prefilter

Documentation

Overview

Package prefilter provides Aho-Corasick based keyword pre-filtering for detectors.

This package uses a forked version of pgavlin/aho-corasick with ByteEquivalence ("klingon") support for custom byte transformations during matching.

Index

• type ByteEquivalence
• type Prefilter
  • func New(keywords []string, klingon ByteEquivalence) *Prefilter
  • func NewWithDetectorMapping(detectorKeywords map[string][]string, klingon ByteEquivalence) *Prefilter
  • func (p *Prefilter) HasMatch(text string) bool
  • func (p *Prefilter) Match(text string) []string
  • func (p *Prefilter) MatchedDetectors(text string) []string
  • func (p *Prefilter) MatchedPatternIndices(text string) []int

Types

type ByteEquivalence

type ByteEquivalence = func(byte) []byte

ByteEquivalence defines a function that returns equivalent bytes for matching. This enables "klingon" support - custom encodings/transformations.

type Prefilter

type Prefilter struct {
	// contains filtered or unexported fields
}

Prefilter provides efficient multi-pattern matching using Aho-Corasick.

func New

func New(keywords []string, klingon ByteEquivalence) *Prefilter

New creates a Prefilter with the given keywords and optional klingon transformation. If klingon is nil, standard exact matching is used.

func NewWithDetectorMapping

func NewWithDetectorMapping(detectorKeywords map[string][]string, klingon ByteEquivalence) *Prefilter

NewWithDetectorMapping creates a Prefilter that maps keywords to detector names. The mapping allows MatchedDetectors to return which detectors should run.

func (*Prefilter) HasMatch

func (p *Prefilter) HasMatch(text string) bool

HasMatch returns true if any keyword matches the text. This is faster than Match when you only need to know if there's any match.

func (*Prefilter) Match

func (p *Prefilter) Match(text string) []string

Match returns all keywords that match in the given text.

func (*Prefilter) MatchedDetectors

func (p *Prefilter) MatchedDetectors(text string) []string

MatchedDetectors returns the detector names that have at least one keyword match. Requires the Prefilter to be created with NewWithDetectorMapping.

func (*Prefilter) MatchedPatternIndices

func (p *Prefilter) MatchedPatternIndices(text string) []int

MatchedPatternIndices returns the indices of patterns that match in the text.