%% This BibTeX bibliography file was created using BibDesk.

%% https://bibdesk.sourceforge.io/

%% Created for CS TAN at 2022-05-23 18:43:50 +0100 

%% Saved with string encoding Unicode (UTF-8) 

@article{Murugesan2014,

  author    = {N.~Murugesan and O.~V.~Shanmuga Sundaram},

  title     = {{S}ome {P}roperties of {B}rzozowski {D}erivatives of {R}egular {E}xpressions},

  journal   = {International Journal of Computer Trends and Technology},

  volume    = {13},

  number    = {1},

  year      = {2014},

  url       = {http://arxiv.org/abs/1407.5902},

  pages     = {29--33}

}

@PhdThesis{Ausaf,

  author =       {F.~Ausaf},

  title =        {{V}erified {L}exing and {P}arsing},

  school =       {King's College London},

  year =         {2018}

}

%% POSIX specification------------------------

@InProceedings{Okui10,

author=" S.~Okui

and T.~Suzuki",

editor="Domaratzki, Michael

and Salomaa, Kai",

title="Disambiguation in Regular Expression Matching via Position Automata with Augmented Transitions",

booktitle="Implementation and Application of Automata",

year="2011",

publisher="Springer Berlin Heidelberg",

address="Berlin, Heidelberg",

pages="231--240",

abstract="This paper offers a new efficient regular expression matching algorithm which follows the POSIX-type leftmost-longest rule. The algorithm basically emulates the subset construction without backtracking, so that its computational cost even in the worst case does not explode exponentially; the time complexity of the algorithm is O(mn(n{\thinspace}+{\thinspace}c)), where m is the length of a given input string, n the number of occurrences of the most frequently used letter in a given regular expression and c the number of subexpressions to be used for capturing substrings. A formalization of the leftmost-longest semantics by using parse trees is also discussed.",

isbn="978-3-642-18098-9"

}

%% POSIX specification------------------------

%% Brzozowski ders------------------------

@article{Berglund14,

author = {M.~Berglund, F.~Drewes and B.~Van Der Merwe},

year = {2014},

month = {05},

pages = {},

title = {Analyzing Catastrophic Backtracking Behavior in Practical Regular Expression Matching},

volume = {151},

journal = {Electronic Proceedings in Theoretical Computer Science},

doi = {10.4204/EPTCS.151.7}

}

@InProceedings{Berglund18,

author="M.~Berglund

and Bester, Willem

and van der Merwe, Brink",

editor="Fischer, Bernd

and Uustalu, Tarmo",

title="Formalising Boost POSIX Regular Expression Matching",

booktitle="Theoretical Aspects of Computing -- ICTAC 2018",

year="2018",

publisher="Springer International Publishing",

address="Cham",

pages="99--115",

abstract="Whereas Perl-compatible regular expression matchers typically exhibit some variation of leftmost-greedy semantics, those conforming to the posix standard are prescribed leftmost-longest semantics. However, the posix standard leaves some room for interpretation, and Fowler and Kuklewicz have done experimental work to confirm differences between various posix matchers. The Boost library has an interesting take on the posix standard, where it maximises the leftmost match not with respect to subexpressions of the regular expression pattern, but rather, with respect to capturing groups. In our work, we provide the first formalisation of Boost semantics, and we analyse the complexity of regular expression matching when using Boost semantics.",

isbn="978-3-030-02508-3"

}

@inproceedings{Chen12,

author = {Chen, Haiming and Yu, Sheng},

year = {2012},

month = {01},

pages = {343-356},

title = {Derivatives of Regular Expressions and an Application},

volume = {7160},

doi = {10.1007/978-3-642-27654-5_27}

}

%% Brzozowski ders------------------------

%@article{Murugesan2014,

%  author    = {N.~Murugesan and O.~V.~Shanmuga Sundaram},

%  title     = {{S}ome {P}roperties of {B}rzozowski {D}erivatives of {R}egular {E}xpressions},

%  journal   = {International Journal of Computer Trends and Technology},

%  volume    = {13},

%  number    = {1},

%  year      = {2014},

%  url       = {http://arxiv.org/abs/1407.5902},

%  pages     = {29--33}

%}

%% look-aheads------------------------

@article{Takayuki2019,

  title={Derivatives of Regular Expressions with Lookahead},

  author={Takayuki Miyazaki and Yasuhiko Minamide},

  journal={Journal of Information Processing},

  volume={27},

  number={ },

  pages={422-430},

  year={2019},

  doi={10.2197/ipsjjip.27.422}

}

%% look-aheads------------------------

%% back-references--------------------

}

%% back-references--------------------

@article{fowler2003,

  title={An interpretation of the POSIX regex standard},

  author={Fowler, Glenn},

  journal={URL: https://web. archive. org/web/20050408073627/http://www. research. att. com/\~{} gsf/testregex/re-interpretation. html},

  year={2003}

}

@inproceedings{Snort1999,

author = {Roesch, Martin},

title = {Snort - Lightweight Intrusion Detection for Networks},

year = {1999},

publisher = {USENIX Association},

address = {USA},

abstract = {Network intrusion detection systems (NIDS) are an important part of any network security architecture. They provide a layer of defense which monitors network traffic for predefined suspicious activity or patterns, and alert system administrators when potential hostile traffic is detected. Commercial NIDS have many differences, but Information Systems departments must face the commonalities that they share such as significant system footprint, complex deployment and high monetary cost. Snort was designed to address these issues.},

booktitle = {Proceedings of the 13th USENIX Conference on System Administration},

pages = {229–238},

numpages = {10},

location = {Seattle, Washington},

series = {LISA '99}

}

@inproceedings{Becchi08,

author = {Becchi, Michela and Crowley, Patrick},

year = {2008},

month = {01},

pages = {25},

title = {Extending finite automata to efficiently match Perl-compatible regular expressions},

doi = {10.1145/1544012.1544037}

}

@book{

	Sakarovitch2009, 

	place={Cambridge}, 

	title={Elements of Automata Theory}, 

	DOI={10.1017/CBO9781139195218}, 

	publisher={Cambridge University Press}, 

	author={Sakarovitch, Jacques}, 

	editor={Thomas, ReubenTranslator}, 

	year={2009}

}

@unpublished{CSL2022,

author = "Chengsong Tan and Christian Urban",

title = "POSIX Lexing with Bitcoded Derivatives",

note = "submitted",

}

@INPROCEEDINGS{Verbatim,  author={Egolf, Derek and Lasser, Sam and Fisher, Kathleen},  booktitle={2021 IEEE Security and Privacy Workshops (SPW)},   title={Verbatim: A Verified Lexer Generator},   year={2021},  volume={},  number={},  pages={92-100},  doi={10.1109/SPW53761.2021.00022}}

@inproceedings{Verbatimpp,

author = {Egolf, Derek and Lasser, Sam and Fisher, Kathleen},

title = {Verbatim++: Verified, Optimized, and Semantically Rich Lexing with Derivatives},

year = {2022},

isbn = {9781450391825},

publisher = {Association for Computing Machinery},

address = {New York, NY, USA},

url = {https://doi.org/10.1145/3497775.3503694},

doi = {10.1145/3497775.3503694},

abstract = {Lexers and parsers are attractive targets for attackers because they often sit at the boundary between a software system's internals and the outside world. Formally verified lexers can reduce the attack surface of these systems, thus making them more secure. One recent step in this direction is the development of Verbatim, a verified lexer based on the concept of Brzozowski derivatives. Two limitations restrict the tool's usefulness. First, its running time is quadratic in the length of its input string. Second, the lexer produces tokens with a simple "tag and string" representation, which limits the tool's ability to integrate with parsers that operate on more expressive token representations. In this work, we present a suite of extensions to Verbatim that overcomes these limitations while preserving the tool's original correctness guarantees. The lexer achieves effectively linear performance on a JSON benchmark through a combination of optimizations that, to our knowledge, has not been previously verified. The enhanced version of Verbatim also enables users to augment their lexical specifications with custom semantic actions, and it uses these actions to produce semantically rich tokens---i.e., tokens that carry values with arbitrary, user-defined types. All extensions were implemented and verified with the Coq Proof Assistant.},

booktitle = {Proceedings of the 11th ACM SIGPLAN International Conference on Certified Programs and Proofs},

pages = {27–39},

numpages = {13},

keywords = {Brzozowski derivatives, formal verification, lexical analysis, semantic actions},

location = {Philadelphia, PA, USA},

series = {CPP 2022}

}

@article{Turo_ov__2020,

	author = {Lenka Turo{\v{n}}ov{\'{a}} and Luk{\'{a}}{\v{s}} Hol{\'{\i}}k and Ond{\v{r}}ej Leng{\'{a}}l and Olli Saarikivi and Margus Veanes and Tom{\'{a}}{\v{s}} Vojnar},

	date-added = {2022-05-23 18:43:04 +0100},

	date-modified = {2022-05-23 18:43:04 +0100},

	doi = {10.1145/3428286},

	journal = {Proceedings of the {ACM} on Programming Languages},

	month = {nov},

	number = {{OOPSLA}},

	pages = {1--30},

	publisher = {Association for Computing Machinery ({ACM})},

	title = {Regex matching with counting-set automata},

	url = {https://doi.org/10.1145%2F3428286},

	volume = {4},

	year = 2020,

	bdsk-url-1 = {https://doi.org/10.1145%2F3428286},

	bdsk-url-2 = {https://doi.org/10.1145/3428286}}

@article{Rathnayake2014StaticAF,

	author = {Asiri Rathnayake and Hayo Thielecke},

	journal = {ArXiv},

	title = {Static Analysis for Regular Expression Exponential Runtime via Substructural Logics},

	volume = {abs/1405.7058},

	year = {2014}}

@inproceedings{Weideman2017Static,

	author = {Nicolaas Weideman},

	title = {Static analysis of regular expressions},

	year = {2017}}

@inproceedings{RibeiroAgda2017,

	abstract = {We describe the formalization of a regular expression (RE) parsing algorithm that produces a bit representation of its parse tree in the dependently typed language Agda. The algorithm computes bit-codes using Brzozowski derivatives and we prove that produced codes are equivalent to parse trees ensuring soundness and completeness w.r.t an inductive RE semantics. We include the certified algorithm in a tool developed by us, named verigrep, for regular expression based search in the style of the well known GNU grep. Practical experiments conducted with this tool are reported.},

	address = {New York, NY, USA},

	articleno = {4},

	author = {Ribeiro, Rodrigo and Bois, Andr\'{e} Du},

	booktitle = {Proceedings of the 21st Brazilian Symposium on Programming Languages},

	date-modified = {2022-03-16 16:38:47 +0000},

	doi = {10.1145/3125374.3125381},

	isbn = {9781450353892},

	keywords = {Certified algorithms, regular expressions, dependent types, bit-codes},

	location = {Fortaleza, CE, Brazil},

	numpages = {8},

	publisher = {Association for Computing Machinery},

	series = {SBLP 2017},

	title = {Certified Bit-Coded Regular Expression Parsing},

	url = {https://doi.org/10.1145/3125374.3125381},

	year = {2017},

	bdsk-url-1 = {https://doi.org/10.1145/3125374.3125381}}

@article{Thompson_1968,

	author = {Ken Thompson},

	date-added = {2022-02-23 13:44:42 +0000},

	date-modified = {2022-02-23 13:44:42 +0000},

	doi = {10.1145/363347.363387},

	journal = {Communications of the {ACM}},

	month = {jun},

	number = {6},

	pages = {419--422},

	publisher = {Association for Computing Machinery ({ACM})},

	title = {Programming Techniques: Regular expression search algorithm},

	url = {https://doi.org/10.1145%2F363347.363387},

	volume = {11},

	year = 1968,

	bdsk-url-1 = {https://doi.org/10.1145%2F363347.363387},

	bdsk-url-2 = {https://doi.org/10.1145/363347.363387}}

@article{17Bir,

	author = {Asiri Rathnayake and Hayo Thielecke},

	date-added = {2019-08-18 17:57:30 +0000},

	date-modified = {2019-08-18 18:00:13 +0000},

	journal = {arXiv:1405.7058},

	title = {Static Analysis for Regular Expression Exponential Runtime via Substructural Logics},

	year = {2017}}

@article{alfred2014algorithms,

	author = {Alfred, V},

	journal = {Algorithms and Complexity},

	pages = {255},

	publisher = {Elsevier},

	title = {Algorithms for finding patterns in strings},

	volume = {1},

	year = {2014}}

@article{nielson11bcre,

	author = {Lasse Nielsen, Fritz Henglein},

	date-added = {2019-07-03 21:09:39 +0000},

	date-modified = {2019-07-03 21:17:33 +0000},

	journal = {LATA},

	title = {Bit-coded Regular Expression Parsing},

	year = {2011},

	bdsk-file-1 = {YnBsaXN0MDDSAQIDBFxyZWxhdGl2ZVBhdGhZYWxpYXNEYXRhXxA1Li4vLi4vLi4vTXkgTWFjIChNYWNCb29rLVBybykvRGVza3RvcC9mcml0ei1wYXBlci5wZGZPEQF+AAAAAAF+AAIAAAxNYWNpbnRvc2ggSEQAAAAAAAAAAAAAAAAAAAAAAAAAQkQAAf////8PZnJpdHotcGFwZXIucGRmAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/////wAAAAAAAAAAAAAAAAADAAMAAAogY3UAAAAAAAAAAAAAAAAAB0Rlc2t0b3AAAAIAQi86VXNlcnM6Y3N0YW46RHJvcGJveDpNeSBNYWMgKE1hY0Jvb2stUHJvKTpEZXNrdG9wOmZyaXR6LXBhcGVyLnBkZgAOACAADwBmAHIAaQB0AHoALQBwAGEAcABlAHIALgBwAGQAZgAPABoADABNAGEAYwBpAG4AdABvAHMAaAAgAEgARAASAEBVc2Vycy9jc3Rhbi9Ecm9wYm94L015IE1hYyAoTWFjQm9vay1Qcm8pL0Rlc2t0b3AvZnJpdHotcGFwZXIucGRmABMAAS8AABUAAgAM//8AAAAIAA0AGgAkAFwAAAAAAAACAQAAAAAAAAAFAAAAAAAAAAAAAAAAAAAB3g==}}

@software{regexploit2021,

	author = {Ben Caller, Luca Carettoni},

	date-added = {2020-11-24 00:00:00 +0000},

	date-modified = {2021-05-07 00:00:00 +0000},

	keywords = {ReDos static analyser},

	month = {May},

	title = {regexploit},

	url = {https://github.com/doyensec/regexploit},

	year = {2021},

	bdsk-url-1 = {https://github.com/doyensec/regexploit}}

@software{pcre,

	author = {Philip Hazel},

	date-added = {1997-01-01 00:00:00 +0000},

	date-modified = {2021-06-14 00:00:00 +0000},

	keywords = {Perl Compatible Regular Expressions},

	month = {June},

	title = {PCRE},

	url = {https://www.pcre.org/original/doc/html/},

	year = {2021},

	bdsk-url-1 = {https://www.pcre.org/original/doc/html/}

}

@misc{KuklewiczHaskell,

	author = {Kuklewicz},

	keywords = {Buggy C POSIX Lexing Libraries},

	title = {Regex Posix},

	url = {https://wiki.haskell.org/Regex_Posix},

	year = {2017},

	bdsk-url-1 = {https://wiki.haskell.org/Regex_Posix}}

@misc{regex101,

	author = {Firas Dib},

	keywords = {regex tester debugger},

	title = {regex101},

	url = {https://regex101.com/},

	year = {2011},

	bdsk-url-1 = {https://regex101.com/}}

@misc{atomEditor,

	author = {Dunno},

	keywords = {text editor},

	title = {Atom Editor},

	url = {https://atom.io},

	year = {2022},

	bdsk-url-1 = {https://atom.io}}

@techreport{grathwohl2014crash,

	author = {Grathwohl, Niels Bj{\o}rn Bugge and Henglein, Fritz and Rasmussen, Ulrik Terp},

	institution = {Technical report, University of Copenhagen},

	title = {A Crash-Course in Regular Expression Parsing and Regular Expressions as Types},

	year = {2014}}

@inproceedings{xml2015,

author = {Bj\"{o}rklund, Henrik and Martens, Wim and Timm, Thomas},

title = {Efficient Incremental Evaluation of Succinct Regular Expressions},

year = {2015},

isbn = {9781450337946},

publisher = {Association for Computing Machinery},

address = {New York, NY, USA},

url = {https://doi.org/10.1145/2806416.2806434},

doi = {10.1145/2806416.2806434},

abstract = {Regular expressions are omnipresent in database applications. They form the structural core of schema languages for XML, they are a fundamental ingredient for navigational queries in graph databases, and are being considered in languages for upcoming technologies such as schema- and transformation languages for tabular data on the Web. In this paper we study the usage and effectiveness of the counting operator (or: limited repetition) in regular expressions. The counting operator is a popular extension which is part of the POSIX standard and therefore also present in regular expressions in grep, Java, Python, Perl, and Ruby. In a database context, expressions with counting appear in XML Schema and languages for querying graphs such as SPARQL 1.1 and Cypher.We first present a practical study that suggests that counters are extensively used in practice. We then investigate evaluation methods for such expressions and develop a new algorithm for efficient incremental evaluation. Finally, we conduct an extensive benchmark study that shows that exploiting counting operators can lead to speed-ups of several orders of magnitude in a wide range of settings: normal and incremental evaluation on synthetic and real expressions.},

booktitle = {Proceedings of the 24th ACM International on Conference on Information and Knowledge Management},

pages = {1541–1550},

numpages = {10},

keywords = {regular expressions, schema, regular path queries, xml},

location = {Melbourne, Australia},

series = {CIKM '15}

}

@misc{SE16,

	author = {StackStatus},

	date-added = {2019-06-26 11:28:41 +0000},

	date-modified = {2019-06-26 16:07:31 +0000},

	keywords = {ReDos Attack},

	month = {July},

	rating = {5},

	read = {1},

	title = {Stack Overflow Outage Postmortem},

	url = {https://stackstatus.net/post/147710624694/outage-postmortem-july-20-2016},

	year = {2016},

	bdsk-url-1 = {https://stackstatus.net/post/147710624694/outage-postmortem-july-20-2016}}

@article{HosoyaVouillonPierce2005,

	author = {H.~Hosoya and J.~Vouillon and B.~C.~Pierce},

	journal = {ACM Transactions on Programming Languages and Systems (TOPLAS)},

	number = 1,

	pages = {46--90},

	title = {{R}egular {E}xpression {T}ypes for {XML}},

	volume = 27,

	year = {2005}}