First commit of file entropy analyzer.

- Code comments need cleaned up still.
This commit is contained in:
Seth Hall 2013-08-05 00:02:48 -04:00
parent 2f0671aeeb
commit b7877792c9
7 changed files with 221 additions and 0 deletions

View file

@ -0,0 +1,19 @@
module Files;
export {
redef record Files::Info += {
## The information density of the contents of the file, expressed as a number of bits per character.
entropy: double &log &optional;
};
}
event file_new(f: fa_file)
{
Files::add_analyzer(f, Files::ANALYZER_ENTROPY);
}
event file_entropy(f: fa_file, ent: entropy_test_result)
{
f$info$entropy = ent$entropy;
}