HYX

Study 04 / Application security

Hyx research study

A WAF is a state machine.

A compatibility and execution study of OWASP CRS semantics across request, response, scoring, exclusion, and live configuration boundaries.

Research classification

Repository invariants / 92 focused tests / host-local release benchmark

E1 / finding
92
focused tests passed
library + CRS integration + documentation
E2 / finding
2.991µs
clean request
11-rule host benchmark / complete measured path
E3 / finding
11 / 0
rules / drops
strict benchmark compilation inventory
E4 / finding
16
CRS integration tests
clean / attack / reload / detection-only

Abstract

The claim begins with a question, not a headline.

Research question / RQ-04

Can a compatibility-oriented WAF preserve the stateful behavior of OWASP CRS while compiling safe acceleration into the request path?

Hyx treats Core Rule Set compatibility as semantic work, not rule-file ingestion. This study follows a transaction through compilation and phased execution, then defines the conclusions supported by the available measurements.

01

Method

Trace directive compatibility into a compiled program, inspect phase and transaction boundaries, then run the focused library and CRS integration suites plus the repository release benchmark.

02

Finding

Acceleration is constrained by semantics: prefilters must remain sound, unsupported constructs are inventoried, and scoring, exclusions, collections, and response phases stay inside one transaction model.

03

Disclosure boundary

The study describes compatibility surfaces, measured behavior, and safeguards. It does not publish reconstructable rule programs, private exclusions, or production policy composition.

System boundary

Compilation narrows work. The transaction preserves meaning.

S-01 / system topology

parse / compile / execute / attribute

01

Compatibility inventory

Directives, operators, actions, transforms, variables, collections, controls, and macros are classified explicitly instead of being silently accepted.

02

Strict compiler

Rules become an immutable execution artifact. Unsupported or unsafe constructs fail strict compilation; permissive mode records every deliberate drop.

03

Sound prefilters

Indexes may remove impossible candidates, but cannot remove a rule whose full semantics could match. The evaluator remains the authority.

04

Phased transaction

Request headers, request body, response headers, response body, and logging share scoring, captures, exclusions, collections, and final action state.

Controlled measurement

The measured path is narrow and runs at microsecond scale.

M-01 / host-local evidence

release mode / scoped result

MeasurementObservedScope
01Clean request / total2.991µs5 args · 7 headers · 3 cookies
02Evaluator / run1.962µsdominant measured stage
03Transaction construction0.736µsrequest materialization
04Attack request1.315µsSQLi sample · blocked · 1 event
05Scaling / 0 → 40 args1.768 → 11.800µswork grows with inspected input

Release mode on this host. Synthetic production-shaped 11-rule program; not a full CRS benchmark or cross-product comparison.

Findings

The useful optimization is the one that cannot change the answer.

01

Compatibility is observable

Compile statistics and compatibility matrices expose unsupported semantics. An apparently successful load cannot quietly erase policy.

02

Anomaly scoring is state

Matches accumulate across phases and rule families before configured thresholds resolve the disruptive action.

03

Exclusions are part of semantics

Target removal, rule removal, detection-only behavior, and per-transaction controls are evaluated within the same state machine.

04

Reload is an atomic boundary

A completed ruleset replaces the previous snapshot without exposing a partially compiled configuration to concurrent requests.

Correctness and safety

Correctness is defended at ingestion, execution, and replacement.

01

Strict by default

Unknown semantics are rejected where preservation cannot be established.

02

Oracle comparisons

Prefiltered execution is checked against exhaustive candidates so acceleration cannot create false negatives.

03

Detection-only separation

Observation can emit attributable findings without mutating the delivery action.

04

Hot-reload isolation

Existing transactions retain a coherent program while later transactions see the new snapshot.

The defensible claim is not that Hyx universally outperforms every CRS implementation. It is that the repository represents compatibility as a testable contract, constrains its indexes to semantic equivalence, and demonstrates a low-microsecond path for the included 11-rule workload.

Interpretation

The evidence boundary is part of the result.

01

Not the full CRS

The release benchmark compiles 11 rules. It cannot establish latency for the complete current Core Rule Set or a customer-specific policy.

02

No external comparator

No same-host ModSecurity or Coraza run was performed, so this study makes no cross-engine throughput claim.

03

Workload sensitivity

Body size, transform cost, regex shape, collection access, and match position can materially change execution time.

Evidence register

Every public claim keeps its provenance attached.

E1

Focused suites

75 library tests, 16 CRS integration tests, and one documentation test passed with zero failures on this host.

E2

Release breakdown

The repository benchmark measured 2.991µs per clean request and 1.315µs for its blocking SQLi request.

E3

Compile inventory

The benchmark reported 11 compiled rules and zero drops; compiler structures retain explicit compatibility and drop statistics.

E4

Integration boundary

Tests cover clean traffic, SQLi, XSS, response leakage, detection-only mode, prefilter equivalence, and hot reload.

E5

Transaction semantics

The engine carries phase, score, exclusions, captures, collections, events, and disruptive action across one request lifecycle.

Research archive

Return to the systems studies.

Mechanisms, measurements, and the limits required to interpret both.

Open the archive