发表机构
Institute of Communication and Computer Systems (ICCS), National Technical University of Athens; University of Thessaly; DASKALOS APPS SAS（雅典国立技术大学通信与计算机系统研究所; 色萨利大学; 达斯卡洛斯应用公司）
机构由 AI 辅助整理，请以论文原文为准。AI 中文总结
本研究通过滑动窗口威胁评分器对比 Python 与 Rust 实现，分离语言与算法效应，发现算法优化（增量更新）贡献超万倍加速，远超语言本身，强调性能报告应区分两者。
AI 中文摘要
将热路径从 Python 重写为 Rust 是加速安全分析的常见方法，且通常能报告出显著的加速效果。一次重写通常同时改变语言和算法，因此单一因素可能将源于更优算法的收益归功于语言本身。我们以 SentinelSphere 平台的红绿灯计算器为模型，对滑动窗口威胁评分器进行了研究。五种实现（三种用 Python，两种用 Rust）产生了位级完全相同的评分，并通过共享校验和加以确认；我们在有界和突发两种模式下，对从 100 到 100 万个事件进行了计时。仅语言因素就贡献了约 4 到 29 倍的加速。将每次事件的窗口重扫描替换为增量更新，在突发模式下贡献了超过 11,000 倍的加速，因此当窗口持续填充时，端到端加速因子达到约 195,000 倍，而当窗口不再填充时，加速因子稳定在约 13,000 倍。对原始重写所报告计时数据的幂律拟合给出了 Python 的 1.85 和 Rust 的 0.88 的增长指数，这是算法差异的标志。因此，安全工具的性能声明应分别报告语言和算法的贡献。
英文摘要
Rewriting a hot path from Python into Rust is a common way to speed up security analytics, and large speedups are routinely reported. A rewrite usually changes the language and the algorithm at once, so a single factor can credit the language with a gain that comes from a better algorithm. We study this on a sliding window threat scorer modelled on the traffic light calculator of the SentinelSphere platform. Five implementations, three in Python and two in Rust, produce bit identical scores, confirmed by a shared checksum, and we time them from 100 to one million events in a bounded and a burst regime. The language alone contributes between about 4 and 29 times. Replacing a per event rescan of the window by an incremental update contributes more than 11,000 times in the burst regime, so the end to end factor reaches about 195,000 times when the window keeps filling and levels off near 13,000 times when it does not. A power law fit to the timings reported for the original rewrite gives growth exponents of 1.85 for Python and 0.88 for Rust, the signature of an algorithmic difference. Performance claims for security tooling should therefore report the language and algorithm contributions separately.
Comments4 pages, 2 figures
