Skip to content

Superrule generation logic #22

@kryponix

Description

@kryponix

Hi,
Is it possible that the super-rule generation condition is inverted?
Inspecting the code, there's a condition that practically (unless there're at least 20 rules by default) stops the code from generating a super-rule (...if len(combinations[combi]["strings"]) >= int(args.rc):..).
Inverting the condition, allows the script to generate super-rules. It seems to me that args.rc, as described by the documentation shouldn't be playing that role in that condition.
I do agree that simply inverting the condition, might be a simplistic approach and that, of course, I just landed in the code and did not try it throughly, and will be more likely missing sth.
But reality is that the script does not generate super-rules even in cases where it should (I don't expect a super-rule covering dozens of (similar) samples to have more than 20 rules).
And as I stated before, it seems args.rc is being used with two different meanings (maximum number of strings for simple rules, (sort of a) minimum for super-rules.
Pls, forget me if I made a basic mistake (I'm not proficient in Python).
Thanks in advance for your help.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions