Regular Expression ReDOS Vulnerability Detection via SAT Solvers
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional approaches to detecting Regular Expression Denial of Service (ReDOS) vulnerabilities in regular expressions are inefficient, as they often require exhaustive validation to find all possible attack strings, which is time-consuming and memory-intensive, and fail to identify a single valid attack string that causes disproportionate resource consumption.
Innovation Solution
The method involves evaluating a regular expression by forming a logical equation based on Boolean satisfiability (SAT) problems, using SMT solvers to identify a single valid attack string that induces ReDOS, rather than constructing the intersection of Non-deterministic Finite Automata (NFAs), thus reducing computational burden and memory requirements.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional exhaustive validation methods are used to detect ReDOS vulnerabilities, then all possible attack strings can be found, but the process becomes time-consuming and memory-intensive
Solution Approach 1:
The patent extracts the core vulnerability detection problem from exhaustive validation by using SAT solvers to find a single satisfying assignment (attack string) that proves vulnerability existence. Instead of extracting and analyzing all possible attack strings, the method extracts just one valid counterexample to establish vulnerability, dramatically reducing detection time while maintaining reliability.
Solution Approach 2:
The patent performs preliminary action by transforming the vulnerability detection problem into a SAT formulation before solving. By pre-processing the regular expression and attack string into logical constraints, the system prepares the problem in a form that allows SAT solvers to efficiently determine vulnerability without requiring exhaustive traversal of all possible strings.
2Reliability
If conventional exhaustive validation methods are used to detect ReDOS vulnerabilities, then all possible attack strings can be found, but memory consumption increases significantly
Solution Approach 1:
The patent extracts only the essential information needed for vulnerability detection by formulating the problem as a SAT instance. Instead of storing and processing all possible attack strings in memory, the method extracts the regular expression structure and attack string patterns into logical constraints, requiring minimal memory while maintaining complete detection capability.
Solution Approach 2:
The patent uses disposable logical formulations that are created, solved, and discarded. The SAT instance is constructed temporarily to prove vulnerability existence, then discarded after solving. This approach replaces persistent storage of large numbers of attack strings with temporary logical structures that consume minimal memory.
3Measurement precision
If exhaustive traversal of potential attack strings is performed, then all vulnerability instances are identified, but the computational complexity increases
Solution Approach 1:
The patent substitutes the mechanical exhaustive traversal system with a logical SAT solving system. Instead of mechanically iterating through and testing each possible attack string, the method translates the traversal problem into logical constraints and uses SAT solver algorithms to determine satisfiability, reducing computational complexity from exponential traversal to polynomial-time logical reasoning.
Solution Approach 2:
The patent changes the parameter of detection from enumerating all attack strings to finding one satisfying assignment. By changing the detection parameter from comprehensive enumeration to existential proof, the system maintains measurement precision (accuracy in identifying vulnerability) while dramatically reducing computational complexity through SAT-based parameter optimization.
Data Source
AI summary
A method for assessing a regular expression for vulnerability to ReDoS attacks includes receiving a regular expression for evaluating a string defined by ordered set of characters from an alphanumeric input device, and evaluating the regular expression for determining if a parsing operation of the string according to the regular expression results in a disproportionate resource consumption. The evaluation determines if the resource consumption constitutes a Regular expression Denial of Service (ReDOS) attack by providing a vulnerability indication of a single valid attack string, rather than attempting to find all possible attack strings. The valid attack string is defined by an input string for which evaluation based on the regular expression would result in disproportionate resource consumption.