Quotient's request protection layer receives user-controlled text and a configurable list of known injection signatures. Implement a detector that identifies which signatures occur in a payload, including simple obfuscation through casing, whitespace, punctuation, or separators.
Normalize both the payload and every signature by converting ASCII letters to lowercase and removing all non-alphanumeric ASCII characters. Then find every normalized signature that appears as a contiguous substring of the normalized payload.
Return the zero-based indices of all matching signatures in ascending order. Each signature index must appear at most once. The detector must support many signatures efficiently, so scan the normalized payload once with an Aho-Corasick automaton.
Implement detect_signatures(payload, signatures). payload is a string. signatures is a non-empty list of non-empty strings. Return a list of integer signature indices.
A signature whose normalized form is empty does not occur because inputs are constrained to contain at least one ASCII letter or digit.
def detect_signatures(payload, signatures):