{"id":"https://openalex.org/W7165402272","doi":"https://doi.org/10.48550/arxiv.2606.19654","title":"PUFFERDOS: Efficient and Effective Attack String Generation for Regular Expression Denial of Service Vulnerabilities","display_name":"PUFFERDOS: Efficient and Effective Attack String Generation for Regular Expression Denial of Service Vulnerabilities","publication_year":2026,"publication_date":"2026-06-17","ids":{"openalex":"https://openalex.org/W7165402272","doi":"https://doi.org/10.48550/arxiv.2606.19654"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2606.19654","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.19654","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2606.19654","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5053837667","display_name":"S Xu","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Xu, Shangzhi","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5112859152","display_name":"Ziqi Ding","orcid":"https://orcid.org/0009-0008-8336-7516"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Ding, Ziqi","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5132676922","display_name":"Xiao Cheng","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Cheng, Xiao","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5138989653","display_name":"Yuekang Li","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Li, Yuekang","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5139004162","display_name":"Nan Sun","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Sun, Nan","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5138775830","display_name":"Benjamin Turnbull","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Turnbull, Benjamin","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5098879465","display_name":"Shuangxiang Kan","orcid":"https://orcid.org/0000-0002-2807-1420"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Kan, Shuangxiang","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5138973554","display_name":"Siqi Ma","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Ma, Siqi","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.4717000126838684,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.4717000126838684,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10743","display_name":"Software Testing and Debugging Techniques","score":0.19769999384880066,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.18709999322891235,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/exploit","display_name":"Exploit","score":0.8661999702453613},{"id":"https://openalex.org/keywords/fuzz-testing","display_name":"Fuzz testing","score":0.7512999773025513},{"id":"https://openalex.org/keywords/denial-of-service-attack","display_name":"Denial-of-service attack","score":0.7390000224113464},{"id":"https://openalex.org/keywords/vulnerability","display_name":"Vulnerability (computing)","score":0.5782999992370605},{"id":"https://openalex.org/keywords/process","display_name":"Process (computing)","score":0.5289000272750854},{"id":"https://openalex.org/keywords/string","display_name":"String (physics)","score":0.5286999940872192},{"id":"https://openalex.org/keywords/regular-expression","display_name":"Regular expression","score":0.48399999737739563},{"id":"https://openalex.org/keywords/attack-patterns","display_name":"Attack patterns","score":0.46889999508857727}],"concepts":[{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.8661999702453613},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8266000151634216},{"id":"https://openalex.org/C111065885","wikidata":"https://www.wikidata.org/wiki/Q1189053","display_name":"Fuzz testing","level":3,"score":0.7512999773025513},{"id":"https://openalex.org/C38822068","wikidata":"https://www.wikidata.org/wiki/Q131406","display_name":"Denial-of-service attack","level":3,"score":0.7390000224113464},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.5788999795913696},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.5782999992370605},{"id":"https://openalex.org/C98045186","wikidata":"https://www.wikidata.org/wiki/Q205663","display_name":"Process (computing)","level":2,"score":0.5289000272750854},{"id":"https://openalex.org/C157486923","wikidata":"https://www.wikidata.org/wiki/Q1376436","display_name":"String (physics)","level":2,"score":0.5286999940872192},{"id":"https://openalex.org/C121329065","wikidata":"https://www.wikidata.org/wiki/Q185612","display_name":"Regular expression","level":2,"score":0.48399999737739563},{"id":"https://openalex.org/C2780741293","wikidata":"https://www.wikidata.org/wiki/Q4818019","display_name":"Attack patterns","level":3,"score":0.46889999508857727},{"id":"https://openalex.org/C2780378061","wikidata":"https://www.wikidata.org/wiki/Q25351891","display_name":"Service (business)","level":2,"score":0.4348999857902527},{"id":"https://openalex.org/C2777212361","wikidata":"https://www.wikidata.org/wiki/Q5127848","display_name":"Class (philosophy)","level":2,"score":0.4336000084877014},{"id":"https://openalex.org/C188198153","wikidata":"https://www.wikidata.org/wiki/Q1613840","display_name":"Limiting","level":2,"score":0.4025000035762787},{"id":"https://openalex.org/C77618280","wikidata":"https://www.wikidata.org/wiki/Q1155772","display_name":"Scheme (mathematics)","level":2,"score":0.37950000166893005},{"id":"https://openalex.org/C120314980","wikidata":"https://www.wikidata.org/wiki/Q180634","display_name":"Distributed computing","level":1,"score":0.34869998693466187},{"id":"https://openalex.org/C28420585","wikidata":"https://www.wikidata.org/wiki/Q2665075","display_name":"Timing attack","level":4,"score":0.33730000257492065},{"id":"https://openalex.org/C119024030","wikidata":"https://www.wikidata.org/wiki/Q759899","display_name":"Call stack","level":3,"score":0.30469998717308044},{"id":"https://openalex.org/C2779639559","wikidata":"https://www.wikidata.org/wiki/Q7661178","display_name":"Symbolic execution","level":3,"score":0.29649999737739563},{"id":"https://openalex.org/C28719098","wikidata":"https://www.wikidata.org/wiki/Q44946","display_name":"Point (geometry)","level":2,"score":0.289000004529953},{"id":"https://openalex.org/C178489894","wikidata":"https://www.wikidata.org/wiki/Q8789","display_name":"Cryptography","level":2,"score":0.27140000462532043},{"id":"https://openalex.org/C80444323","wikidata":"https://www.wikidata.org/wiki/Q2878974","display_name":"Theoretical computer science","level":1,"score":0.2662000060081482},{"id":"https://openalex.org/C93996380","wikidata":"https://www.wikidata.org/wiki/Q44127","display_name":"Server","level":2,"score":0.265500009059906}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2606.19654","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.19654","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2606.19654","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.19654","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"ReDoS":[0,42,62,185],"attacks":[1],"constitute":[2],"a":[3,210],"critical":[4],"class":[5],"of":[6,19,122,184],"resource-exhaustion":[7],"vulnerabilities.":[8],"In":[9],"such":[10],"attacks,":[11,43],"adversaries":[12],"exploit":[13,61],"the":[14,52,65,97,118,123,126,145,178,206,222],"pathological":[15,84],"worst-case":[16],"execution":[17,228],"behavior":[18],"regular":[20],"expression":[21],"(regex)":[22],"engines":[23],"to":[24,59,134,140,163,205,213,229],"induce":[25],"highly":[26],"asymmetric":[27],"computational":[28],"workloads,":[29],"ultimately":[30],"exhausting":[31],"system":[32],"resources":[33],"and":[34,69,87,114,120,156,175,201,217,220],"degrading":[35],"service":[36],"availability.":[37],"To":[38,148],"protect":[39],"systems":[40],"against":[41],"numerous":[44],"detection":[45],"techniques":[46,73],"have":[47],"been":[48],"proposed":[49],"that":[50,81,91,167],"simulate":[51],"attack":[53,57,94,99,124,158,165,215],"process":[54],"by":[55],"generating":[56],"strings":[58,100,132,223],"proactively":[60],"vulnerabilities":[63,186],"at":[64,125,177],"early":[66],"development":[67],"stage":[68],"facilitate":[70],"remediation.":[71],"Existing":[72],"broadly":[74],"fall":[75],"into":[76],"two":[77],"classes:":[78],"static":[79],"analyses":[80],"search":[82],"for":[83,104],"regex":[85],"structures,":[86],"dynamic":[88],"exploration":[89],"methods":[90],"synthesize":[92,164],"candidate":[93],"strings.":[95],"However,":[96],"generated":[98,131],"are":[101,168],"often":[102],"impractical":[103],"real-world":[105,141,188,231],"exploitation":[106,183],"because":[107],"they":[108],"usually":[109],"assume":[110],"unrealistic":[111],"input-length":[112],"budgets":[113,174],"do":[115],"not":[116],"validate":[117],"effectiveness":[119],"efficiency":[121],"program":[127,179],"level.":[128],"Therefore,":[129],"many":[130],"fail":[133],"trigger":[135],"vulnerable":[136,195],"regexes":[137],"when":[138],"applied":[139],"programs,":[142],"further":[143],"limiting":[144],"practical":[146],"utility.":[147],"address":[149],"these":[150],"shortcomings,":[151],"we":[152,191],"introduce":[153],"an":[154],"effective":[155,182],"efficient":[157],"string":[159],"generator,":[160],"PUFFERDOS,":[161],"designed":[162],"inputs":[166],"both":[169],"feasible":[170],"within":[171],"realistic":[172],"length":[173],"validated":[176],"level,":[180],"enabling":[181],"in":[187],"programs.":[189],"Specifically,":[190],"first":[192],"define":[193],"three":[194],"patterns":[196],"based":[197],"on":[198],"our":[199],"observation":[200],"formal":[202],"verification.":[203],"According":[204],"patterns,":[207],"PUFFERDOS":[208],"conducts":[209],"synthesis":[211],"technique":[212],"generate":[214],"strings,":[216],"then":[218],"refines":[219],"validates":[221],"with":[224],"ReDoS-specific":[225],"compositional":[226],"concolic":[227],"guarantee":[230],"exploitability.":[232]},"counts_by_year":[],"updated_date":"2026-07-28T07:46:37.118299","created_date":"2026-06-20T00:00:00"}