ThreatFactor NSIA

ThreatSignatures could have more power if they supported extensions that could be used inside of definitions. These extensions could be used to perform operations not typically available within ThreatSignatures. Below is an example of the syntax that may be used:

Extension.HTTP.Header["Server"] = "/Apache.*/i";
Extension.HTTP.Cookie("auth", true) != "/[A-F0-9]{,32}/i";

The actual function to process the extension would include the following function prototype:

boolean matchedExtension(
    String extensionName, //"Extension.HTTP.Cookie" 
    String[] arguments, //"auth", "true" 
    boolean notFlagSet, //true
    String operand ); //"/[A-F0-9]{,32}/i"