diff --git a/java/ql/lib/semmle/code/java/security/regexp/ExponentialBackTracking.qll b/java/ql/lib/semmle/code/java/security/regexp/ExponentialBackTracking.qll
index d0a08dc88bfa..0a948ff6d982 100644
--- a/java/ql/lib/semmle/code/java/security/regexp/ExponentialBackTracking.qll
+++ b/java/ql/lib/semmle/code/java/security/regexp/ExponentialBackTracking.qll
@@ -3,7 +3,7 @@
  *
  *   James Kirrage, Asiri Rathnayake, Hayo Thielecke: Static Analysis for
  *     Regular Expression Denial-of-Service Attacks. NSS 2013.
- *     (http://www.cs.bham.ac.uk/~hxt/research/reg-exp-sec.pdf)
+ *     (https://arxiv.org/abs/1301.0849)
  *   Asiri Rathnayake, Hayo Thielecke: Static Analysis for Regular Expression
  *     Exponential Runtime via Substructural Logics. 2014.
  *     (https://www.cs.bham.ac.uk/~hxt/research/redos_full.pdf)
diff --git a/java/ql/src/Security/CWE/CWE-730/ReDoSReferences.inc.qhelp b/java/ql/src/Security/CWE/CWE-730/ReDoSReferences.inc.qhelp
index 2b3e5f17c62d..7aec3aa0bf08 100644
--- a/java/ql/src/Security/CWE/CWE-730/ReDoSReferences.inc.qhelp
+++ b/java/ql/src/Security/CWE/CWE-730/ReDoSReferences.inc.qhelp
@@ -10,7 +10,7 @@
 		<li>Wikipedia: <a href="https://en.wikipedia.org/wiki/ReDoS">ReDoS</a>.</li>
 		<li>Wikipedia: <a href="https://en.wikipedia.org/wiki/Time_complexity">Time complexity</a>.</li>
 		<li>James Kirrage, Asiri Rathnayake, Hayo Thielecke:
-		<a href="http://www.cs.bham.ac.uk/~hxt/research/reg-exp-sec.pdf">Static Analysis for Regular Expression Denial-of-Service Attack</a>.
+		<a href="https://arxiv.org/abs/1301.0849">Static Analysis for Regular Expression Denial-of-Service Attack</a>.
 		</li>
 	</references>
 </qhelp>
diff --git a/javascript/ql/lib/semmle/javascript/security/regexp/ExponentialBackTracking.qll b/javascript/ql/lib/semmle/javascript/security/regexp/ExponentialBackTracking.qll
index aa0cd6b3e695..f930a7d9d3d8 100644
--- a/javascript/ql/lib/semmle/javascript/security/regexp/ExponentialBackTracking.qll
+++ b/javascript/ql/lib/semmle/javascript/security/regexp/ExponentialBackTracking.qll
@@ -3,7 +3,7 @@
  *
  *   James Kirrage, Asiri Rathnayake, Hayo Thielecke: Static Analysis for
  *     Regular Expression Denial-of-Service Attacks. NSS 2013.
- *     (http://www.cs.bham.ac.uk/~hxt/research/reg-exp-sec.pdf)
+ *     (https://arxiv.org/abs/1301.0849)
  *   Asiri Rathnayake, Hayo Thielecke: Static Analysis for Regular Expression
  *     Exponential Runtime via Substructural Logics. 2014.
  *     (https://www.cs.bham.ac.uk/~hxt/research/redos_full.pdf)
diff --git a/javascript/ql/src/Performance/ReDoSReferences.inc.qhelp b/javascript/ql/src/Performance/ReDoSReferences.inc.qhelp
index 2b3e5f17c62d..7aec3aa0bf08 100644
--- a/javascript/ql/src/Performance/ReDoSReferences.inc.qhelp
+++ b/javascript/ql/src/Performance/ReDoSReferences.inc.qhelp
@@ -10,7 +10,7 @@
 		<li>Wikipedia: <a href="https://en.wikipedia.org/wiki/ReDoS">ReDoS</a>.</li>
 		<li>Wikipedia: <a href="https://en.wikipedia.org/wiki/Time_complexity">Time complexity</a>.</li>
 		<li>James Kirrage, Asiri Rathnayake, Hayo Thielecke:
-		<a href="http://www.cs.bham.ac.uk/~hxt/research/reg-exp-sec.pdf">Static Analysis for Regular Expression Denial-of-Service Attack</a>.
+		<a href="https://arxiv.org/abs/1301.0849">Static Analysis for Regular Expression Denial-of-Service Attack</a>.
 		</li>
 	</references>
 </qhelp>
diff --git a/python/ql/lib/semmle/python/security/regexp/ExponentialBackTracking.qll b/python/ql/lib/semmle/python/security/regexp/ExponentialBackTracking.qll
index f4628b883da3..263bf0f53451 100644
--- a/python/ql/lib/semmle/python/security/regexp/ExponentialBackTracking.qll
+++ b/python/ql/lib/semmle/python/security/regexp/ExponentialBackTracking.qll
@@ -3,7 +3,7 @@
  *
  *   James Kirrage, Asiri Rathnayake, Hayo Thielecke: Static Analysis for
  *     Regular Expression Denial-of-Service Attacks. NSS 2013.
- *     (http://www.cs.bham.ac.uk/~hxt/research/reg-exp-sec.pdf)
+ *     (https://arxiv.org/abs/1301.0849)
  *   Asiri Rathnayake, Hayo Thielecke: Static Analysis for Regular Expression
  *     Exponential Runtime via Substructural Logics. 2014.
  *     (https://www.cs.bham.ac.uk/~hxt/research/redos_full.pdf)
diff --git a/python/ql/src/Security/CWE-730/ReDoSReferences.inc.qhelp b/python/ql/src/Security/CWE-730/ReDoSReferences.inc.qhelp
index 2b3e5f17c62d..7aec3aa0bf08 100644
--- a/python/ql/src/Security/CWE-730/ReDoSReferences.inc.qhelp
+++ b/python/ql/src/Security/CWE-730/ReDoSReferences.inc.qhelp
@@ -10,7 +10,7 @@
 		<li>Wikipedia: <a href="https://en.wikipedia.org/wiki/ReDoS">ReDoS</a>.</li>
 		<li>Wikipedia: <a href="https://en.wikipedia.org/wiki/Time_complexity">Time complexity</a>.</li>
 		<li>James Kirrage, Asiri Rathnayake, Hayo Thielecke:
-		<a href="http://www.cs.bham.ac.uk/~hxt/research/reg-exp-sec.pdf">Static Analysis for Regular Expression Denial-of-Service Attack</a>.
+		<a href="https://arxiv.org/abs/1301.0849">Static Analysis for Regular Expression Denial-of-Service Attack</a>.
 		</li>
 	</references>
 </qhelp>
diff --git a/ruby/ql/lib/codeql/ruby/security/regexp/ExponentialBackTracking.qll b/ruby/ql/lib/codeql/ruby/security/regexp/ExponentialBackTracking.qll
index 608f0e595526..c8d21b0bd31b 100644
--- a/ruby/ql/lib/codeql/ruby/security/regexp/ExponentialBackTracking.qll
+++ b/ruby/ql/lib/codeql/ruby/security/regexp/ExponentialBackTracking.qll
@@ -3,7 +3,7 @@
  *
  *   James Kirrage, Asiri Rathnayake, Hayo Thielecke: Static Analysis for
  *     Regular Expression Denial-of-Service Attacks. NSS 2013.
- *     (http://www.cs.bham.ac.uk/~hxt/research/reg-exp-sec.pdf)
+ *     (https://arxiv.org/abs/1301.0849)
  *   Asiri Rathnayake, Hayo Thielecke: Static Analysis for Regular Expression
  *     Exponential Runtime via Substructural Logics. 2014.
  *     (https://www.cs.bham.ac.uk/~hxt/research/redos_full.pdf)
diff --git a/ruby/ql/src/queries/security/cwe-1333/ReDoSReferences.inc.qhelp b/ruby/ql/src/queries/security/cwe-1333/ReDoSReferences.inc.qhelp
index d8bb9eb9ee01..641b1e56b7cc 100644
--- a/ruby/ql/src/queries/security/cwe-1333/ReDoSReferences.inc.qhelp
+++ b/ruby/ql/src/queries/security/cwe-1333/ReDoSReferences.inc.qhelp
@@ -7,7 +7,7 @@
     <li>Wikipedia: <a href="https://en.wikipedia.org/wiki/ReDoS">ReDoS</a>.</li>
     <li>Wikipedia: <a href="https://en.wikipedia.org/wiki/Time_complexity">Time complexity</a>.</li>
     <li>James Kirrage, Asiri Rathnayake, Hayo Thielecke:
-      <a href="http://www.cs.bham.ac.uk/~hxt/research/reg-exp-sec.pdf">Static Analysis for Regular Expression Denial-of-Service Attack</a>.
+      <a href="https://arxiv.org/abs/1301.0849">Static Analysis for Regular Expression Denial-of-Service Attack</a>.
     </li>
   </references>
 </qhelp>
diff --git a/shared/regex/codeql/regex/nfa/ExponentialBackTracking.qll b/shared/regex/codeql/regex/nfa/ExponentialBackTracking.qll
index a2a35298b373..450ee807089d 100644
--- a/shared/regex/codeql/regex/nfa/ExponentialBackTracking.qll
+++ b/shared/regex/codeql/regex/nfa/ExponentialBackTracking.qll
@@ -3,7 +3,7 @@
  *
  *   James Kirrage, Asiri Rathnayake, Hayo Thielecke: Static Analysis for
  *     Regular Expression Denial-of-Service Attacks. NSS 2013.
- *     (http://www.cs.bham.ac.uk/~hxt/research/reg-exp-sec.pdf)
+ *     (https://arxiv.org/abs/1301.0849)
  *   Asiri Rathnayake, Hayo Thielecke: Static Analysis for Regular Expression
  *     Exponential Runtime via Substructural Logics. 2014.
  *     (https://www.cs.bham.ac.uk/~hxt/research/redos_full.pdf)