Explain Code Functionality

At Trend Micro, endpoint scanning agents submit file hashes to a shared classifier cache so an agent doesn't call the slow cloud classification API twice for the same hash inside one scan batch. Several agent worker threads on the same box share one ThreatHashCache instance.

import time

class ThreatHashCache:
    def __init__(self, ttl_seconds=300):
        self.ttl_seconds = ttl_seconds
        self.entries = {}  # file_hash -> (verdict, inserted_at)

    def add(self, file_hash, verdict):
        self.entries[file_hash] = (verdict, time.time())

    def lookup(self, file_hash):
        if file_hash in self.entries:
            verdict, inserted_at = self.entries[file_hash]
            age = time.time() - inserted_at
            if age <= self.ttl_seconds:
                return verdict
        return None

    def scan_batch(self, file_hashes, scanner):
        # scanner.classify(hash) calls the cloud classification API
        results = []
        seen = []
        for file_hash in file_hashes:
            if file_hash in seen:
                continue
            seen.append(file_hash)
            cached = self.lookup(file_hash)
            if cached is not None:
                results.append(cached)
                continue
            verdict = scanner.classify(file_hash)
            self.add(file_hash, verdict)
            results.append(verdict)
        return results

Walk through exactly what this code does, method by method. Then trace scan_batch(['h1', 'h2', 'h1', 'h3'], scanner) in detail, given that 'h3' was already cached 301 seconds ago and ttl_seconds is the default 300: say precisely which hashes call scanner.classify, what results ends up containing, and what self.entries looks like once the call returns.