Abstract
The claim begins with a question, not a headline.
Research question / RQ-04
Can a compatibility-oriented WAF preserve the stateful behavior of OWASP CRS while compiling safe acceleration into the request path?
Hyx treats Core Rule Set compatibility as semantic work, not rule-file ingestion. This study follows a transaction through compilation and phased execution, then defines the conclusions supported by the available measurements.
Method
Trace directive compatibility into a compiled program, inspect phase and transaction boundaries, then run the focused library and CRS integration suites plus the repository release benchmark.
Finding
Acceleration is constrained by semantics: prefilters must remain sound, unsupported constructs are inventoried, and scoring, exclusions, collections, and response phases stay inside one transaction model.
Disclosure boundary
The study describes compatibility surfaces, measured behavior, and safeguards. It does not publish reconstructable rule programs, private exclusions, or production policy composition.
System boundary
Compilation narrows work. The transaction preserves meaning.
S-01 / system topology
parse / compile / execute / attribute
Compatibility inventory
Directives, operators, actions, transforms, variables, collections, controls, and macros are classified explicitly instead of being silently accepted.
Strict compiler
Rules become an immutable execution artifact. Unsupported or unsafe constructs fail strict compilation; permissive mode records every deliberate drop.
Sound prefilters
Indexes may remove impossible candidates, but cannot remove a rule whose full semantics could match. The evaluator remains the authority.
Phased transaction
Request headers, request body, response headers, response body, and logging share scoring, captures, exclusions, collections, and final action state.
Controlled measurement
The measured path is narrow and runs at microsecond scale.
M-01 / host-local evidence
release mode / scoped result
| Measurement | Observed | Scope |
|---|---|---|
| 01Clean request / total | 2.991µs | 5 args · 7 headers · 3 cookies |
| 02Evaluator / run | 1.962µs | dominant measured stage |
| 03Transaction construction | 0.736µs | request materialization |
| 04Attack request | 1.315µs | SQLi sample · blocked · 1 event |
| 05Scaling / 0 → 40 args | 1.768 → 11.800µs | work grows with inspected input |
Release mode on this host. Synthetic production-shaped 11-rule program; not a full CRS benchmark or cross-product comparison.
Findings
The useful optimization is the one that cannot change the answer.
Compatibility is observable
Compile statistics and compatibility matrices expose unsupported semantics. An apparently successful load cannot quietly erase policy.
Anomaly scoring is state
Matches accumulate across phases and rule families before configured thresholds resolve the disruptive action.
Exclusions are part of semantics
Target removal, rule removal, detection-only behavior, and per-transaction controls are evaluated within the same state machine.
Reload is an atomic boundary
A completed ruleset replaces the previous snapshot without exposing a partially compiled configuration to concurrent requests.
Correctness and safety
Correctness is defended at ingestion, execution, and replacement.
Strict by default
Unknown semantics are rejected where preservation cannot be established.
Oracle comparisons
Prefiltered execution is checked against exhaustive candidates so acceleration cannot create false negatives.
Detection-only separation
Observation can emit attributable findings without mutating the delivery action.
Hot-reload isolation
Existing transactions retain a coherent program while later transactions see the new snapshot.
The defensible claim is not that Hyx universally outperforms every CRS implementation. It is that the repository represents compatibility as a testable contract, constrains its indexes to semantic equivalence, and demonstrates a low-microsecond path for the included 11-rule workload.
Interpretation
The evidence boundary is part of the result.
Not the full CRS
The release benchmark compiles 11 rules. It cannot establish latency for the complete current Core Rule Set or a customer-specific policy.
No external comparator
No same-host ModSecurity or Coraza run was performed, so this study makes no cross-engine throughput claim.
Workload sensitivity
Body size, transform cost, regex shape, collection access, and match position can materially change execution time.
Evidence register
Every public claim keeps its provenance attached.
Focused suites
75 library tests, 16 CRS integration tests, and one documentation test passed with zero failures on this host.
Release breakdown
The repository benchmark measured 2.991µs per clean request and 1.315µs for its blocking SQLi request.
Compile inventory
The benchmark reported 11 compiled rules and zero drops; compiler structures retain explicit compatibility and drop statistics.
Integration boundary
Tests cover clean traffic, SQLi, XSS, response leakage, detection-only mode, prefilter equivalence, and hot reload.
Transaction semantics
The engine carries phase, score, exclusions, captures, collections, events, and disruptive action across one request lifecycle.
References / Harvard style
OWASP Core Rule Set
OWASP Foundation (n.d.) OWASP ModSecurity Core Rule Set. Available at: owasp.org (Accessed: 11 July 2026).
Open source ↗Reference / 02HTTP semantics
Fielding, R., Nottingham, M. and Reschke, J. (2022) HTTP Semantics. RFC 9110. Internet Engineering Task Force.
Open source ↗Research archive
Return to the systems studies.
Mechanisms, measurements, and the limits required to interpret both.