threatflux_string_analysis/
lib.rs

1//! # ThreatFlux String Analysis
2//!
3//! A comprehensive string analysis library for security applications, providing
4//! advanced categorization, entropy analysis, and pattern detection capabilities.
5//!
6//! ## Features
7//!
8//! - **String Tracking**: Track string occurrences across multiple files with context
9//! - **Automatic Categorization**: Identify URLs, paths, commands, registry keys, etc.
10//! - **Entropy Analysis**: Detect potentially encoded or encrypted strings
11//! - **Suspicious Pattern Detection**: Built-in patterns for malware and threat indicators
12//! - **Statistical Analysis**: Generate insights about string distributions and relationships
13//! - **Extensible Architecture**: Add custom patterns and categorization rules
14//!
15//! ## Quick Start
16//!
17//! ```rust
18//! use threatflux_string_analysis::{StringTracker, StringContext};
19//!
20//! # fn main() -> anyhow::Result<()> {
21//! let tracker = StringTracker::new();
22//!
23//! // Track a string
24//! tracker.track_string(
25//!     "http://suspicious.com/malware.exe",
26//!     "/path/to/file.bin",
27//!     "file_hash_123",
28//!     "my_scanner",
29//!     StringContext::FileString { offset: Some(1024) }
30//! )?;
31//!
32//! // Get statistics
33//! let stats = tracker.get_statistics(None);
34//! println!("Suspicious strings found: {}", stats.suspicious_strings.len());
35//! # Ok(())
36//! # }
37//! ```
38
39mod analyzer;
40mod categorizer;
41mod patterns;
42mod tracker;
43mod types;
44
45// Re-export main types
46pub use analyzer::{DefaultStringAnalyzer, StringAnalysis, StringAnalyzer, SuspiciousIndicator};
47pub use categorizer::{Categorizer, CategoryRule, DefaultCategorizer, StringCategory};
48pub use patterns::{DefaultPatternProvider, Pattern, PatternDef, PatternProvider};
49pub use tracker::{
50    StringContext, StringEntry, StringFilter, StringOccurrence, StringStatistics, StringTracker,
51};
52pub use types::*;
53
54// Version information
55/// Library version string
56pub const VERSION: &str = env!("CARGO_PKG_VERSION");
threatflux_string_analysis/lib.rs

threatflux_string_analysis/
lib.rs
