ThreatFlux String Analysis

A comprehensive Rust library for advanced string analysis and categorization, designed for security applications including malware analysis, threat hunting, and forensic investigations.

Features

String Tracking: Track string occurrences across multiple files with full context
Automatic Categorization: Identify URLs, paths, commands, registry keys, and more
Entropy Analysis: Detect potentially encoded or encrypted strings
Suspicious Pattern Detection: Built-in patterns for malware and threat indicators
Statistical Analysis: Generate insights about string distributions and relationships
Extensible Architecture: Add custom patterns and categorization rules
High Performance: Optimized for analyzing large volumes of strings
Serialization Support: Full serde support for all data structures

Quick Start

Add this to your Cargo.toml:

[dependencies]
threatflux-string-analysis = "0.1.0"

Basic usage:

use threatflux_string_analysis::{StringTracker, StringContext};

fn main() -> anyhow::Result<()> {
    let tracker = StringTracker::new();
    
    // Track a suspicious string
    tracker.track_string(
        "http://malware.com/beacon",
        "/path/to/file.exe",
        "file_hash_123",
        "my_scanner",
        StringContext::Url { protocol: Some("http".to_string()) }
    )?;
    
    // Get statistics
    let stats = tracker.get_statistics(None);
    println!("Suspicious strings: {}", stats.suspicious_strings.len());
    
    Ok(())
}

Advanced Usage

Custom Pattern Matching

use threatflux_string_analysis::{PatternDef, DefaultPatternProvider};

let mut provider = DefaultPatternProvider::empty();

// Add custom pattern for API keys
provider.add_pattern(PatternDef {
    name: "api_key".to_string(),
    regex: r"[A-Za-z0-9]{32,}".to_string(),
    category: "credential".to_string(),
    description: "Potential API key".to_string(),
    is_suspicious: true,
    severity: 7,
})?;

Custom Categorization

use threatflux_string_analysis::{CategoryRule, StringCategory, DefaultCategorizer};

let mut categorizer = DefaultCategorizer::new();

categorizer.add_rule(CategoryRule {
    name: "custom_rule".to_string(),
    matcher: Box::new(|s| s.contains("custom_pattern")),
    category: StringCategory {
        name: "custom_category".to_string(),
        parent: None,
        description: "Custom category description".to_string(),
    },
    priority: 100,
})?;

Filtering and Searching

use threatflux_string_analysis::StringFilter;

// Filter for high-entropy suspicious strings
let filter = StringFilter {
    suspicious_only: Some(true),
    min_entropy: Some(4.5),
    categories: Some(vec!["network".to_string(), "command".to_string()]),
    ..Default::default()
};

let filtered_stats = tracker.get_statistics(Some(&filter));

Use Cases

Malware Analysis

Extract and categorize strings from binary files
Identify C2 servers, encryption keys, and malicious commands
Track string patterns across malware families

Security Log Analysis

Process security logs to identify IOCs
Detect repeated attack patterns
Correlate suspicious activities

Threat Hunting

Search for specific threat indicators
Analyze string entropy for obfuscation detection
Track evolution of threats over time

Forensic Investigations

Extract and analyze strings from memory dumps
Categorize artifacts by type
Build timelines of string occurrences

Architecture

The library is built with a modular, trait-based architecture:

StringAnalyzer: Core trait for analyzing strings
Categorizer: Trait for categorizing strings
PatternProvider: Trait for managing detection patterns
StringTracker: Main tracking and analysis engine

This design allows for easy extension and customization for specific use cases.

Examples

See the examples/ directory for complete examples:

basic_usage.rs: Introduction to the library
security_log_analysis.rs: Analyzing security logs
custom_patterns.rs: Creating domain-specific patterns

Performance

The library is optimized for high-volume string analysis:

Efficient string deduplication
Configurable memory limits
Fast pattern matching with compiled regexes
Minimal allocations in hot paths

Contributing

Contributions are welcome! Please feel free to submit issues and pull requests.

License

This project is licensed under the MIT license.

threatflux-string-analysis 0.1.1