This project adds an extension to the Postgres database server to allow querying data by TLSH similarity. TLSH is the Trend Micro Locality Sensitive Hash.
- Install pre-requisites: CMake, Postgres server dev packages. On Ubuntu/Debian, this can be done by running
sudo apt-get install cmake postgresql-server-dev-12
where 12 indicates the version of Postgres you're using. git clone --recursive https://github.com/malwaredb/tlsh_pg.git
cd tlsh_pg
- Build TLSH, since it generates a needed header file.
cd tlsh
./make.sh
mkdir build
cd build
cmake .. -DCMAKE_BUILD_TYPE=Release
make
- Installation & testing:
- Copy the resulting library to the Postgres
lib
directory, which is shown by runningpg_config --pkglibdir
. - As the Postgres user, run
psql DBNAME
, where you'll load the libary for the database schema you wish to use it with. This is done per-schema, as a privileged user. - At the psql prompt, run
CREATE OR REPLACE FUNCTION tlsh_compare(TEXT, TEXT) RETURNS INTEGER AS 'tlsh_psql.so', 'pg_tlsh_compare' LANGUAGE 'c';
. - Test by running
select tlsh_compare('T14814B643D364FEBFD624EAF8998AB8D5D4A5B0022BF00E5B65420EB704CE9D067543ED','T18784FA0392966E7FC9D6EFF8168BA4E5D562FC504BF0093B75404E3518CA9D0AB393E8');
. The result should be 233.
- Copy the resulting library to the Postgres