Cell Phone

[Ron McKeating <R....@lboro.ac.uk>]

I am trying to get an understanding of how the SA rules work. Never been
too good at regex but trying to get better. Just had a false positive in
which a member of staff reporting her mobile phone theft got her email
filtered. The rule that mostly did for her was

body CELL_PHONE_BOOST          
/\b(?:(?:boost|antenna|reception).{0,16}(?:cell|mobile|phone|cord.?less)|(?:cell|mobile|phone|cord.?less).{0,16}(?:boost|antenna|reception))/i
describe CELL_PHONE_BOOST       Talks about cell-phone signal
improvement

Could somebody point me at an explanation of how these regex's work. 
Not sure of the role of '?'. I get the or '|'  also not sure how the
{0,16} works. Any pointers to what I should be reading to get a better
understanding of this would be much appreciated.

Ron

-- 
Ron McKeating
Senior IT Services Specialist
Internet Services and Software Solutions
Loughborough University
01509 222329

Re: Cell Phone

[Ron McKeating <R....@lboro.ac.uk>]

Thanks for this, it is very useful, and now obvious why she got hit, her
cell phone was stolen from "reception" where she had left it in a bag on
the desk. 

Cheers

Ron
On Tue, 2004-03-23 at 10:22, Loren Wilton wrote:
> http://www.perldoc.com/perl5.8.0/pod/perlre.html
> 
> The above describes how REs work in perl.  You may or may not find it
> readable on a first try.  It has certainly taken me more than a few tries.
> 
> > body CELL_PHONE_BOOST
> >
> /\b(?:(?:boost|antenna|reception).{0,16}(?:cell|mobile|phone|cord.?less)|(?:
> cell|mobile|phone|cord.?less).{0,16}(?:boost|antenna|reception))/i
> > describe CELL_PHONE_BOOST       Talks about cell-phone signal
> > improvement
> >
> > Could somebody point me at an explanation of how these regex's work.
> > Not sure of the role of '?'. I get the or '|'  also not sure how the
> > {0,16} works. Any pointers to what I should be reading to get a better
> > understanding of this would be much appreciated.
> 
> Thiings in parends are a group.  This is typically used for things like
> (a|or|b), which will match "a", "or", or "b".
> 
> However, parends also capture their contents, by default, so you can use it
> later.  This takes extra overhead.  If all you want to do is match things
> and you don't need to keep the match result around, perl has a hack where
> you put "?:" after the leading parend to tell it to not keep the contents.
> 
> The {n,m}, which can also be {n} or {,m}, is a thing that tells you how many
> times the previous thing has to match.  If I say, for instance, (?:a){15},
> then I am matching at least 15 "a" characters in a row.  The n,m form is a
> minumum of n times but presumably no more than m times.  (I'm personally not
> convinced the upper limit works in all cases, from results I've seen.)
> 
> Perl also has a bunch of handy metacharacters like \b and \B and the like.
> The web page above will tell you about these.
> 
> The quoted expression generally says "if boost|antenna|reception, is
> followed by 0 to 16 random characters, and is followed by
> cell|mobile|phone|cordless, then score a hit.  Alternately, if
> cell|mobile|phone|cordless is followed by 0 to 16 random characters and then
> boost|antenna|reception, also score a hit.
> 
> So the victim probably was talking about cell phone reception or the like.
> 
>         Loren
-- 
Ron McKeating
Senior IT Services Specialist
Internet Services and Software Solutions
Loughborough University
01509 222329

Re: Cell Phone

[Loren Wilton <lw...@earthlink.net>]

http://www.perldoc.com/perl5.8.0/pod/perlre.html

The above describes how REs work in perl.  You may or may not find it
readable on a first try.  It has certainly taken me more than a few tries.

> body CELL_PHONE_BOOST
>
/\b(?:(?:boost|antenna|reception).{0,16}(?:cell|mobile|phone|cord.?less)|(?:
cell|mobile|phone|cord.?less).{0,16}(?:boost|antenna|reception))/i
> describe CELL_PHONE_BOOST       Talks about cell-phone signal
> improvement
>
> Could somebody point me at an explanation of how these regex's work.
> Not sure of the role of '?'. I get the or '|'  also not sure how the
> {0,16} works. Any pointers to what I should be reading to get a better
> understanding of this would be much appreciated.

Thiings in parends are a group.  This is typically used for things like
(a|or|b), which will match "a", "or", or "b".

However, parends also capture their contents, by default, so you can use it
later.  This takes extra overhead.  If all you want to do is match things
and you don't need to keep the match result around, perl has a hack where
you put "?:" after the leading parend to tell it to not keep the contents.

The {n,m}, which can also be {n} or {,m}, is a thing that tells you how many
times the previous thing has to match.  If I say, for instance, (?:a){15},
then I am matching at least 15 "a" characters in a row.  The n,m form is a
minumum of n times but presumably no more than m times.  (I'm personally not
convinced the upper limit works in all cases, from results I've seen.)

Perl also has a bunch of handy metacharacters like \b and \B and the like.
The web page above will tell you about these.

The quoted expression generally says "if boost|antenna|reception, is
followed by 0 to 16 random characters, and is followed by
cell|mobile|phone|cordless, then score a hit.  Alternately, if
cell|mobile|phone|cordless is followed by 0 to 16 random characters and then
boost|antenna|reception, also score a hit.

So the victim probably was talking about cell phone reception or the like.

        Loren