Glushkov Automata for Regular Expression Engine ReDoS Mitigation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing regular expression engines are vulnerable to regular expression denial of service (ReDoS) attacks due to excessive temporal and spatial resource usage when checking harmful patterns against character strings, leading to inefficient match determination and potential system crashes.
Innovation Solution
The proposed solution involves transforming regular expression patterns into Glushkov automata and selectively applying either the Spencer or classical matching algorithm based on the presence of extended grammar, minimizing resource usage and preventing ReDoS attacks by optimizing the matching process.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional regular expression engines are used to check patterns against character strings, then pattern matching capability is provided, but temporal and spatial resources are excessively consumed leading to ReDoS attacks
Solution Approach 1:
The patent transforms the regular expression into a Glushkov automaton, fundamentally changing the parameter representation from traditional regex syntax to a finite automaton state graph. This parameter transformation enables efficient pattern matching while preventing ReDoS attacks by limiting the search space to a finite number of states and transitions.
Solution Approach 2:
The patent replaces the traditional mechanical regex matching process with an automaton-based system. Instead of recursively traversing regex patterns (which consumes exponential resources), the system uses deterministic state transitions in a Glushkov automaton, substituting the matching mechanism with a more efficient computational model that inherently bounds resource usage.
2Adaptability or versatility
If extended grammar features are added to regular expressions, then matching capability and flexibility are improved, but complexity of the matching process increases
Solution Approach 1:
The patent segments the extended grammar features into distinct components within the Glushkov automaton structure. Capture groups, forward searches, and other extended features are represented as separate states or transition mechanisms, allowing the system to handle complex patterns by composing simpler automaton components rather than processing a monolithic complex regex.
Data Source
AI summary
Provided are an automata processing method and apparatus capable of transforming a regular expression pattern into a specific type of nondeterministic finite automata (NFA), selectively applying a matching algorithm to the nondeterministic finite automata according to whether to include an extended grammar to minimize the use of temporal and spatial resources, and preventing regular expression denial of service (ReDoS).