Problem statement: I am trying to generate regex for ip-address, domain and url. These are my defitions: IP Address: 93.114.205.169 Domain: example.com sub.example.com Url: 93.114.205.169/path example.com/path sub.example.com/path So, an url always has a path to resource. But an IP-Address or domain should not have path to resource otherwise it would be an URL. Also note that these IP-address, domain and url can have http or https optionally with or without www. My attempt: I have tried various ways for these regex: [[rules]] id = "ip-address" description = "Potential IP Address detected." regex = '''\b(?:[0-9]{1,3}\.){3}[0-9]{1,3}\b''' entropy = 2 keywords = ["ip"] [[rules]] id = "domain" description = "Potential domain name detected." regex = '''\b[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}\b''' entropy = 2 keywords = ["domain"] [[rules]] id = "url" description = "Potential URL detected." regex = '''\b(?:https?|ftp):\/\/(?:[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}|\d{1,3}(?:\.\d{1,3}){3})(?::\d{1,5})?(?:\/[^\s\"<>]*)?\b''' entropy = 2 keywords = ["http", "https", "ftp", "url"] But, these regex covering ip-address as url. For example, this ip-address http://93.114.205.169 is covering in url not as ip-address which should be only as ip-address but not as url according to my above definitions. I changed to these regex: [[rules]] id = "ip-address" description = "Potential IP Address detected." regex = '''\b(?:[0-9]{1,3}\.){3}[0-9]{1,3}\b''' entropy = 2 keywords = ["ip"] [[rules]] id = "domain" description = "Potential domain name detected." regex = '''\b[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}\b''' entropy = 2 keywords = ["domain"] [[rules]] id = "url" description = "Potential URL detected." regex = '''\b(?:https?|ftp):\/\/(?:[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}|\d{1,3}(?:\.\d{1,3}){3})(?::\d{1,5})?(?:\/[^\s\"<>]*)?\b''' entropy = 2 keywords = ["http", "https", "ftp", "url"] This also has same problem as above as http://93.114.205.169 recogize as url, but also it recognizing as ip-address too. It means it indentifies ip-address but it can also returning ip-addresses from urls like this http://93.114.205.169/path as url and 93.114.205.169 as ip-address. Could you suggest me correct regex for my these definitions: IP Address: 93.114.205.169 Domain: example.com sub.example.com Url: 93.114.205.169/path example.com/path sub.example.com/path These IP-address, domain and url can have http or https optionally with or without www. Continue reading...
