Přístupnostní navigace
E-application
Search Search Close
Master's Thesis
Author of thesis: Ing. Jan Vašák
Acad. year: 2025/2026
Supervisor: doc. Ing. Ondřej Lengál, Ph.D.
Reviewer: Ing. Michal Hečko
Matching regular expressions with back-references (regexes) is a common task in computer programs. To match these regexes, current state-of-the-art regex matchers use backtracking algorithms with exponential worst-case complexity, or do not support them at all. The exponential worst-case time complexity makes the backtracking matchers using backtracking vulnerable to the so-called regular expression denial of service attack (ReDoS), where an attacker submits a malicious text to a regex matcher running on a server, triggering a large slowdown and causing the server to become unresponsive. We present a robust regex matcher capable of matching a class of regexes with back-references in linear time (for a fixed number of capture groups). Our matcher is based on recently introduced model of register set automata, which are capable of representing the above-mentioned class of regexes with back-references deterministically. We tested the performance of our matcher under simulated ReDoS attacks on regexes from real-world projects and compared it against state-of-the-art tools. The experiments show that our matcher is immune to all tested ReDoS attacks; in contrast with the state-of-the-art matchers, which on these attacks suffer from extreme slowdowns.
regex matching, back-references, ReDoS, data words, register set automata
Date of defence
22.06.2026
Result of the defence
Defended (thesis was successfully defended)
Grading
A
Process of defence
Student nejprve prezentoval výsledky, kterých dosáhl v rámci své práce. Komise se poté seznámila s hodnocením vedoucího a posudkem oponenta práce. Student následně odpověděl na otázky oponenta a na další otázky přítomných. Komise se na základě posudku oponenta, hodnocení vedoucího, přednesené prezentace a odpovědí studenta na položené otázky rozhodla práci hodnotit stupněm A.
Topics for thesis defence
Language of thesis
English
Faculty
Fakulta informačních technologií
Department
Department of Intelligent Systems
Study programme
Information Technology and Artificial Intelligence (MITAI)
Specialization
Mathematical Methods (NMAT)
Composition of Committee
doc. Mgr. Adam Rogalewicz, Ph.D. (předseda) doc. RNDr. Milan Češka, Ph.D. (místopředseda) Ing. Martin Hrubý, Ph.D. (člen) Ing. Aleš Smrčka, Ph.D. (člen) Dr. Ing. Petr Peringer (člen) Ing. Jaroslav Rozman, Ph.D. (člen)
Supervisor’s reportdoc. Ing. Ondřej Lengál, Ph.D.
Diplomová práce Jana Vašáka výrazně posunula projekt efektivního matchingu regexů s backreferencemi, a to do úrovně článku publikovaného na konferenci PLDI'26, což je nejúspěšnější akademické zakončení diplomové práce, co jsem zatím na fakultě viděl. Student nad rámec článku ještě výrazně (o několik řádů) zrychlil prototyp regex matcheru. Celkově hodnotím diplomovou práci Jana Vašáka známkou A a vřele ji navrhuji na vyšší ocenění, včetně soutěže IT Spy.
Jde o náročnější zadání navazující na projekt efektivního regex matchingu s backreferencemi běžící již několik let. Smyslem bylo navázání na předchozí práce zavádějící a rozšiřující formální model register set automatů a dotažení tohoto modelu do podoby efektivního regex matcheru. To se povedlo na úrovni publikace vědeckého článku na PLDI'26, což je flagship ACM konference (CORE A*) v oblasti programovacích jazyků. S výsledkem jsem velmi spokojen a očekávám jeho rozšíření v rámci disertační práce.
Práce byla odevzdána s domluveným týdenním odkladem (vynuceným prací studenta na artefaktu ke zmíněnému PLDI článku), finální obsah byl dostatečně konzultován.
Jak již bylo zmíněno, článek částečně založený na této diplomové práci byl publikován na konferenci PLDI'26. O práci dále projevila zájem firma Oracle (v rámci integrace do systému TRegEx) a výzkumnici z EPFL (v rámci integrace do jejich JavaScript regex matcheru). Výsledný regex matcher je zveřejněn pod otevřenou licencí.
Student dostal zadánu studijní literaturu, další vhodnou literaturu si dokázal najít sám.
Student byl během řešení aktivní, chodil na pravidelné konzultace, na které byl připraven, dodržoval termíny.
Grade proposed by supervisor: A
Reviewer’s reportIng. Michal Hečko
The thesis successfully presents a highly technical and challenging topic in a clear and logically coherent way. The accompanying implementation is a result of tremendous engineering effort, yielding a matcher that outperforms the state of the art on matching regular expressions with backreferences. The implementation, and, thus, the core ideas presented in the thesis, is a part of a paper published at PLDI'26 (CORE A*) that the student co-authored.
Based on the above, I would like to nominate the student for any award for which this thesis is eligible.
Evaluation level: assignment fulfilled, and the work contains significant extensions
The student fulfilled all points of the assignment. The thesis provides a comprehensive overview of published data language models, including their strengths and weaknesses with respect to the task of matching regular expressions with backreferences. The primary objective is to identify a model that can serve as the foundation of a matcher resistant to so-called ReDoS attacks. Register automata (RA) and register set automata (RSA) are identified as suitable formalisms for this purpose.
The thesis proposes several optimizations that improve the practical performance of these models when used for matching regular expressions. The core procedure required to obtain a high-performance matcher is the determinization of a nondeterministic RA into a deterministic RSA. The thesis introduces several optimizations that improve the practical efficiency of this algorithm.
Finally, the thesis proposes a high-performance RSA-based matcher in the form of a virtual machine. Its design decisions are thoroughly documented, and the matcher is fully implemented. The VM implementation is a significant engineering achievement in its own right, as it employs multiple advanced techniques (e.g., MTBDDs) to achieve high performance.
Evaluation level: is within the usual extent
The main body of the thesis consists of 46 pages of technical writing of exceptionally high quality.
The thesis is carefully structured and follows a logical progression that makes an otherwise highly technical topic accessible to the reader. The writing is of a very high standard, with no apparent spelling or grammatical errors.
Both the typographical and linguistic aspects of the thesis are at the level of a high-quality scientific publication.
The student has surveyed a large body of literature, ranging from various models for recognizing data languages to related formalisms such as multi-terminal binary decision diagrams (MTBDDs). Citations are used correctly throughout the thesis, placing the work within its broader scientific context.
The practical output of the thesis consists of two parts: improvements to the construction of deterministic RSAs from regular expressions and a matcher based on deterministic RSAs.
In the first part, the author builds upon (his) previous work by proposing several heuristics for constructing nondeterministic RAs from regular expressions and subsequently determinizing them into RSAs. These optimizations significantly improve the practicality of the RSA-based approach to regular-expression matching by enabling the construction of smaller automata in less time.
The second part presents a cleverly designed RSA matcher in the form of an optimized virtual machine (VM). Although the design is inspired by existing technologies for NFA simulation, adapting these ideas to RSAs required several elegant solutions to problems related to instruction-set design, program layout, code generation, and other implementation aspects. Large alphabets (Unicode) are handled using prefix trees that classify UTF-8 encodings of symbols into minterm character sets associated with a given state. Furthermore, MTBDDs are used to minimize the number of register tests. Both features highlight the tremendous amount of engineering effort invested in the implementation.
The thesis also presents a detailed experimental evaluation of the implementation, demonstrating that the proposed approach outperforms state-of-the-art matchers on regular expressions with backreferences that can be used in so-called ReDoS attacks.
The implementation is also part of a publication co-authored by the student that has been accepted to PLDI 2026 (CORE A*). Consequently, part of the experimental evaluation presented in the thesis has been independently reproduced by multiple reviewers, and the artifact received the highest possible rating (Available, Functional, Reusable).
The implementation resulting from this thesis was publised at PLDI'26 (CORE A*) as a part of a paper co-authored by the student, which clearly speaks about the scientific relevance of the work.
Evaluation level: very difficult assignment
The assignment is very challenging. Numerous models for recognizing different classes of data languages have been introduced in the literature. The assignment requires determining a suitable model for representing regular expressions with backreferences; thus, the student must familiarize themselves with the available models at a deeper level in order to assess their suitability for this task.
Based on an agreement with the supervisor, the student is required to work on one of the following two tasks. First, the student may advance our theoretical understanding of a particular model by proving various properties, such as investigating the decidability and complexity of different decision problems associated with the model. Such a task is extremely demanding, as discovering a proof often requires a combination of mathematical experience, creativity, and luck, with no guarantee of success. Alternatively, the student may focus on developing efficient algorithms for various problems related to the model. Finding sound and complete algorithms is itself a difficult task that becomes easier only with experience. Moreover, designing efficient algorithms requires an in-depth understanding of the subtleties of a particular model as well as strong engineering foresight.
Grade proposed by reviewer: A
Responsibility: Mgr. et Mgr. Hana Odstrčilová