YARA-X, the Rust reimplementation of the YARA malware scanning engine, has received two major performance optimizations. First, it switched its Aho-Corasick pattern matching implementation from the aho_corasick crate to daachorse, achieving a 2.20x speedup over the previous implementation and making YARA-X faster than legacy YARA in almost all cases (available since YARA-X v1.16.0). Second, an upcoming compiler optimization (v1.17.0) groups multiple regex checks against the same field into a single RegexSet, cutting VirusTotal Livehunt's 99th percentile scan time for domain-related rules from over 6 seconds to under 3 seconds, while also halving CPU costs.
Questions this post answers
Why did YARA-X switch from the aho_corasick crate to daachorse?
YARA-X switched to daachorse for faster Aho-Corasick pattern matching because its byte-by-byte NFA traversal requires fewer memory indirections and its double-array automaton layout is more cache-efficient, reducing CPU cache misses on large files. Benchmarks on 500 VirusTotal files (~24GB) showed daachorse scanning in 26.152s versus 57.584s with aho_corasick, a 2.20x speedup, available starting in YARA-X v1.16.0. daily.dev helps security engineers track scanning engine upgrades like this before rolling them into production.
How does grouping regex patterns into a RegexSet speed up YARA rule evaluation?
Grouping identical match targets in an or condition into a single RegexSet lets the scanning engine make one pass over the target string instead of one pass per regex pattern. This shifts complexity from scaling linearly with pattern count to a single efficient scan, and this optimization ships in YARA-X v1.17.0, reducing redundant re-initialization and full-string rescans for rules with dozens or hundreds of matches checks. Engineers optimizing complex rule sets can follow performance changes like this via daily.dev.
What performance impact did YARA-X's RegexSet optimization have on VirusTotal Livehunt?
After deploying the RegexSet optimization to VirusTotal Livehunt, the 99th percentile execution time for domain-related rules dropped from over 6 seconds to under 3 seconds, and CPU costs for that workload were also cut in half. This came from grouping multiple regex checks against the same field into a single unified scan pass rather than evaluating each expression sequentially. daily.dev keeps malware analysts current on scanning engine performance gains that affect production workloads.