Repository Analysis

stamparm/maltrail

Malicious traffic detection system

12.2 Low AI signal View on GitHub

Analysis Overview

This report presents the forensic synthetic code analysis of stamparm/maltrail, a Python project with 8,588 GitHub stars. SynthScan v2.0 examined 103,861 lines of code across 249 source files, recording 870 pattern matches distributed across 12 syntactic categories. The overall adjusted score of 12.2 places this repository in the Low AI signal band.

The scanner applied 160+ deterministic lexical heuristics, multi-line block detectors, abstract syntax tree depth profilers, and a cross-file Jaccard similarity matrix to construct a statistically normalised synthetic code estimate. All matches are individually weighted by severity coefficient and contextual multiplier before summation, and the resulting headline score is temporally discounted to account for the repository's development history relative to the commercial emergence of large language model coding tooling (November 2022 onward).

12.2
Adjusted Score
12.2
Raw Score
100%
Time Factor
2026-08-28
Last Push
8.6K
Stars
Python
Language
103.9K
Lines of Code
249
Files
870
Pattern Hits
2026-08-29
Scan Date
0.28
HC Hit Rate

What These Metrics Mean

Adjusted Score
Primary synthetic code indicator. Raw score normalised per 1,000 lines of code and multiplied by the temporal discount factor. This is the definitive comparative metric — use it to rank repositories by AI authorship density.
Raw Score
The unmodified sum of all severity-weighted, context-multiplied pattern match scores before temporal discounting. Reflects the absolute signal strength independent of when the repository was last active.
Time Factor
The temporal discount multiplier (0–100%) applied to the raw score. Repositories last updated before ChatGPT's launch (Nov 2022) receive a 5% factor. Full signal is only assigned to repositories active in the post-adoption era (Jan 2024+).
Pattern Hits
Total count of individual pattern matches across all files and categories. A high hit count with a low score may indicate a very large codebase with isolated AI snippets; a low count with a high score indicates dense, concentrated AI signatures.
HC Hit Rate
High+Critical pattern hits per file, averaged across the repository. This orthogonal signal catches repositories where a few files are densely packed with high-severity AI tells — a strong indicator even when the normalised score appears moderate due to codebase size.
Lines of Code / Files
Total lines and files analysed. The scanner examines 94 file extensions. These denominators are used to normalise the score, enabling fair comparison between repositories of vastly different sizes.

Score History

This chart maps the temporal evolution of the adjusted synthetic code score across successive scan runs. An upward trajectory indicates ongoing incorporation of AI-generated code or expanding LLM-assisted scaffolding; a stable or declining trajectory may reflect active human refactoring, code removal, or the adoption of stricter authorship policies. The dashed secondary line (right axis) independently tracks total raw pattern hit count, which can diverge from the normalised score when codebase size changes significantly between scans.

Severity Breakdown

Classifies detected patterns by their diagnostic confidence and structural impact. CRITICAL patterns (coefficient 10) represent definitive synthetic signatures — hallucinated imports, explicit LLM attribution metadata — virtually never produced by human authors. HIGH (5) indicates strong structural tells such as cross-file repetition or cross-linguistic idioms. MEDIUM (2) covers recognisable conversational padding and AI-specific vocabulary. LOW (1) captures subtle indicators like tautological comments and generic boilerplate that require density to carry independent signal.

CRITICAL 0HIGH 70MEDIUM 49LOW 751

Directory Score Breakdown

This horizontal bar chart decomposes the repository's raw synthetic code score by top-level directory, allowing you to pinpoint precisely which modules or components carry the highest AI authorship density. Directories with disproportionately high scores relative to their size warrant targeted manual review: concentrated AI signatures often trace back to mass-generated configuration layers, auto-ported test suites, LLM-scaffolded boilerplate classes, or entire subsystems authored under heavy copilot assistance. Use this view to prioritise your human code-review effort.

Pattern Findings

The scanner identified 870 distinct pattern matches across 12 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a statistically significant AI authorship indicator. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the diagnostic confidence level (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — comment-context matches receive a ×1.5 weight because LLMs systematically over-annotate. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier as dense clusters constitute far stronger evidence of synthetic authorship than isolated hits.

Hyper-Verbose Identifiers364 hits · 414 pts
SeverityFileLineSnippetContext
LOWcore/quic_sni.py219def derive_client_initial_keys(dcid, version=1):CODE
LOWcore/quic_sni.py250def extract_sni_from_quic_initial(udp_payload):CODE
LOWcore/common.py768 def _format_action_invocation(self, action):STRING
LOWcore/doctor.py131def check_update_reachability():CODE
LOWtests/test_reference.py60 def test_no_substring_false_positive(self):CODE
LOWtests/test_reference.py110 def test_a_trail_with_no_citation_is_not_reported_as_missing_provenance(self):CODE
LOWtests/test_reference.py115 def test_no_sidecar_names_what_restores_it(self):CODE
LOWtests/test_reference.py123 def test_a_corrupt_sidecar_does_not_take_the_endpoint_down(self):CODE
LOWtests/test_reference.py132 def test_it_reopens_when_the_sidecar_changes(self):CODE
LOWtests/test_ignore.py25 def test_no_config_keeps_event(self):CODE
LOWtests/test_ignore.py28 def test_regex_match_and_miss(self):CODE
LOWtests/test_ignore.py35 def test_invalid_regex_does_not_crash(self):CODE
LOWtests/test_ignore.py41 def test_ignorelist_src_wildcards(self):CODE
LOWtests/test_debug_artifacts.py55 def test_no_js_debugger_statement(self):CODE
LOWtests/test_debug_artifacts.py60 def test_no_console_log_outside_the_vendored_bundle(self):CODE
LOWtests/test_debug_artifacts.py65 def test_no_pdb_breakpoints_in_the_server(self):CODE
LOWtests/test_debug_artifacts.py71 def test_shipped_config_keeps_the_safe_defaults(self):CODE
LOWtests/test_common.py59 def test_common_affix_factoring(self):CODE
LOWtests/test_common.py63 def test_metachars_escaped_literally(self):CODE
LOWtests/test_common.py73 def test_builtin_ranges_match(self):CODE
LOWtests/test_common.py79 def test_domain_not_range_matched(self):CODE
LOWtests/test_common.py83 def test_exact_member_whitelisted(self):CODE
LOWtests/test_common.py211 def test_a_pem_holding_a_known_bad_block_is_rejected(self):CODE
LOWtests/test_common.py216 def test_the_key_is_recognised_without_its_original_certificate(self):CODE
LOWtests/test_common.py223 def test_whitespace_and_block_order_do_not_matter(self):CODE
LOWtests/test_common.py228 def test_an_unrelated_pem_is_accepted(self):CODE
LOWtests/test_common.py233 def test_garbage_in_a_pem_block_is_not_a_crash(self):CODE
LOWtests/test_common.py241 def test_an_unreadable_pem_is_neither_accepted_nor_rejected(self):CODE
LOWtests/test_common.py245 def test_the_shipped_fingerprint_set_still_names_both_blocks(self):CODE
LOWtests/test_common.py316 def test_missing_or_malformed_payload_is_a_non_answer_not_a_crash(self):CODE
LOWtests/test_common.py323 def test_a_hit_costs_no_request(self):CODE
LOWtests/test_common.py329 def test_a_failure_is_cached_too(self):CODE
LOWtests/test_common.py335 def test_expiry_lets_a_lookup_retry(self):CODE
LOWtests/test_common.py345 def test_the_cache_is_bounded(self):CODE
LOWtests/test_common.py38 def test_public_and_boundaries(self):CODE
LOWtests/test_common.py122 def test_non_aligned_cidr_whitelists_subnet(self):CODE
LOWtests/test_common.py299 def test_geoloc_country_is_extracted_and_normalised(self):CODE
LOWtests/test_common.py305 def test_a_country_that_is_not_a_country_code_is_dropped(self):CODE
LOWtests/test_common.py356 def test_disabled_means_no_request_at_all(self):CODE
LOWtests/test_common.py362 def test_an_unknown_kind_is_refused_before_any_request(self):CODE
LOWtests/test_quic_sni.py152 def test_multibyte_packet_number(self):CODE
LOWtests/test_quic_sni.py169 def test_multi_crypto_frame_reassembly(self):CODE
LOWtests/test_quic_sni.py176 def test_multi_crypto_frame_out_of_order(self):CODE
LOWtests/test_quic_sni.py183 def test_padding_and_ping_frames_skipped(self):CODE
LOWtests/test_quic_sni.py193 def test_pure_python_decodes_crypto_encrypted(self):CODE
LOWtests/test_quic_sni.py206 def test_prefix_cap_matches_full(self):CODE
LOWtests/test_quic_sni.py224 def test_truncated_valid_packet(self):CODE
LOWtests/test_frontend.py44 def test_every_column_has_a_cell(self):CODE
LOWtests/test_frontend.py59 def test_empty_state_spans_every_column(self):CODE
LOWtests/test_frontend.py67 def test_sortable_columns_are_sortable(self):CODE
LOWtests/test_frontend.py107 def test_severity_of_real_events(self):CODE
LOWtests/test_frontend.py157 def test_family_of_real_info_fields(self):STRING
LOWtests/test_frontend.py180 def test_family_token_filters_rows(self):STRING
LOWtests/test_frontend.py225 def test_canvas_is_sized_from_the_panel(self):STRING
LOWtests/test_frontend.py231 def test_open_chart_follows_a_window_resize(self):STRING
LOWtests/test_frontend.py235 def test_donut_and_legend_are_centred(self):STRING
LOWtests/test_frontend.py282 def test_every_count_chart_labels_its_gridlines(self):STRING
LOWtests/test_frontend.py294 def test_axis_ticks_are_whole_and_distinct(self):STRING
LOWtests/test_frontend.py337 def test_the_whole_tag_set_is_editable_here(self):CODE
LOWtests/test_frontend.py344 def test_sections_cover_the_event_tuple(self):CODE
304 more matches not shown…
Cross-File Repetition67 hits · 335 pts
SeverityFileLineSnippetContext
HIGHserver.py0copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying pSTRING
HIGHcore/update.py0copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying pSTRING
HIGHcore/geo.py0copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying pSTRING
HIGHcore/enums.py0copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying pSTRING
HIGHcore/trailsbin.py0copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying pSTRING
HIGHcore/compat.py0copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying pSTRING
HIGHcore/index.py0copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying pSTRING
HIGHcore/log.py0copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying pSTRING
HIGHcore/httpd.py0copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying pSTRING
HIGHcore/__init__.py0copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying pSTRING
HIGHcore/addr.py0copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying pSTRING
HIGHcore/assemble.py0copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying pSTRING
HIGHcore/ignore.py0copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying pSTRING
HIGHcore/common.py0copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying pSTRING
HIGHcore/custom_trails.py0copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying pSTRING
HIGHcore/settings.py0copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying pSTRING
HIGHcore/attribdict.py0copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying pSTRING
HIGHcore/provenance.py0copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying pSTRING
HIGHcore/parallel.py0copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying pSTRING
HIGHcore/testing.py0copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying pSTRING
HIGHcore/trailsdict.py0copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying pSTRING
HIGHcore/alert.py0copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying pSTRING
HIGHcore/meta.py0copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying pSTRING
HIGHtests/test_index.py0copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying pSTRING
HIGHfeeds/rutgers.py0copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying pSTRING
HIGHfeeds/ciarmy.py0copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying pSTRING
HIGHfeeds/policeman.py0copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying pSTRING
HIGHfeeds/atmos.py0copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying pSTRING
HIGHfeeds/fareit.py0copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying pSTRING
HIGHfeeds/blocklist.py0copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying pSTRING
HIGHfeeds/abuseipdb.py0copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying pSTRING
HIGHfeeds/viriback.py0copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying pSTRING
HIGHfeeds/greensnow.py0copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying pSTRING
HIGHfeeds/myip.py0copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying pSTRING
HIGHfeeds/emergingthreatsdns.py0copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying pSTRING
HIGHfeeds/sslproxies.py0copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying pSTRING
HIGHfeeds/blackbook.py0copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying pSTRING
HIGHfeeds/statics.py0copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying pSTRING
HIGHfeeds/binarydefense.py0copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying pSTRING
HIGHfeeds/dshieldip.py0copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying pSTRING
HIGHfeeds/__init__.py0copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying pSTRING
HIGHfeeds/maxmind.py0copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying pSTRING
HIGHfeeds/minerchk.py0copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying pSTRING
HIGHfeeds/badips.py0copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying pSTRING
HIGHfeeds/sslblja3.py0copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying pSTRING
HIGHfeeds/bruteforceblocker.py0copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying pSTRING
HIGHfeeds/torprojectnodes.py0copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying pSTRING
HIGHfeeds/emergingthreatsbot.py0copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying pSTRING
HIGHfeeds/torproject.py0copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying pSTRING
HIGHfeeds/socksproxy.py0copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying pSTRING
HIGHfeeds/cybercrimetracker.py0copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying pSTRING
HIGHfeeds/emergingthreatscip.py0copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying pSTRING
HIGHfeeds/alienvault.py0copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying pSTRING
HIGHfeeds/ipnoise.py0copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying pSTRING
HIGHfeeds/bitcoinnodes.py0copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying pSTRING
HIGHfeeds/turris.py0copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying pSTRING
HIGHfeeds/feodotrackerip.py0copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying pSTRING
HIGHfeeds/cleantalk.py0copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying pSTRING
HIGHfeeds/sslblcert.py0copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying pSTRING
HIGHfeeds/gpfcomics.py0copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying pSTRING
7 more matches not shown…
Excessive Try-Catch Wrapping161 hits · 170 pts
SeverityFileLineSnippetContext
LOWserver.py184 except Exception:CODE
LOWserver.py203 except Exception:CODE
MEDIUMcore/update.py199def _cached_sha():CODE
MEDIUMcore/update.py698def update_ipcat(force=False):CODE
LOWcore/update.py834 except Exception:CODE
LOWcore/update.py836 except Exception as ex:CODE
LOWcore/update.py844 except Exception as ex:CODE
LOWcore/update.py100 except Exception as ex:CODE
LOWcore/update.py148 except Exception as ex:CODE
LOWcore/update.py153 except Exception:CODE
LOWcore/update.py233 except Exception as ex:CODE
LOWcore/update.py316 except Exception as ex:CODE
LOWcore/update.py354 except Exception as ex:CODE
LOWcore/update.py374 except Exception:CODE
LOWcore/update.py472 except Exception as ex:CODE
LOWcore/update.py478 except Exception:CODE
LOWcore/update.py589 except Exception:CODE
LOWcore/update.py680 except Exception as ex:CODE
LOWcore/update.py688 except Exception:CODE
LOWcore/update.py702 except Exception as ex:CODE
LOWcore/update.py717 except Exception as ex:CODE
LOWcore/update.py739 except Exception as ex:CODE
LOWcore/update.py803 except Exception as ex:CODE
LOWcore/geo.py78 except Exception:CODE
LOWcore/geo.py94 except Exception:CODE
LOWcore/geo.py124 except Exception:CODE
LOWcore/geo.py153 except Exception:CODE
LOWcore/trailsbin.py124 except Exception:CODE
LOWcore/log.py225 except Exception:STRING
LOWcore/log.py397 except Exception:STRING
LOWcore/log.py427 except Exception:STRING
MEDIUMcore/log.py402def handle(self):CODE
MEDIUMcore/httpd.py881def process_request_thread(self, request, client_address):CODE
MEDIUMcore/httpd.py910def shutdown_request(self, request):CODE
MEDIUMcore/httpd.py1076def do_POST(self):CODE
LOWcore/httpd.py92except Exception:CODE
LOWcore/httpd.py128 except Exception:CODE
LOWcore/httpd.py135 except Exception:CODE
LOWcore/httpd.py197 except Exception:CODE
LOWcore/httpd.py249 except Exception:CODE
LOWcore/httpd.py280 except Exception:CODE
LOWcore/httpd.py475 except Exception:CODE
LOWcore/httpd.py488 except Exception:CODE
LOWcore/httpd.py552 except Exception:CODE
LOWcore/httpd.py589 except Exception:CODE
LOWcore/httpd.py722 except Exception:CODE
LOWcore/httpd.py868 except Exception:CODE
LOWcore/httpd.py875 except Exception:CODE
LOWcore/httpd.py895 except Exception:CODE
LOWcore/httpd.py913 except Exception:CODE
LOWcore/httpd.py1073 except Exception:CODE
LOWcore/httpd.py1138 except Exception:CODE
LOWcore/httpd.py1155 except Exception:CODE
LOWcore/httpd.py1209 except Exception:CODE
LOWcore/httpd.py1221 except Exception:CODE
LOWcore/httpd.py1274 except Exception:CODE
LOWcore/httpd.py1375 except Exception:CODE
LOWcore/httpd.py1396 except Exception:CODE
LOWcore/httpd.py1443 except Exception:CODE
LOWcore/httpd.py1547 except Exception:CODE
101 more matches not shown…
Over-Commented Block109 hits · 108 pts
SeverityFileLineSnippetContext
LOWinstall.sh1#!/bin/shCOMMENT
LOWruff.toml1# Python linting, so the server is held to a comparable bar to the sensor's clippy -D warnings.COMMENT
LOWruff.toml41# documented CPython thread-safety workaround, and a linter cannot know that).COMMENT
LOWdocker/entrypoint.sh1#!/bin/shCOMMENT
LOWdocker/entrypoint.sh101 chown "$want_uid:$want_gid" "$d" 2>/dev/null || :COMMENT
LOWdocker/tests/entrypoint_test.sh1#!/usr/bin/env bashCOMMENT
LOWcore/geo.py21from core.settings import GEO_IP2CC6_BUNDLED_FILECOMMENT
LOWcore/trailsbin.py1#!/usr/bin/env pythonCOMMENT
LOWcore/log.py381 #COMMENT
LOWcore/httpd.py1001 # third-party origin is allowed to execute code in the page that renders theCOMMENT
LOWcore/httpd.py1441 return "%s(%s)" % (callback, payload)COMMENT
LOWcore/assemble.py181COMMENT
LOWcore/custom_trails.py21# This used to be a directory inside the checkout (trails/custom/) that pretended to be a feed: anCOMMENT
LOWcore/settings.py181DNS_TUNNELING_MIN_ENTROPY_X100 = 300 # bits/char x100: base32 ~500, hex ~400, English ~200COMMENT
LOWcore/provenance.py1#!/usr/bin/env pythonCOMMENT
LOWcore/alert.py21from core.settings import MAX_ALERT_THROTTLE_KEYSCOMMENT
LOWcore/meta.py21COMMENT
LOWtests/run.sh1#!/bin/shCOMMENT
LOWtests/canaries.txt1# Domains and addresses that must never be flagged by a static trail.COMMENT
LOWtests/canaries-allow.txt1# Trails that match a popular domain and are RIGHT anyway.COMMENT
LOWtests/install/run.sh1#!/usr/bin/env bashCOMMENT
LOWtests/install/soname.sh1#!/usr/bin/env bashCOMMENT
LOWtests/install/assert.sh1#!/bin/shCOMMENT
LOWsensor/Cargo.toml21# TPACKET_V3 mmap ring on Linux.COMMENT
LOWsensor/Cargo.toml41# digest that can match them. It is never used to authenticate anything.COMMENT
LOWsensor/deny.toml1# cargo-deny: the checks `cargo audit` does not do.COMMENT
LOWsensor/build.rs1//! Turn a missing libpcap into a sentence somebody can act on.COMMENT
LOWsensor/tools/check_redistribution.py61# door. EC2, EBS, WORKSPACES and the rest are single-tenant and stay eligible for listing. GCP'sCOMMENT
LOWsensor/tools/check_trails.py261 # A dotless key is a bare-TLD trail (the `.xyz` entries in suspicious/domain.txt, with theCOMMENT
LOWsensor/tools/check_trails.py281 # leading dot - `.tk`, `.xyz`, `.cf` - which the loader strips and which this reads as "yes,COMMENT
LOWsensor/tools/check_trails.py401 if verdict:COMMENT
LOWsensor/tools/gen_corpus.py601 # 34. Two DIFFERENT DNS queries back-to-back on one socket in one second. sensor.py's burstCOMMENT
LOWsensor/tools/gen_corpus.py801 # A host/path trail whose BARE PATH is also a trail in its own right never produces theCOMMENT
LOWsensor/tools/check.sh1#!/bin/shCOMMENT
LOWsensor/tools/check.sh41echo "== generated files are in sync with core/settings.py and data/ua.txt =="COMMENT
LOWsensor/tests/loader_parity.rs1//! Differential loader test: the Rust loader vs `core.common.load_trails()`, on the REALCOMMENT
LOWsensor/tests/trails.rs441 let (db2, _) = trails::load(&second, &wl).unwrap();COMMENT
LOWsensor/tests/bounded_state.rs1//! Bounded state (ROADMAP Gate 1.5).COMMENT
LOWsensor/tests/fail_closed.rs181/// A capture that OPENS but cannot be read must not replay to "success" with zero packets.COMMENT
LOWsensor/tests/config_ranges.rs1//! Numeric option bounds (ROADMAP Gate 1.6).COMMENT
LOWsensor/tests/multi_pcap.rs1//! Multi-file offline replay shares one detection state (ROADMAP Gate 1.3).COMMENT
LOWsensor/tests/fuzz_parsers.rs1//! Deterministic fuzzing of every packet parser and of the whole packet path.COMMENT
LOWsensor/tests/generated.rs1//! Generated-file freshness.COMMENT
LOWsensor/tests/generated.rs141/// The `pub const ...` declaration inside one `;\n`-delimited chunk, or `None`.COMMENT
LOWsensor/tests/multi_worker_parity.rs1//! Multi-worker parity (ROADMAP Gate 2.2).COMMENT
LOWsensor/tests/meta.rs1//! The condensed observable store, end to end (`src/meta.rs` <-> `core/meta.py`).COMMENT
LOWsensor/tests/trail_update.rs1//! The sensor must REFRESH `trails.csv` itself, like `sensor.py:init():update_timer()` does.COMMENT
LOWsensor/tests/replay.rs1//! Offline pcap replay over the shipped corpus, through the real capture handle and DLTCOMMENT
LOWsensor/benches/hotpath.rs1//! Reproducible benchmarks for the Rust sensor's packet path.COMMENT
LOWsensor/src/addr.rs1//! Address helpers, byte-for-byte compatible with `core/addr.py`.COMMENT
LOWsensor/src/trailupdate.rs1//! Trail updating — `sensor.py:init():update_timer()`.COMMENT
LOWsensor/src/pyre.rs1//! Python `re` compatibility shims.COMMENT
LOWsensor/src/config.rs41/// packets/s it dropped over 90% of offered traffic, taking 63% of injected detections with it.COMMENT
LOWsensor/src/config.rs161 /// externally, e.g. pushed by the Maltrail server). Default OFF, i.e. the sensor refreshesCOMMENT
LOWsensor/src/config.rs681 // running fewer workers than PROCESS_COUNT wrote proportionally fewer lines for the sameCOMMENT
LOWsensor/src/config.rs721 // detection. A dropped packet is never seen by any of the detection logic, so this is theCOMMENT
LOWsensor/src/config.rs861 /// Force every numeric option into a range the sensor can actually operate in, recordingCOMMENT
LOWsensor/src/worker.rs81/// This is what `-r a.pcap,b.pcap` must do. Giving each file its own worker also gave it its ownCOMMENT
LOWsensor/src/worker.rs221 }COMMENT
LOWsensor/src/worker.rs281 // Close throttle windows on the same coarse tick.COMMENT
49 more matches not shown…
Decorative Section Separators27 hits · 90 pts
SeverityFileLineSnippetContext
MEDIUMinstall.sh148# ---------------------------------------------------------------------------------------------COMMENT
MEDIUMinstall.sh150# ---------------------------------------------------------------------------------------------COMMENT
MEDIUMinstall.sh208# ---------------------------------------------------------------------------------------------COMMENT
MEDIUMinstall.sh210# ---------------------------------------------------------------------------------------------COMMENT
MEDIUMinstall.sh258# ---------------------------------------------------------------------------------------------COMMENT
MEDIUMinstall.sh260# ---------------------------------------------------------------------------------------------COMMENT
MEDIUMinstall.sh439# ---------------------------------------------------------------------------------------------COMMENT
MEDIUMinstall.sh441# ---------------------------------------------------------------------------------------------COMMENT
MEDIUMinstall.sh552# ---------------------------------------------------------------------------------------------COMMENT
MEDIUMinstall.sh554# ---------------------------------------------------------------------------------------------COMMENT
MEDIUMinstall.sh590# ---------------------------------------------------------------------------------------------COMMENT
MEDIUMinstall.sh592# ---------------------------------------------------------------------------------------------COMMENT
MEDIUMinstall.sh622# ---------------------------------------------------------------------------------------------COMMENT
MEDIUMcore/quic_sni.py39# ---------------------------------------------------------------------------COMMENT
MEDIUMcore/quic_sni.py41# ---------------------------------------------------------------------------COMMENT
MEDIUMcore/quic_sni.py139# ---------------------------------------------------------------------------COMMENT
MEDIUMcore/quic_sni.py141# ---------------------------------------------------------------------------COMMENT
MEDIUMcore/quic_sni.py182# ---------------------------------------------------------------------------COMMENT
MEDIUMcore/quic_sni.py184# ---------------------------------------------------------------------------COMMENT
MEDIUMcore/quic_sni.py233# ---------------------------------------------------------------------------COMMENT
MEDIUMcore/quic_sni.py235# ---------------------------------------------------------------------------COMMENT
MEDIUMcore/tls_intel.py104# ---------------------------------------------------------------------------COMMENT
MEDIUMcore/tls_intel.py106# ---------------------------------------------------------------------------COMMENT
MEDIUMcore/tls_intel.py275# ---------------------------------------------------------------------------COMMENT
MEDIUMcore/tls_intel.py277# ---------------------------------------------------------------------------COMMENT
MEDIUMcore/tls_intel.py380# ---------------------------------------------------------------------------COMMENT
MEDIUMcore/tls_intel.py382# ---------------------------------------------------------------------------COMMENT
Deep Nesting84 hits · 70 pts
SeverityFileLineSnippetContext
LOWcore/update.py157CODE
LOWcore/update.py342CODE
LOWcore/update.py698CODE
LOWcore/update.py792CODE
LOWcore/update.py850CODE
LOWcore/index.py98CODE
LOWcore/log.py54CODE
LOWcore/log.py119CODE
LOWcore/log.py257CODE
LOWcore/log.py330CODE
LOWcore/httpd.py148CODE
LOWcore/httpd.py447CODE
LOWcore/httpd.py494CODE
LOWcore/httpd.py728CODE
LOWcore/httpd.py829CODE
LOWcore/httpd.py919CODE
LOWcore/httpd.py1091CODE
LOWcore/httpd.py1142CODE
LOWcore/httpd.py1231CODE
LOWcore/httpd.py1503CODE
LOWcore/httpd.py1721CODE
LOWcore/httpd.py1780CODE
LOWcore/httpd.py1828CODE
LOWcore/httpd.py1941CODE
LOWcore/httpd.py1959CODE
LOWcore/httpd.py2049CODE
LOWcore/httpd.py2202CODE
LOWcore/httpd.py2294CODE
LOWcore/httpd.py2382CODE
LOWcore/httpd.py2467CODE
LOWcore/addr.py108CODE
LOWcore/quic_sni.py338CODE
LOWcore/quic_sni.py377CODE
LOWcore/assemble.py109CODE
LOWcore/common.py66CODE
LOWcore/common.py155CODE
LOWcore/common.py231CODE
LOWcore/common.py382CODE
LOWcore/common.py446CODE
LOWcore/common.py464CODE
LOWcore/common.py493CODE
LOWcore/common.py530CODE
LOWcore/common.py701CODE
LOWcore/common.py407CODE
LOWcore/custom_trails.py34CODE
LOWcore/settings.py413CODE
LOWcore/settings.py593CODE
LOWcore/settings.py606CODE
LOWcore/settings.py626CODE
LOWcore/parallel.py65CODE
LOWcore/parallel.py83CODE
LOWcore/testing.py285CODE
LOWcore/tls_intel.py118CODE
LOWcore/tls_intel.py326CODE
LOWcore/meta.py213CODE
LOWtests/test_quic_sni.py230CODE
LOWtests/test_tls_intel.py204CODE
LOWtests/test_adversarial.py83CODE
LOWtests/test_httpd.py818CODE
LOWtests/test_httpd.py874CODE
24 more matches not shown…
Unused Imports40 hits · 34 pts
SeverityFileLineSnippetContext
LOWserver.py16CODE
LOWserver.py37CODE
LOWcore/update.py59CODE
LOWcore/update.py60CODE
LOWcore/update.py61CODE
LOWcore/update.py62CODE
LOWcore/geo.py12CODE
LOWcore/trailsbin.py25CODE
LOWcore/httpd.py21CODE
LOWcore/httpd.py76CODE
LOWcore/httpd.py77CODE
LOWcore/httpd.py78CODE
LOWcore/httpd.py79CODE
LOWcore/httpd.py85CODE
LOWcore/quic_sni.py23CODE
LOWcore/assemble.py8CODE
LOWcore/common.py44CODE
LOWcore/common.py45CODE
LOWcore/common.py46CODE
LOWcore/common.py47CODE
LOWcore/settings.py23CODE
LOWcore/settings.py24CODE
LOWcore/settings.py25CODE
LOWcore/settings.py26CODE
LOWcore/trailsdict.py8CODE
LOWcore/tls_intel.py20CODE
LOWcore/tls_intel.py21CODE
LOWtests/test_alert.py11CODE
LOWtests/test_adversarial.py13CODE
LOWtests/test_refs.py12CODE
LOWtests/test_refs.py16CODE
LOWtests/test_config.py108CODE
LOWfeeds/maxmind.py8CODE
LOWfeeds/cleantalk.py8CODE
LOWsensor/tools/check_redistribution.py32CODE
LOWsensor/tools/gen_vectors.py19CODE
LOWsensor/tools/gen_vectors.py30CODE
LOWsensor/tools/gen_vectors.py31CODE
LOWsensor/tools/gen_vectors.py32CODE
LOWsensor/tools/gen_vectors.py33CODE
AI Slop Vocabulary7 hits · 20 pts
SeverityFileLineSnippetContext
MEDIUMdocker/tests/entrypoint_test.sh13# It builds a small harness image rather than the real one: the entrypoint is the thing underCOMMENT
MEDIUMdocker/tests/entrypoint_test.sh15# harness copies the same entrypoint into the same directory layout, with a stub namedCOMMENT
MEDIUMsensor/tools/gen_corpus.py225# mode BOTH sensors stay silent here; the harness asserts these with --timestamps pcap.COMMENT
MEDIUMsensor/tools/gen_corpus.py242# breaks the harness instead of quietly restoring "parity" with a detection hole.COMMENT
MEDIUM.github/workflows/ci.yml44 # disagree in a way the parity harness structurally cannot see, because each is internallyCOMMENT
MEDIUM.github/workflows/ci.yml305 # This runs against a real daemon and takes about a minute: it builds a small harness imageCOMMENT
MEDIUM.github/workflows/ci.yml327 fetch-depth: 0 # the harness serves the clone from this checkout over file://CODE
Cross-Language Confusion3 hits · 15 pts
SeverityFileLineSnippetContext
HIGHtests/test_frontend.py197function portDir() { return null; } function hay(t) { return (t.info + " " + t.trail).toLowerCase(); }CODE
HIGHtests/test_frontend.py249for (var i = 0; i < 10; i++) slices.push({ k: "threat" + i, v: 100 - i });CODE
HIGHtests/test_frontend.py316 if (i && v <= t[i - 1]) die("not ascending");CODE
Verbosity Indicators3 hits · 4 pts
SeverityFileLineSnippetContext
LOWsensor/src/addr.rs142 // Step 1: re.findall("(?:0000:)+", address) -> maximal runs of the 5-byte unitCOMMENT
LOWsensor/src/addr.rs179 // Step 2: re.sub(r"(\A|:)0+(\w)", r"\g<1>\g<2>", address)COMMENT
LOWsensor/src/addr.rs223 // Step 3: a collapsed leading run yields a single ':' -> make it '::'.COMMENT
Structural Annotation Overuse3 hits · 4 pts
SeverityFileLineSnippetContext
LOWsensor/src/addr.rs142 // Step 1: re.findall("(?:0000:)+", address) -> maximal runs of the 5-byte unitCOMMENT
LOWsensor/src/addr.rs179 // Step 2: re.sub(r"(\A|:)0+(\w)", r"\g<1>\g<2>", address)COMMENT
LOWsensor/src/addr.rs223 // Step 3: a collapsed leading run yields a single ':' -> make it '::'.COMMENT
AI Structural Patterns2 hits · 2 pts
SeverityFileLineSnippetContext
LOWtests/test_tls_intel.py23CODE
LOWsensor/tools/gen_ja_vectors.py36CODE