Skip to content

Patterns.md

Latest commit

 

History

History
52 lines (36 loc) · 1.89 KB

Patterns.md

File metadata and controls

52 lines (36 loc) · 1.89 KB
Raw

Threat Intelligence Patterns

StruLink utilizes hundreds of rigorously optimized regular expressions under its Zero-Trust Security Module.

Primary Pattern Map (PATTERNS)

Developers can import and observe the raw PATTERNS object dictionary containing arrays of raw RegExp statements targeting specific subsets of vulnerabilities.

Categorized families include:

  • SQL_INJECTION_PATTERNS
  • XSS_PATTERNS
  • COMMAND_INJECTION_PATTERNS
  • PATH_TRAVERSAL_PATTERNS
  • OPEN_REDIRECT_PATTERNS
  • SSRF_PATTERNS
  • CRLF_INJECTION_PATTERNS
  • TEMPLATE_INJECTION_PATTERNS
  • NOSQL_INJECTION_PATTERNS
  • GRAPHQL_INJECTION_PATTERNS

Extracted Insights Types

When evaluating user input, systems leverage standard analysis properties.

MaliciousPatternResult

The root result from a complete security scanning session.

  • isMalicious: (boolean) Trigger flag for mitigation blocks.
  • score: Total risk accumulation.
  • confidence: low, medium, or high.
  • detectedPatterns: Comprehensive array displaying which specific rule blocks matched.
  • recommendation: Contextual advice generated by the evaluation engine.

DetectedPattern

Provides deeper insight dynamically on individual pattern classifications triggered.

  • type: Relates to the MaliciousPatternType enum (e.g., MaliciousPatternType.SQL_INJECTION).
  • severity & confidence: Contextual indicators mapped directly to the match strength.
  • location: Specifies where it was found (useful in full URL analysis when the injection happens on params or path).
  • pattern: Representation of the regex rule invoked.

MaliciousPatternType

An enumeration identifying over 30 modern and legacy network attack models. Examples include:

  • SQL_INJECTION, NOSQL_INJECTION, GRAPHQL_INJECTION
  • RCE, COMMAND_INJECTION
  • PATH_TRAVERSAL, RFI, FILE_INCLUSION
  • PROTOTYPE_POLLUTION, DOM_CLOBBERING, DESERIALIZATION