fix: optimize with aho-corasick

cli/src/main.rs

@@ -30,7 +30,6 @@ pub fn main() {
       .expect("Failed to create RPCServer")
   };
 
-
   // Starts the other threads (process detector, client connector, etc)
   client.start();
 

lib/Cargo.toml

@@ -11,8 +11,8 @@ serde_json = "1.0"
 serde_with = "3.11"
 simple-websockets = { git = "https://github.com/SpikeHD/simple-websockets.git", branch = "master" }
 chrono = "0.4"
-rayon = "1.7"
 interprocess = "2.2"
+aho-corasick = "1.1"
 
 [target.'cfg(target_os = "windows")'.dependencies]
 winapi = { version = "0.3", features = ["namedpipeapi", "winbase"] }

lib/src/lib.rs

@@ -1,5 +1,4 @@
 use detection::DetectableActivity;
-use rayon::iter::{IntoParallelRefMutIterator, ParallelIterator};
 use serde_json::Value;
 use server::{
   client_connector::ClientConnector,
@@ -56,25 +55,6 @@ pub struct RPCServer {
   on_process_scan_complete: Option<Arc<Mutex<ProcessCallback>>>,
 }
 
-// Make paths consistent, and fix some additional checks
-fn normalize_detectables(detectable: &mut Vec<DetectableActivity>) {
-  detectable.par_iter_mut().for_each(|activity| {
-    if let Some(ref mut execs) = activity.executables {
-      for exec in execs.iter_mut() {
-        // Replace backslashes with forward slashes and lowercase
-        exec.name = exec.name.replace('\\', "/").to_lowercase();
-
-        // Checks adapted from arrpc
-        if exec.name.starts_with(">") {
-          exec.name.replace_range(0..1, "/");
-        } else if !exec.name.starts_with("/") {
-          exec.name.insert(0, '/');
-        }
-      }
-    }
-  });
-}
-
 impl RPCServer {
   pub fn from_json_str(
     detectable: impl AsRef<str>,
@@ -86,7 +66,7 @@ impl RPCServer {
 
     // Turn detectable into a vector of DetectableActivity
     let detectable_arr = detectable.as_array();
-    let mut detectable: Vec<DetectableActivity>;
+    let detectable: Vec<DetectableActivity>;
 
     if let Some(detectable_arr) = detectable_arr {
       detectable = detectable_arr
@@ -98,10 +78,6 @@ impl RPCServer {
       detectable = vec![];
     }
 
-    log!("[RPC Server] Normalizing detectable activities...");
-    normalize_detectables(&mut detectable);
-    log!("[RPC Server] Done!");
-
     Ok(Self {
       detectable: Arc::new(Mutex::new(detectable)),
 
@@ -209,7 +185,6 @@ impl RPCServer {
       process_server: Arc::new(Mutex::new(ProcessServer::new(
         self.detectable.lock().unwrap().to_vec(),
         proc_event_sender,
-        8,
         ProcessEventListeners {
           on_process_scan_complete: self.on_process_scan_complete.clone(),
         },