bytematcher

Documentation

Overview

Package bytematcher builds a matching engine from a set of signatures and performs concurrent matching against an input siegreader.Buffer.

Index

• func Add(c core.Matcher, ss core.SignatureSet, priorities priority.List) (core.Matcher, int, error)
• func Load(ls *persist.LoadSaver) core.Matcher
• func Save(c core.Matcher, ls *persist.LoadSaver)
• type Matcher
  • func (b *Matcher) Identify(name string, sb *siegreader.Buffer, exclude ...int) (chan core.Result, error)
  • func (b *Matcher) InspectTestTree(i int) []int
  • func (b *Matcher) SetLowMem()
  • func (b *Matcher) String() string
• type SignatureSet

Functions

func Add

func Add(c core.Matcher, ss core.SignatureSet, priorities priority.List) (core.Matcher, int, error)

Add a set of signatures to a bytematcher. The priority list should be of equal length to the signatures, or nil (if no priorities are to be set).

Example:

m, n, err := Add(bm, []frames.Signature{frames.Signature{frames.NewFrame(frames.BOF, patterns.Sequence{'p','d','f'}, 0, 0)}}, nil)

func Load

func Load(ls *persist.LoadSaver) core.Matcher

Load loads a Matcher.

func Save

func Save(c core.Matcher, ls *persist.LoadSaver)

Save persists a Matcher.

Types

type Matcher

type Matcher struct {
	// contains filtered or unexported fields
}

Matcher matches byte signatures against the siegreader.Buffer.

func (*Matcher) Identify

func (b *Matcher) Identify(name string, sb *siegreader.Buffer, exclude ...int) (chan core.Result, error)

Identify matches a Matcher's signatures against the input siegreader.Buffer. Results are passed on the returned channel.

Example:

ret := bm.Identify("", buf)
for v := range ret {
  if v.Index() == 0 {
    fmt.Print("Success! It is signature 0!")
  }
}

func (*Matcher) InspectTestTree

func (b *Matcher) InspectTestTree(i int) []int

InspectTestTree reports which signatures are linked to a given index in the test tree. This is used by the -log debug and -log slow options for sf.

func (*Matcher) SetLowMem

func (b *Matcher) SetLowMem()

SetLowMem instructs the Aho Corasick search tree to be built with a low memory opt (runs slightly slower than regular).

func (*Matcher) String

func (b *Matcher) String() string

String returns information about the Bytematcher including the number of BOF, VAR and EOF sequences, the number of BOF and EOF frames, and the total number of tests.

type SignatureSet

type SignatureSet []frames.Signature

SignatureSet for a bytematcher is a slice of frames.Signature.