Background

The concepts that are not Stairwell's: YARA rules, binary images and Hilbert curves, public suffixes, and what historical DNS is good for.

These pages explain ideas from the wider field rather than features of the product. They are here because the platform surfaces all of them, and a term you have not met is a term you cannot act on.

None of this assumes prior experience. What Is a YARA Rule? starts from why matching on file contents beats matching on a hash. What Are Hilbert Curves? teaches you to read the picture of a file's bytes. What Is a Public Suffix? is the one that decides what you can safely put in a blocklist.

Read them when you hit the term, or read them all in an afternoon and the rest of the site gets easier.


Did this page help you?