Adaptive NFA Backtracking Limits for Regex DDOS Prevention
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional non-deterministic finite automaton (NFA) implementations in regular expression processing are vulnerable to service outages due to unsafe patterns or malicious payloads, leading to potential distributed denial-of-service (DDOS) attacks.
Innovation Solution
Implementing an adaptive backtracking depth limit for NFAs, which includes using a backtrack-depth counter to track the number of times a state has been visited during a match attempt, and dynamically adjusting this limit based on payload size to prevent excessive backtracking and terminate the match attempt when the limit is reached.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional NFA implementations are used for regular expression processing, then pattern matching capability is maintained, but service outages occur due to unsafe patterns or malicious payloads
Solution Approach 1:
The patent applies preliminary anti-action by implementing a backtracking depth limit mechanism that prevents excessive backtracking before it can cause service outages. The system proactively limits the depth of backtracking to a predetermined threshold, thereby preventing DDOS attacks and service outages caused by unsafe patterns or malicious payloads, while maintaining normal pattern matching operations.
2Adaptability or versatility
If backtracking is enabled in NFA implementations, then pattern matching flexibility is improved, but excessive backtracking leads to service outages
Solution Approach 1:
The patent applies dynamics by implementing a configurable backtracking depth limit that can be dynamically adjusted based on system conditions. The limit is not fixed but can be adapted to different operational contexts, allowing the system to maintain pattern matching flexibility while preventing excessive backtracking that would lead to service outages.
3Reliability
If a fixed backtracking depth limit is implemented, then service outages are prevented, but legitimate pattern matches may be incorrectly terminated
Solution Approach 1:
The patent applies parameter changes by making the backtracking depth limit configurable and adaptable rather than fixed. The system can adjust the depth limit parameter based on the specific pattern matching operations being performed, allowing optimization between preventing service outages and maintaining match accuracy for legitimate patterns.
Data Source
AI summary
Systems and methods for adaptive backtracking depth limit for non-deterministic finite automaton implementations are provided. A method includes, as part of a match attempt between a regular expression (regex) pattern and a payload, a non-deterministic finite automaton (NFA) instance executing instructions for an NFA graph having a plurality of nodes linked via arcs indicative of transitions among states of the NFA instance. The method further includes during execution of the instructions for the NFA graph, using a backtrack-depth counter counting a number of times a current state of the NFA graph has been previously visited during the match attempt between the regex pattern and the payload. The method further includes, upon the backtrack-depth counter for the NFA instance reaching or exceeding an adaptive backtracking depth limit for the NFA instance, terminating the match attempt between the regex pattern and the payload.