Restructure detection packages

detection/dga/lms.go

@@ -0,0 +1,56 @@
+package dga
+
+import (
+	"strings"
+)
+
+// LmsScoreOfDomain calculates the mean longest meaningful substring of a domain. It follows some special rules to increase accuracy. It returns a value between 0 and 100, representing the length-based percentage of the meaningful substring.
+func LmsScoreOfDomain(domain string) float64 {
+	var totalScore float64
+	domain = strings.ToLower(domain)
+	subjects := strings.Split(domain, ".")
+	// ignore the last two parts
+	if len(subjects) <= 3 {
+		return 100
+	}
+	subjects = subjects[:len(subjects)-3]
+	var totalLength int
+	for _, subject := range subjects {
+		totalLength += len(subject)
+	}
+	for _, subject := range subjects {
+		// calculate score, weigh it and add it
+		if len(subject) > 0 {
+			totalScore += LmsScore(subject) * (float64(len(subject)) / float64(totalLength))
+		}
+	}
+	return totalScore
+}
+
+// LmsScore calculates the longest meaningful substring of a domain. It returns a value between 0 and 100, representing the length-based percentage of the meaningful substring.
+func LmsScore(subject string) float64 {
+	lmsStart := -1
+	lmsStop := -1
+	longestLms := 0
+
+	for i, c := range subject {
+		if int(c) >= int('a') && int(c) <= int('z') {
+			if lmsStart == -1 {
+				lmsStart = i
+			}
+		} else {
+			if lmsStart > -1 {
+				lmsStop = i
+				if lmsStop-lmsStart > longestLms {
+					longestLms = lmsStop - lmsStart
+				}
+				lmsStart = -1
+			}
+		}
+	}
+	if lmsStop == -1 {
+		longestLms = len(subject)
+	}
+	// fmt.Printf("algs: lms score of %s is %.2f\n", subject, (float64(longest_lms) * 100.0 / float64(len(subject))))
+	return (float64(longestLms) * 100.0 / float64(len(subject)))
+}

detection/dga/lms_test.go

@@ -0,0 +1,17 @@
+package dga
+
+import "testing"
+
+func TestLmsScoreOfDomain(t *testing.T) {
+	testDomain(t, "g.symcd.com.", 100, 100)
+	testDomain(t, "www.google.com.", 100, 100)
+	testDomain(t, "55ttt5.12abc3.test.com.", 50, 50)
+	testDomain(t, "mbtq6opnuodp34gcrma65fxacgxv5ukr7lq6xuhr4mhoibe7.yvqptrozfbnqyemchpovw3q5xwjibuxfsgb72mix3znhpfhc.i2n7jh2gadqaadck3zs3vg3hbv5pkmwzeay4gc75etyettbb.isi5mhmowtfriu33uxzmgvjur5g2p3tloynwohfrggee6fkn.meop7kqyd5gwxxa3.er.spotify.com.", 0, 30)
+}
+
+func testDomain(t *testing.T, domain string, min, max float64) {
+	score := LmsScoreOfDomain(domain)
+	if score < min || score > max {
+		t.Errorf("domain %s has scored %.2f, but should be between %.0f and %.0f", domain, score, min, max)
+	}
+}