[medium] Require AS prefix for high-confidence ASN detection

[elhoim]

BLUF — Bare digit strings such as a pasted port number are guessed as ASNs with near-certain confidence.

• Problem — looks_like_asn in bin/cli.py matches the regex ^(AS)?\d{1,10}$, making the AS prefix optional, so any bare one-to-ten digit string such as a pasted port number like 443 is scored 90 and presented as a near-certain ASN guess.
• Fix — Requires the AS prefix for the high-confidence match and adds a looks_like_bare_asn_digits helper that offers bare digit strings at score 20 instead.
• Effect — Type guessing keeps the suggestion but ranks it honestly, so --show-guesses output no longer leads with a spurious ASN.

Finding 22 (Medium) — bin/cli.py:182

Problem

looks_like_asn's ^(AS)?\d{1,10}$ makes the prefix optional, so any bare 1-10 digit string scores 90 as an ASN - verified for '12345' and '443' (a pasted port number).

Fix

looks_like_asn used the regex ^(AS)?\d{1,10}$, making the "AS" prefix optional, so any bare 1-10 digit string (e.g. "12345", or a pasted port number like "443") scored 90 and was confidently guessed as an ASN attribute. Fixed by requiring the "AS" prefix for the 90-score match (regex now ^AS\d{1,10}$), and adding a separate low-confidence path (score 20) for bare digit strings via a new looks_like_bare_asn_digits helper, so the guess is still offered but ranked appropriately low rather than near-certain.

Verification

Reproduced against the unmodified code at 9b8c605, then re-checked after the change.

Before

python3 -c "import sys; sys.path.insert(0,'bin'); import cli; print(cli.guess_attribute_types('443', {'AS'}, set()))" -> [('AS', 'matches ASN syntax')] with internal score 90 (near top confidence) for a bare port number.

After

Same call after fix -> [('AS', "bare digits could be an ASN without the 'AS' prefix")] with internal score 20 (low confidence); "AS12345" still correctly scores 90 via looks_like_asn.

python bin/cli.py --help exits 0 and the module still imports cleanly. Verification was performed offline against the pure functions — no running misp-modules instance is required.

Branched from 9b8c605. This PR addresses only this finding; the other findings from the same review are in separate PRs, so they will need rebasing against each other as they merge.

🤖 Generated with Claude Code