--- title: YARA-X just got faster | daily.dev description: YARA-X, the Rust reimplementation of the YARA malware scanning engine, has received two major performance optimizations. First, it switched its Aho-Corasick... canonical: https://daily.dev/posts/yara-x-just-got-faster-88jjhmfvr twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: YARA-X just got faster | daily.dev og:description: YARA-X, the Rust reimplementation of the YARA malware scanning engine, has received two major performance optimizations. First, it switched its Aho-Corasick... og:url: https://daily.dev/posts/yara-x-just-got-faster-88jjhmfvr og:image: https://api.daily.dev/og/posts/88JjHMfvR.png og:image:alt: YARA-X just got faster og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # YARA-X just got faster **[YARA-X](https://daily.dev/sources/yara-x)** · 4 min read · 0 upvotes · 0 comments ## Summary YARA-X, the Rust reimplementation of the YARA malware scanning engine, has received two major performance optimizations. First, it switched its Aho-Corasick pattern matching implementation from the aho_corasick crate to daachorse, achieving a 2.20x speedup over the previous implementation and making YARA-X faster than legacy YARA in almost all cases (available since YARA-X v1.16.0). Second, an upcoming compiler optimization (v1.17.0) groups multiple regex checks against the same field into a single RegexSet, cutting VirusTotal Livehunt's 99th percentile scan time for domain-related rules from over 6 seconds to under 3 seconds, while also halving CPU costs. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Why did YARA-X switch from the aho_corasick crate to daachorse? YARA-X switched to daachorse for faster Aho-Corasick pattern matching because its byte-by-byte NFA traversal requires fewer memory indirections and its double-array automaton layout is more cache-efficient, reducing CPU cache misses on large files. Benchmarks on 500 VirusTotal files (~24GB) showed daachorse scanning in 26.152s versus 57.584s with aho_corasick, a 2.20x speedup, available starting in YARA-X v1.16.0. _daily.dev helps security engineers track scanning engine upgrades like this before rolling them into production._ ### How does grouping regex patterns into a RegexSet speed up YARA rule evaluation? Grouping identical match targets in an or condition into a single RegexSet lets the scanning engine make one pass over the target string instead of one pass per regex pattern. This shifts complexity from scaling linearly with pattern count to a single efficient scan, and this optimization ships in YARA-X v1.17.0, reducing redundant re-initialization and full-string rescans for rules with dozens or hundreds of matches checks. _Engineers optimizing complex rule sets can follow performance changes like this via daily.dev._ ### What performance impact did YARA-X's RegexSet optimization have on VirusTotal Livehunt? After deploying the RegexSet optimization to VirusTotal Livehunt, the 99th percentile execution time for domain-related rules dropped from over 6 seconds to under 3 seconds, and CPU costs for that workload were also cut in half. This came from grouping multiple regex checks against the same field into a single unified scan pass rather than evaluating each expression sequentially. _daily.dev keeps malware analysts current on scanning engine performance gains that affect production workloads._ ## Similar posts on daily.dev - [How to speed up the Rust compiler in July 2026](https://daily.dev/posts/how-to-speed-up-the-rust-compiler-in-july-2026-rsrjhr5xg) · Lobsters · 2 upvotes · 0 comments - [How AST-grep Rewrote Tree-sitter in Rust and Made It 30% Faster](https://daily.dev/posts/how-ast-grep-rewrote-tree-sitter-in-rust-and-made-it-30-faster-a1lxwchoq) · Hacker News · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#performance](https://daily.dev/tags/performance), [#rust](https://daily.dev/tags/rust) [View this post on daily.dev](https://daily.dev/posts/yara-x-just-got-faster-88jjhmfvr) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"YARA-X just got faster","url":"https://daily.dev/posts/yara-x-just-got-faster-88jjhmfvr","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/yara-x-just-got-faster-88jjhmfvr"},"datePublished":"2026-08-23T12:23:27.934Z","dateModified":"2026-08-23T12:56:09.421Z","description":"YARA-X, the Rust reimplementation of the YARA malware scanning engine, has received two major performance optimizations. First, it switched its Aho-Corasick...","image":"https://media.daily.dev/image/upload/s--foaA6JGU--/f_auto/v1722860399/public/Placeholder%2004","thumbnailUrl":"https://media.daily.dev/image/upload/s--foaA6JGU--/f_auto/v1722860399/public/Placeholder%2004","isAccessibleForFree":true,"articleSection":"YARA-X","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"YARA-X","logo":"https://media.daily.dev/image/upload/s--PuWW0skn--/f_auto,q_auto/v1787487499/logos/yara-x?_a=BAMAMicg0","url":"https://daily.dev/sources/yara-x"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/yara-x-just-got-faster-88jjhmfvr","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,performance,rust","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"YARA-X","item":"https://daily.dev/sources/yara-x"},{"@type":"ListItem","position":3,"name":"YARA-X just got faster"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/yara-x-just-got-faster-88jjhmfvr#faq","mainEntity":[{"@type":"Question","name":"Why did YARA-X switch from the aho_corasick crate to daachorse?","acceptedAnswer":{"@type":"Answer","text":"YARA-X switched to daachorse for faster Aho-Corasick pattern matching because its byte-by-byte NFA traversal requires fewer memory indirections and its double-array automaton layout is more cache-efficient, reducing CPU cache misses on large files. Benchmarks on 500 VirusTotal files (~24GB) showed daachorse scanning in 26.152s versus 57.584s with aho_corasick, a 2.20x speedup, available starting in YARA-X v1.16.0. daily.dev helps security engineers track scanning engine upgrades like this before rolling them into production."}},{"@type":"Question","name":"How does grouping regex patterns into a RegexSet speed up YARA rule evaluation?","acceptedAnswer":{"@type":"Answer","text":"Grouping identical match targets in an or condition into a single RegexSet lets the scanning engine make one pass over the target string instead of one pass per regex pattern. This shifts complexity from scaling linearly with pattern count to a single efficient scan, and this optimization ships in YARA-X v1.17.0, reducing redundant re-initialization and full-string rescans for rules with dozens or hundreds of matches checks. Engineers optimizing complex rule sets can follow performance changes like this via daily.dev."}},{"@type":"Question","name":"What performance impact did YARA-X's RegexSet optimization have on VirusTotal Livehunt?","acceptedAnswer":{"@type":"Answer","text":"After deploying the RegexSet optimization to VirusTotal Livehunt, the 99th percentile execution time for domain-related rules dropped from over 6 seconds to under 3 seconds, and CPU costs for that workload were also cut in half. This came from grouping multiple regex checks against the same field into a single unified scan pass rather than evaluating each expression sequentially. daily.dev keeps malware analysts current on scanning engine performance gains that affect production workloads."}}]} ```