class Mihari::Analyzers::Base

Attributes

ignore_old_artifacts[RW]
ignore_threshold[RW]

Public Class Methods

inherited(child) click to toggle source
# File lib/mihari/analyzers/base.rb, line 75
def self.inherited(child)
  Mihari.analyzers << child
end
new(*args, **kwargs) click to toggle source
Calls superclass method
# File lib/mihari/analyzers/base.rb, line 17
def initialize(*args, **kwargs)
  super

  @ignore_old_artifacts = false
  @ignore_threshold = 0
end

Public Instance Methods

artifacts() click to toggle source

@return [Array<String>, Array<Mihari::Artifact>]

# File lib/mihari/analyzers/base.rb, line 25
def artifacts
  raise NotImplementedError, "You must implement #{self.class}##{__method__}"
end
description() click to toggle source

@return [String]

# File lib/mihari/analyzers/base.rb, line 35
def description
  raise NotImplementedError, "You must implement #{self.class}##{__method__}"
end
normalized_artifacts() click to toggle source

Normalize artifacts

  • Uniquefy artifacts by native uniq

  • Convert data (string) into an artifact

  • Reject an invalid artifact

@return [Array<Mihari::Artifact>]

# File lib/mihari/analyzers/base.rb, line 87
def normalized_artifacts
  @normalized_artifacts ||= artifacts.compact.uniq.sort.map do |artifact|
    # No need to set data_type manually
    # It is set automatically in #initialize
    artifact.is_a?(Artifact) ? artifact : Artifact.new(data: artifact, source: source)
  end.select(&:valid?).uniq(&:data)
end
run() click to toggle source

Set artifacts & run emitters in parallel

@return [nil]

# File lib/mihari/analyzers/base.rb, line 54
def run
  set_enriched_artifacts

  Parallel.each(valid_emitters) do |emitter|
    run_emitter emitter
  end
end
run_emitter(emitter) click to toggle source

Run emitter

@param [Mihari::Emitters::Base] emitter

@return [nil]

# File lib/mihari/analyzers/base.rb, line 69
def run_emitter(emitter)
  emitter.run(title: title, description: description, artifacts: enriched_artifacts, source: source, tags: tags)
rescue StandardError => e
  puts "Emission by #{emitter.class} is failed: #{e}"
end
source() click to toggle source

@return [String]

# File lib/mihari/analyzers/base.rb, line 40
def source
  self.class.to_s.split("::").last.to_s
end
tags() click to toggle source

@return [Array<String>]

# File lib/mihari/analyzers/base.rb, line 45
def tags
  []
end
title() click to toggle source

@return [String]

# File lib/mihari/analyzers/base.rb, line 30
def title
  self.class.to_s.split("::").last.to_s
end

Private Instance Methods

enriched_artifacts() click to toggle source

Enriched artifacts

@return [Array<Mihari::Artifact>]

# File lib/mihari/analyzers/base.rb, line 113
def enriched_artifacts
  @enriched_artifacts ||= unique_artifacts.map do |artifact|
    artifact.enrich_all
    artifact
  end
end
set_enriched_artifacts() click to toggle source

Set enriched artifacts

@return [nil]

# File lib/mihari/analyzers/base.rb, line 125
def set_enriched_artifacts
  retry_on_error { enriched_artifacts }
rescue ArgumentError => e
  klass = self.class.to_s.split("::").last.to_s
  raise Error, "Please configure #{klass} settings properly. (#{e})"
end
unique_artifacts() click to toggle source

Uniquefy artifacts

@return [Array<Mihari::Artifact>]

# File lib/mihari/analyzers/base.rb, line 102
def unique_artifacts
  @unique_artifacts ||= normalized_artifacts.select do |artifact|
    artifact.unique?(ignore_old_artifacts: ignore_old_artifacts, ignore_threshold: ignore_threshold)
  end
end
valid_emitters() click to toggle source

Select valid emitters

@return [Array<Mihari::Emitters::Base>]

# File lib/mihari/analyzers/base.rb, line 137
def valid_emitters
  @valid_emitters ||= Mihari.emitters.filter_map do |klass|
    emitter = klass.new
    emitter.valid? ? emitter : nil
  end.compact
end