hashlookup-server/doc/DATABASE.md

Database structure of hashlookup

hash storage

• l:<md5> key/value -> {sha1, sha1}
• h:<sha1> hash -> keys from NSRL or other data sources
• p:<sha1> set -> {sha1, sha1} for the parents of a hash (such as original packages)
• c:<sha1> set -> {sha1, sha1} for the children of a hash (such as files contained in a package)

Standard keys

• MD5
• SHA-1
• SHA-256
• TLSH
• SSDEEP
• FileName
• FileSize
• PackageArch
• PackageDescription
• PackageMaintainer
• PackageName
• PackageRelease
• PackageVersion
• KnownMalicious

Publish-Subscribe channels

• nx JSON message of non-existing hashes searched
• exist JSON message of existing hashes searched

Statistics

• s:nx:md5 sorted set of MD5 non-existing hashes
• s:nx:sha1 sorted set of SHA1 non-existing hashes
• s:exist:md5 sorted set of SHA1 existing hashes
• s:exist:sha1 sorted set of SHA1 existing hashes
• stat:<NSRLname> string with the number of items imported