLAB continues to develop new versions of its proprietary full-text search engine. 3 About ZyLAB • We develop for Windows environments only, including Azure • Software developed in C++, .Net, SQL • Typical clients are from law enforcement, intelligence, fraud investigators, law firms, regulators etc. • FTC (Federal Trade Commission), est. >50 TB (peak 2TB per day) • US White House (all email of presidential administration), est. >20 TB • Dutch National Police, est. >20 TB 4 ZyLAB Search Engine Full-text search engine • Boolean and Proximity search operators • Support for Wildcards, Regular Expressions and Fuzzy search • Support for numeric and date searches • Search in document fields • Near duplicate search 5 ZyLAB Search Engine • Highly parallel indexing and searching • Can index Terabytes of data and millions of documents • Can be distributed • Supports 100+ languages, Unicode characters 6 Overview Approximate string matching or fuzzy search is the technique of finding strings in text or dictionary that match given pattern approximately with respect to chosen edit distance. The edit distance is the number of primitive operations necessary to convert the string into an exact match.
    [Show full text]
  • NEWS for R Version 4.1.1 (2021-08-10)
    NEWS for R version 4.1.1 (2021-08-10) NEWS R News LATER NEWS • News for R 3.0.0 and later can be found in file `NEWS.Rd' in the R sources and files `NEWS' and `doc/html/NEWS.html' in an R build. CHANGES IN R VERSION 2.15.3 NEW FEATURES: • lgamma(x) for very small x (in the denormalized range) is no longer Inf with a warning. • image() now sorts an unsorted breaks vector, with a warning. • The internal methods for tar() and untar() do a slightly more general job for `ustar'- style handling of paths of more than 100 bytes. • Packages compiler and parallel have been added to the reference index (`refman.pdf'). • untar(tar = "internal") has some support for pax headers as produced by e.g. gnu- tar --posix (which seems prevalent on OpenSUSE 12.2) or bsdtar --format pax, including long path and link names. • sQuote() and dQuote() now handle 0-length inputs. (Suggestion of Ben Bolker.) • summaryRprof() returns zero-row data frames rather than throw an error if no events are recorded, for consistency. • The included version of PCRE has been updated to 8.32. • The tcltk namespace can now be re-loaded after unloading. The Tcl/Tk event loop is inhibited in a forked child from package parallel (as in e.g. mclapply()). • parallel::makeCluster() recognizes the value `random' for the environment vari- able R_PARALLEL_PORT: this chooses a random value for the port and reduces the chance of conflicts when multiple users start a cluster at the same time. UTILITIES: • The default for TAR on Windows for R CMD build has been changed to be `internal' if no tar command is on the path.
    [Show full text]
  • Approximate Pattern Matching with Index Structures
    Technische Universität München Fakultät für Informatik Lehrstuhl für Effiziente Algorithmen a Approximatec e Pattern Matching b with Index Structuresd f Johannes Krugel a c b d c e d f e e e f a d e b c f Technische Universität München Fakultät für Informatik Lehrstuhl für Effiziente Algorithmen Approximate Pattern Matching with Index Structures Johannes A. Krugel Vollständiger Abdruck der von der Fakultät für Informatik der Technischen Universität München zur Erlangung des akademischen Grades eines Doktors der Naturwissenschaften (Dr. rer. nat.) genehmigten Dissertation. Vorsitzender: Univ.-Prof. Dr. Helmut Seidl Prüfer der Dissertation: 1. Univ.-Prof. Dr. Ernst W. Mayr 2. Univ.-Prof. Dr. Stefan Kramer, Johannes Gutenberg-Universität Mainz Die Dissertation wurde am 06.05.2015 bei der Technischen Universität München eingereicht und durch die Fakultät für Informatik am 19.01.2016 angenommen. ii Zusammenfassung Ziel dieser Arbeit ist es, einen Überblick über das praktische Verhalten von Indexstrukturen und Algorithmen zur approximativen Textsuche (approximate pattern matching, APM) zu geben, abhängig von den Eigenschaften der Eingabe. APM ist die Suche nach Zeichenfolgen in Texten oder biologischen Sequenzen unter Berücksichtigung von Fehlern (wie z. B. Rechtschreibfehlern oder genetischen Mutationen). In der Offline-Variante dieses Problems kann der Text vorverarbeitet werden, um eine Indexstruktur aufzubauen bevor die Suchanfragen beantwortet werden. Diese Arbeit beschreibt und diskutiert praktisch relevante Indexstrukturen, Ähnlichkeitsmaÿe und Suchalgorithmen für APM. Wir schlagen einen neuen effizienten Suchalgorithmus für Suffixbäume im externen Speicher vor. Im Rahmen der Arbeit wurden mehrere Indexstrukturen und Algorithmen für APM implementiert und in einer Softwarebibliothek bereitgestellt; die Implementierungen sind effizient, stabil, generisch, getestet und online verfügbar.
    [Show full text]
  • NEWS for R Version 3.3.1 (2016-06-21)
    NEWS for R version 3.3.1 (2016-06-21) NEWS R News CHANGES IN R 3.3.1 BUG FIXES: • R CMD INSTALL and hence install.packages() gave an internal error installing a package called description from a tarball on a case-insensitive file system. • match(x, t) (and hence x %in% t) failed when x was of length one, and either character and x and t only differed in their Encoding or when x and t where complex with NAs or NaNs. (PR#16885.) • unloadNamespace(ns) also works again when ns is a `namespace', as from getNames- pace(). • rgamma(1,Inf) or rgamma(1, 0,0) no longer give NaN but the correct limit. • length(baseenv()) is correct now. • pretty(d, ..) for date-time d rarely failed when "halfmonth" time steps were tried (PR#16923) and on `inaccurate' platforms such as 32-bit windows or a configuration with --disable-long-double; see comment #15 of PR#16761. • In text.default(x, y, labels), the rarely(?) used default for labels is now cor- rect also for the case of a 2-column matrix x and missing y. • as.factor(c(a = 1L)) preserves names() again as in R < 3.1.0. • strtrim(""[0], 0[0]) now works. • Use of Ctrl-C to terminate a reverse incremental search started by Ctrl-R in the readline-based Unix terminal interface is now supported for readline >= 6.3 (Ctrl- G always worked). (PR#16603) • diff(<difftime>) now keeps the "units" attribute, as subtraction already did, PR#16940. CHANGES IN R 3.3.0 SIGNIFICANT USER-VISIBLE CHANGES: 1 2 NEWS • nchar(x, *)'s argument keepNA governing how the result for NAs in x is deter- mined, gets a new default keepNA = NA which returns NA where x is NA, except for type = "width" which still returns 2, the formatting / printing width of NA.
    [Show full text]
  • Department of Computer Science Fast Text Searching with Errors
    Fast Text Searching With Errors Sun Wu and Udi Manber TR 91-11 DEPARTMENT OF COMPUTER SCIENCE FAST TEXT SEARCHING WITH ERRORS Sun Wu and Udi Manber1 Department of Computer Science University of Arizona Tucson, AZ 85721 June 1991 ABSTRACT Searching for a pattern in a text ®le is a very common operation in many applications ranging from text editors and databases to applications in molecular biology. In many instances the pat- tern does not appear in the text exactly. Errors in the text or in the query can result from misspel- ling or from experimental errors (e.g., when the text is a DNA sequence). The use of such approximate pattern matching has been limited until now to speci®c applications. Most text edi- tors and searching programs do not support searching with errors because of the complexity involved in implementing it. In this paper we present a new algorithm for approximate text searching which is very fast and very ¯exible. We believe that the new algorithm will ®nd its way to many searching applications and will enable searching with errors to be just as common as searching exactly. 1. Introduction The string-matching problem is a very common problem. We are searching for a pattern = = ... P p 1p 2...pm inside a large text ®le T t 1t 2 tn. The pattern and the text are sequences of characters from a ®nite character set Σ. The characters may be English characters in a text ®le, DNA base pairs, lines of source code, angles between edges in polygons, machines or machine parts in a production schedule, music notes and tempo in a musical score, etc.
    [Show full text]
  • The Stringdist Package for Approximate String Matching by Mark P.J
    CONTRIBUTED RESEARCH ARTICLES 111 The stringdist Package for Approximate String Matching by Mark P.J. van der Loo Abstract Comparing text strings in terms of distance functions is a common and fundamental task in many statistical text-processing applications. Thus far, string distance functionality has been somewhat scattered around R and its extension packages, leaving users with inconistent interfaces and encoding handling. The stringdist package was designed to offer a low-level interface to several popular string distance algorithms which have been re-implemented in C for this purpose. The package offers distances based on counting q-grams, edit-based distances, and some lesser known heuristic distance functions. Based on this functionality, the package also offers inexact matching equivalents of R’s native exact matching functions match and %in%. Introduction Approximate string matching is an important subtask of many data processing applications including statistical matching, text search, text classification, spell checking, and genomics. At the heart of approximate string matching lies the ability to quantify the similarity between two strings in terms of string metrics. String matching applications are commonly subdivided into online and offline applications where the latter refers to the situation where the string that is being searched for a match can be preprocessed to build a search index. In online string matching no such preprocessing takes place. A second subdivision can be made into approximate text search, where one is interested in the location of the match of one string in another string, and dictionary lookup, where one looks for the location of the closest match of a string in a lookup table.
    [Show full text]
  • A Coprocessor for Fast Searching in Large Databases: Associative Computing Engine
    A Coprocessor for Fast Searching in Large Databases: Associative Computing Engine DISSERTATION submitted in partial fulfillment of the requirements for the degree of Doktor-Ingenieur (Dr.-Ing.) to the Faculty of Engineering Science and Informatics of the University of Ulm by Christophe Layer from Dijon First Examiner: Prof. Dr.-Ing. H.-J. Pfleiderer Second Examiner: Prof. Dr.-Ing. T. G. Noll Acting Dean: Prof. Dr. rer. nat. H. Partsch Examination Date: June 12, 2007 c Copyright 2002-2007 by Christophe Layer — All Rights Reserved — Abstract As a matter of fact, information retrieval has changed considerably in recent years with the expansion of the Internet and the advent of always more modern and inexpensive mass storage devices. Due to the enormous increase in stored digital contents, multi- media devices must provide effective and intelligent search functionalities. However, in order to retrieve a few relevant kilobytes from a large digital store, one moves up to hundreds of gigabytes of data between memory and processor over a bandwidth- restricted bus. The only long-term solution is to delegate this task to the storage medium itself. For that purpose, this thesis describes the development and prototyping of an as- sociative search coprocessor called ACE: an Associative Computing Engine dedicated to the retrieval of digital information by means of approximate matching procedures. In this work, the two most important features are the overall scalability of the design allowing the support of different bit widths and module depths along the data path, as well as the obtainment of the minimum hardware area while ensuring the maximum throughput of the global architecture.
    [Show full text]
  • Grep Pocket Reference
    grep Pocket Reference John Bambenek and Agnieszka Klus Beijing • Cambridge • Farnham • Köln • Sebastopol • Taipei • Tokyo grep Pocket Reference by John Bambenek and Agnieszka Klus Copyright © 2009 John Bambenek and Agnieszka Klus. All rights reserved. Printed in Canada. Published by O’Reilly Media, Inc., 1005 Gravenstein Highway North, Se- bastopol, CA 95472. O’Reilly books may be purchased for educational, business, or sales promo- tional use. Online editions are also available for most titles (http://safari .oreilly.com). For more information, contact our corporate/institutional sales department: (800) 998-9938 or [email protected]. Editor: Isabel Kunkle Copy Editor: Genevieve d’Entremont Production Editor: Loranah Dimant Proofreader: Loranah Dimant Indexer: Joe Wizda Cover Designer: Karen Montgomery Interior Designer: David Futato Printing History: January 2009: First Edition. Nutshell Handbook, the Nutshell Handbook logo, and the O’Reilly logo are registered trademarks of O’Reilly Media, Inc. grep Pocket Reference, the im- age of an elegant hyla tree frog, and related trade dress are trademarks of O’Reilly Media, Inc. Many of the designations used by manufacturers and sellers to distinguish their products are claimed as trademarks. Where those designations appear in this book, and O’Reilly Media, Inc. was aware of a trademark claim, the designations have been printed in caps or initial caps. While every precaution has been taken in the preparation of this book, the publisher and authors assume no responsibility for errors or omissions,
    [Show full text]
  • On the Impact and Defeat of Regular Expression Denial of Service
    On the Impact and Defeat of Regular Expression Denial of Service James C. Davis Dissertation submitted to the Faculty of the Virginia Polytechnic Institute and State University in partial fulfillment of the requirements for the degree of Doctor of Philosophy in Computer Science and Applications Dongyoon Lee, Chair Francisco Servant Danfeng (Daphne) Yao Ali R. Butt Patrice Godefroid April 30, 2020 Blacksburg, Virginia Keywords: Regular expressions, denial of service, ReDoS, empirical software engineering, software security Copyright 2020, James C. Davis On the Impact and Defeat of Regular Expression Denial of Service James C. Davis (ABSTRACT) Regular expressions (regexes) are a widely-used yet little-studied software component. Engi- neers use regexes to match domain-specific languages of strings. Unfortunately, many regex engine implementations perform these matches with worst-case polynomial or exponential time complexity in the length of the string. Because they are commonly used in user-facing contexts, super-linear regexes are a potential denial of service vector known as Regular ex- pression Denial of Service (ReDoS). Part I gives the necessary background to understand this problem. In Part II of this dissertation, I present the first large-scale empirical studies of super-linear regex use. Guided by case studies of ReDoS issues in practice (Chapter 3), I report that the risk of ReDoS affects up to 10% of the regexes used in practice (Chapter 4), and that these findings generalize to software written in eight popular programming languages (Chapter 5). ReDoS appears to be a widespread vulnerability, motivating the consideration of defenses. In Part III I present the first systematic comparison of ReDoS defenses.
    [Show full text]
  • Implementation of a String Matching Sms Based System for Academic Registration
    BINDURA UNIVERSITY OF SCIENCE EDUCATION FACULTY OF SCIENCE DEPARTMENT OF COMPUTER SCIENCE NAME: MATOMBO WILLIE REGNUMBER: B1335487 SUPERVISOR: MR CHAKA PROJECT TITLE: IMPLEMENTATION OF A STRING MATCHING SMS BASED SYSTEM FOR ACADEMIC REGISTRATION APPROVAL FORM The undersigned certify that they have supervised the student MATOMBO WILLIE (B1335487) dissertation entitled, “IMPLEMENTATION OF A STRING MATCHING SMS BASED SYSTEM FOR ACADEMIC REGISTRATION” submitted in Partial fulfillment of the requirements for a Bachelor of Computer Science Honors Degree at Bindura University of Science Education. …………………………………… …………………………….. STUDENT DATE …….………………………………… ………………………….. SUPERVISOR DATE i Abstract The implementation of a string matching SMS based system at Bindura University of Science Education focuses on improving accessibility to academic registrations and viewing results to all students, despite geographical location and internet connectivity. The proposed system bases its operations on SMS technologies which is also supported by string matching techniques. The system user requirements were obtained by interacting with various university stakeholders and experts in the fields of academic registrations. Based on the stipulated requirements, the system was tested using blackbox testing techniques and the results show that the system satisfies user requirements. The system accuracy was also tested and it proved that the implementation of a string matching SMS based system was viable for the institution to adopt since, it proved that all students are now able to do academic registrations in a cost effective way as well as reliable and fast using SMS. Keywords Short Message Service, String matching, Algorithm, Academic registration, fuzzy string matching technique. ii Dedications This paper is dedicated to my late dad Mr. Henry Matombo and my mother Elizabeth Kandemiri for they did not only raise and nurture me but also sacrificed their finances over the years for my education and intellectual development.
    [Show full text]
  • NR-Grep: a Fast and Flexible Pattern Matching Tool 1 Introduction
    NRgrep A Fast and Flexible Pattern Matching To ol Gonzalo Navarro Abstract We present nrgrep nondeterministic reverse grep a new pattern matching to ol designed for ecient search of complex patterns Unlike previous to ols of the grep family such as agrep and Gnu grep nrgrep is based on a single and uniform concept the bitparallel simulation of a nondeterministic sux automaton As a result nrgrep can search from simple patterns to regular expressions exactly or allowing errors in the matches with an eciency that degrades smo othly as the complexity of the search pattern increases Another concept fully integrated into nrgrep and that contributes to this smo othness is the selection of adequate subpatterns for fast scanning which is also absent in many current to ols We show that the eciency of nrgrep is similar to that of the fastest existing string matching to ols for the simplest patterns and by far unpaired for more complex patterns Intro duction The purp ose of this pap er is to present a new pattern matching to ol which we have coined nrgrep for nondeterministic reverse grep Nrgrep is aimed at ecient searching of complex patterns inside natural language texts but it can b e used in many other scenarios The pattern matching problem can b e stated as follows given a text T of n characters and a 1n pattern P nd all the p ositions of T where P o ccurs The problem is basic in almost every area of computer science and app ears in many dierent forms The pattern P can b e just a simple string but it can also b e for example a regular expression
    [Show full text]
  • U·M·I University Microfilms International
    Approximate pattern matching and its applications. Item Type text; Dissertation-Reproduction (electronic) Authors Wu, Sun. Publisher The University of Arizona. Rights Copyright © is held by the author. Digital access to this material is made possible by the University Libraries, University of Arizona. Further transmission, reproduction or presentation (such as public display or performance) of protected items is prohibited except with permission of the author. Download date 25/09/2021 15:18:22 Link to Item http://hdl.handle.net/10150/185914 INFORMATION TO USERS This manuscript has been reproduced from the microfilm master. UMI films the text directly from the original or copy submitted. Thus, some thesis and dissertation copies are in typewriter face, while others may be from any type of computer printer. The quality of this reproduction is dependent upon the quality of the copy submitted. Broken or indistinct print, colored or poor quality illustrations and photographs, print bleed through, substandard margins, and improper alignment can adversely affect reproduction. In the unlikely event that the author did not send UMI a complete manuscript and there are missing pages, these will be noted. Also, if unauthorized copyright material had to be removed, a note will indicate the deletion. Oversize materials (e.g., maps, drawings, charts) are reproduced by sectioning the original, beginning at the upper left-hand corner and continuing from left to right in equal sections with small overlaps. Each original is also photographed in one exposure and is included in reduced form at the back of the book. Photographs included in the original manuscript have been reproduced xerographically in this copy.
    [Show full text]