mstoeck3/autopsy-flatpak
1
0
Fork 0
mirror of https://github.com/overcuriousity/autopsy-flatpak.git synced 2025-07-16 01:37:43 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #2524 from esaunders/reduce_email_false_positives

Browse Source 
Reduce number of email address false positives by eliminating hits un…
This commit is contained in:
Richard Cordovano 2017-02-14 09:29:47 -05:00 committed by GitHub
commit 82642783eb
1 changed files with 11 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/RegexQuery.java
View File

@ -82,6 +82,9 @@ final class RegexQuery implements KeywordSearchQuery {
private boolean escaped;
private String escapedQuery;
private final int MIN_EMAIL_ADDR_LENGTH = 8;
private final Pattern INVALID_EMAIL_PATTERN = Pattern.compile(".*\\.(dll|txt|exe|jpg|xml)$");
private final ListMultimap<Keyword, KeywordHit> hitsMultiMap = ArrayListMultimap.create();
// Lucene regular expressions do not support the following Java predefined
@ -256,6 +259,14 @@ final class RegexQuery implements KeywordSearchQuery {
offset = hitMatcher.end();
if (originalKeyword.getArtifactAttributeType() == BlackboardAttribute.ATTRIBUTE_TYPE.TSK_EMAIL) {
// Reduce false positives by eliminating email address hits that are either
// too short or end with well known file externsions.
if (hit.length() < MIN_EMAIL_ADDR_LENGTH || INVALID_EMAIL_PATTERN.matcher(hit).matches()) {
break;
}
}
/*
* If searching for credit card account numbers, do a Luhn check
* on the term and discard it if it does not pass.