{"id":325634,"date":"2021-08-16T17:16:21","date_gmt":"2021-08-16T14:16:21","guid":{"rendered":"https:\/\/en.buradabiliyorum.com\/high-performance-detection-tool-for-redos-vulnerability\/"},"modified":"2021-08-16T17:16:21","modified_gmt":"2021-08-16T14:16:21","slug":"high-performance-detection-tool-for-redos-vulnerability","status":"publish","type":"post","link":"https:\/\/buradabiliyorum.com\/en\/high-performance-detection-tool-for-redos-vulnerability\/","title":{"rendered":"#High-performance detection tool for ReDoS-vulnerability"},"content":{"rendered":"

“#High-performance detection tool for ReDoS-vulnerability<\/strong>”<\/p>\n

\n
\n
\n
\"computing\"
\n Credit: Pixabay\/CC0 Public Domain
\n <\/figcaption><\/figure>\n<\/div>\n<\/div>\n

Regular expressions (regexes) are widely used in different fields of computer science<\/a>. However, the Regular expression Denial of Service (ReDoS) vulnerability forms a class of common and serious algorithmic complexity attacks.<\/p>\n

The existing ReDoS-vulnerability detection tools have defects of low precision or low recall rate due to the lacking of formal and comprehensive detection conditions of ReDoS-vulnerabilities. <\/p>\n

A research team led by Prof. Chen Haiming from the Institute of Software of the Chinese Academy of Sciences developed high-performance detection tool for ReDoS-vulnerability. <\/p>\n

Their study was issued at USENIX Security Symposium 2021. <\/p>\n

Through examining massive ReDoS-vulnerable regexes, Chen’s team proposed the ReDoS-vulnerability detection conditions, namely the ReDoS-vulnerability patterns, and gave the necessary conditions for triggering these patterns formally. <\/p>\n

Based on this, they developed a static and dynamic combined ReDoS-vulnerability detection algorithm, and designed ReDoSHunter, the ReDoS-vulnerability detection tool. <\/p>\n

ReDoSHunter can pinpoint multiple root causes in a vulnerable regex, prescribe the degree of the vulnerability and generate attack-triggering strings, etc. It has achieved 100% precision and recall ratio on datasets of Corpus, RegExLib and Snort with 37,651 regexes. <\/p>\n

In detecting the publicly-confirmed practical vulnerabilities in Common Vulnerabilities and Exposure (CVE), ReDoSHunter can detect 100% ReDoS-related CVEs. <\/p>\n

In their previous study, Chen’s team proposed a programming-by-example framework, FlashRegex, for generating anti-ReDoS regexes by either synthesizing or repairing from given examples. It is the first framework that integrates regex synthesis and repair with the awareness of ReDoS-vulnerabilities. <\/p>\n

FlashRegex can efficiently generate or repair regexes without ReDoS-vulnerabilities, and there’re 0 ReDoS-vulnerabilities in repaired regexes. <\/p>\n

The study, titled “FlashRegex: deducing anti-ReDoS regexes from examples,” was issued at ASE 2020.\n <\/p>\n\n

\n

Microsoft warns of PrintNightmare vulnerability due to flaw in Windows Print Spooler\n <\/p><\/div>\n

\n
\n More information:<\/strong>
\n Yeting Li et al, FlashRegex, Proceedings of the 35th IEEE\/ACM International Conference on Automated Software Engineering<\/i> (2021). DOI: 10.1145\/3324884.3416556<\/a><\/p><\/div>\n
\n Provided by
\n Chinese Academy of Sciences
\n
\n <\/svg><\/a><\/p><\/div>\n

<\/p>\n

\n

Citation<\/strong>:
\n High-performance detection tool for ReDoS-vulnerability (2021, August 16)
\n retrieved 16 August 2021
\n from https:\/\/techxplore.com\/news<\/a>\/2021-08-high-performance-tool-redos-vulnerability.html<\/p>\n

This document is subject to copyright. Apart from any fair dealing for the purpose of private study or research, no
\n part may be reproduced without the written permission. The content is provided for information purposes only.<\/p><\/div>\n<\/p><\/div>\n