Object AC (Aho-Corasick)
An Aho-Corasick multi pattern matcher created with T.ac( _pattern_array_ )
This is a convenience utility provided to you by the Trisul framework because multi pattern matching is such a frequent need in network analytics applications.
Creating the object
The object is created and stored in a global state, either as a global variable or as a member in the Global T
table. Note that the global states are per-file not across LUA files.
onload = function()
T.patternMatcher = T.ac( {'string1','string2','strin3'...})
end,
.. later ..
T.patternMatcher:match_one(..)
Functions
A summary of the functions available in this object.
Name | In | Out | Description |
---|---|---|---|
match_all | string | table | Matches all patterns. The matches are returned in a table { pattern_matched = position } The position indicates the last matching character, not the first. |
match_one | string | table | Same as match_all, but stops after finding a single match. Use this method for alerting on pattern matches. |
Function match_all
Tries to match all patterns against the input text.
Purpose
Use this parameter passed to your Lua function to integrate your data into the Trisul framework.
Parameters
text | string | the text to be matched |
Return value
A table of matches. See the debug output below
Usage
In this example we are attempting to match a list of hostnames against a DNS Full Text Search text.
The code at the point the dbg()
is called is shown below
onload = function()
T.patterns = T.ac( { "toolbar", "nsatc", "HOLLERITH" })
end,
onflush= function(dbengine, fts)
local m = T.patterns:match_all( fts:text() )
dbg();
if next(m) then
print("FOUND a match.. do your thing"
end
..
Using the debugger, we can inspect the return value m
debugger.lua> p m
m => {"toolbar" = 87}
debugger.lua> p fts:text()
fts:text() => "QUERY\9ID: 39219\9Flags:0×0100\9QDCount:1\9ANCount:0\9NSCount:0\9ARCount:0\
Questions\
.toolbar.google.com\9\9A\9IN\
\
"
debugger.lua>
Function match_one
Match all the strings in the pattern against the input text.
Stop at the first match. The match_all
tries to match all patterns and does not stop after the first match.