/**
 * @fileoverview Malware Detection Utilities
 * @module rules/malware/utils
 *
 * Core utility functions for malware detection including entropy calculation,
 * code normalization, obfuscation detection, and pattern matching helpers.
 */
import { SupportedLanguage, PatternMatch, SourceLocation, RegexPattern } from '../types';
/**
 * Calculate Shannon entropy of a string
 * Higher entropy indicates more randomness/potential obfuscation
 *
 * @param content - String to analyze
 * @returns Entropy value (0-8 for ASCII)
 */
export declare function calculateEntropy(content: string): number;
/**
 * Calculate entropy per line and detect anomalies
 *
 * @param content - Source code content
 * @returns Object with average entropy and lines with high entropy
 */
export declare function analyzeEntropyByLine(content: string): {
    averageEntropy: number;
    maxEntropy: number;
    highEntropyLines: Array<{
        line: number;
        entropy: number;
        content: string;
    }>;
};
/**
 * Normalize code for analysis by removing common obfuscation patterns
 * IMPORTANT: This does NOT execute any code
 *
 * @param content - Source code to normalize
 * @param language - Programming language
 * @returns Normalized code
 */
export declare function normalizeCode(content: string, language: SupportedLanguage): string;
/**
 * Remove comments from code based on language
 */
declare function removeComments(content: string, language: SupportedLanguage): string;
/**
 * Normalize whitespace
 */
declare function normalizeWhitespace(content: string): string;
/**
 * Safely decode escape sequences without execution
 */
declare function decodeEscapeSequences(content: string): string;
/**
 * Normalize string concatenation
 * "e" + "v" + "a" + "l" -> "eval"
 */
declare function normalizeStringConcatenation(content: string): string;
/**
 * Detect obfuscation level in code
 *
 * @param content - Source code to analyze
 * @param language - Programming language
 * @returns Obfuscation score (0-1)
 */
export declare function detectObfuscationLevel(content: string, language: SupportedLanguage): number;
/**
 * Detect anti-debugging techniques
 */
export declare function detectAntiDebugging(content: string, language: SupportedLanguage): {
    detected: boolean;
    techniques: string[];
};
/**
 * Detect environment-dependent activation (time bombs, sandbox evasion)
 */
export declare function detectEnvironmentChecks(content: string): {
    detected: boolean;
    checks: string[];
};
/**
 * Safe regex matching with timeout protection
 */
export declare function matchWithTimeout(content: string, pattern: RegExp, timeout?: number): Promise<RegExpMatchArray | null>;
/**
 * Apply regex pattern with safety limits
 */
export declare function safeRegexMatch(content: string, pattern: RegexPattern): PatternMatch[];
/**
 * Convert string index to line/column location
 */
export declare function getLocationFromIndex(content: string, startIndex: number, length: number): SourceLocation;
/**
 * Extract code snippet with context
 */
export declare function extractSnippet(content: string, location: SourceLocation, contextLines?: number): string;
/**
 * Detect and analyze base64 encoded content
 * Does NOT decode potentially malicious content
 */
export declare function analyzeBase64Content(content: string): {
    found: boolean;
    count: number;
    longestLength: number;
    locations: SourceLocation[];
};
/**
 * Extract suspicious strings from code
 */
export declare function extractSuspiciousStrings(content: string): {
    urls: string[];
    ips: string[];
    emails: string[];
    paths: string[];
    commands: string[];
};
export { removeComments, normalizeWhitespace, decodeEscapeSequences, normalizeStringConcatenation };
//# sourceMappingURL=index.d.ts.map