Where does a rust speedup come from? Language and algorithm effects in sliding window threat scorer
A sliding-window threat scorer study finds algorithm changes, not Rust itself, drive most reported speedups.
The paper separates language and algorithm effects in a sliding-window threat scorer modelled on SentinelSphere's traffic-light calculator. Five bit-identical implementations, three in Python and two in Rust, are timed from 100 to one million events in bounded and burst regimes. Moving from Python to Rust alone contributes about 4x to 29x, while replacing per-event window rescans with incremental updates contributes more than 11,000x in the burst regime. End-to-end speedup reaches about 195,000x while the window fills and about 13,000x when it does not.
- Five implementations produce bit-identical scores checked by checksum.
- Switching language alone yields about 4x to 29x.
- Incremental window updates exceed 11,000x in the burst regime.
- Combined speedup reaches about 195,000x while the window fills.
- Benchmarks should separate language effects from algorithm changes.
From the original article
1 min read at arxiv.orgRewriting a hot path from Python into Rust is a common way to speed up security analytics, and large speedups are routinely reported. A rewrite usually changes the language and the algorithm at once, so a single factor can credit the language with a gain that comes from a better algorithm. We study this on a sliding window threat scorer modelled on the traffic light calculator of the SentinelSphere platform.
By Nikolaos D. Tantaroudas · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.