Module detect 

Public detection entry point: the spec 4.0.2 SusPatternsManager.detect pipeline (preprocess, four scan views, semantic analysis, scoring).

View passes mirror the reference mixins:

• processed view (raw_view_only=False): excludes raw-view-only and URL-decoded-view-only patterns;
• raw signal-preserving view (raw_view_only=True): raw-view-only patterns plus the recon rows (the processed views fold LDAP hex escapes such as \default before the tables run; duplicates against the processed view are dropped on merge);
• decoded-view path-traversal check (processed vs raw view counts);
• URL-decoded view (url_decoded_view_only=True): only URL-decoded-view patterns, content is the precomputed decoded view truncated safely;
• decode-budget exhaustion threat when a decode pass hit its budget;
• short-base64 additive view (no view exclusion);
• semantic analysis over the processed content (skipped for binary-looking raw content).

Scoring follows _regex_anomaly / _calculate_threat_score: is_threat is sum(regex weights) >= threat_score_threshold or any semantic threat; threat_score is min(max(regex anomaly, semantic max), 1.0) when any threat exists, else 0.0.

Structs

DetectConfig

Knob mapping for one detect call (spec config_knobs).

DetectVerdict

Full verdict (SusPatternsManager.detect return shape, minus timing).

SemanticThreat

Semantic threat with the full analysis payload (_check_semantic_threats).

Enums

Threat

One threat, regex or semantic, exactly as the reference emits it.

Constants

EMBEDDED_JSON_LEAF_CONTEXT_SUFFIX

Functions

detect

The reference detect pipeline over one request content, under a fresh default scan time budget (DEFAULT_MAX_SCAN_SECONDS) for this call.

detect_with_budget

detect_with_semantic_skip over a caller-owned ScanTimeBudget.

detect_with_semantic_skip

detect with the semantic analyzer optionally skipped.

normalize_context

_normalize_context: keep the part before the first :, map unknown contexts to unknown.